{"id":"37b01d1d-c9d7-4558-b37c-0fd5cac15ede","arxiv_id":"2507.03278","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"TwinShield securely outsources attention multiplication and softmax computation in Transformer inference from trusted CPU TEEs to untrusted GPUs, achieving 4.0x to 6.1x speedups.","lead":"TwinShield is a framework that lets Transformer models run largely on untrusted GPUs while keeping model weights and user data protected inside a trusted CPU enclave. It claims to speed up private, verifiable inference by 4.0x to 6.1x compared with earlier TEE-based outsourcing approaches.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"OutSoftMax is not implementable as written: no non-trivial e on Z_p (p=2^24-3) can satisfy e^{x+y}=e^x e^y, so Eqs. (12) and (15) cannot both be exact. The missing base/approximation is a mathematical gap, not a documentation detail.","rationale":"The reader correctly identified the unspecified base/approximation of the finite-field exponential in OutSoftMax as the weakest load-bearing assumption. My stress-test sharpens that concern: it is not merely a missing implementation detail. The equations that define OutSoftMax and U-Verify require an exact multiplicative homomorphism e^{x+y}=e^x e^y on the additive group of Z_p. For any prime p, the only such homomorphism into the multiplicative group F_p* is trivial, because a homomorphism maps 1 to an element of order dividing both p and p-1, and gcd(p,p-1)=1. With p = 2^24-3, this forces e^x = 1. Hence the protocol as written cannot be exact. If the authors intended a real-valued masked exponential computed on the GPU, that contradicts the quantization description in Section VI and the field notation in Section V-B. If they intended fixed-point polynomial approximation, the homomorphic recombination and the check-product verification are approximate, and neither the accuracy numbers in Table VI nor the security level in Theorem 3 covers the resulting error. If they intended modular exponentiation, the p-correction for negative numbers is incompatible with exponent arithmetic modulo p-1, and modular wrapping destroys any resemblance to the real exponential. This means the central claim—that the two dominant Transformer operations can be securely and accurately offloaded—is unsupported by a coherent primitive, not just underdocumented. The performance numbers in Tables I-III are therefore difficult to interpret, because they assume a working OutSoftMax. A concrete minimal test (x=-1, r=0, Eq. (12)) plus a forced U-Verify check would settle the matter quickly. I recommend REJECT for the current version, with the possibility of resubmission once the exponential construction, its error analysis, and reproducing code are provided.","tokens_in":22781,"tokens_out":11251,"duration_ms":160543,"concrete_test":"Run the following minimal experiment with the paper's stated parameters (p = 2^24-3, l = 8): take x = -1, set r = 0, apply Eqs. (10)-(12), and compare the recovered numerator to exp(-1). If the implementation uses modular exponentiation, this outputs 1, not ~0.368; if it uses a fixed-point polynomial, repeat the U-Verify check in Eq. (15) for 1000 random coefficient vectors a at n = 256 and measure the failure rate. Then rerun the LLaMA Wiki-Text perplexity and BERT SST-2 accuracy with Eq. (15) enforced and report the worst-case deviation. A single implementation that passes both the x=-1 check and Eq. (15) at the claimed accuracy would refute the impossibility concern; failure would confirm that the current protocol lacks a coherent definition of e^x.","verdict_should_be":"REJECT","load_bearing_attack":"The central claim—secure, accurate outsourced SoftMax—turns on OutSoftMax's Eqs. (10)-(12) and U-Verify's Eq. (15), which require an element e in F = Z_p, p = 2^24-3, such that e^{x'+r} = e^{x'} * e^r exactly. Over F, the additive group has order p and the multiplicative group has order p-1; since gcd(p, p-1) = 1, the only group homomorphism from (F,+) to (F*,*) is trivial, so any exact e^x must be 1 for all x. No nontrivial e can satisfy Eq. (12) exactly. If e is instead a fixed-point polynomial approximation of the real exponential, Eq. (12) and Eq. (15) hold only approximately, and the claimed 1.9% accuracy bound does not account for this homomorphism error. If e is modular exponentiation g^x, the protocol degenerates further: the stated correction for negative values (adding p) maps -a to p-a, but g^{p-a} = g^{-(a-1)} because g^{p-1}=1, not g^{-a}; for a=1 this yields 1 instead of exp(-1) ~ 0.368. Likewise g^x modulo p wraps for x larger than a few and does not approximate the real softmax numerator. Thus the mechanism said to offload 92.9% of SoftMax cost and drive the 4-6x speedup is not a defined, coherent primitive. The authors must specify the exact finite-field exponential and its error analysis before the headline claim can be evaluated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"TwinShield is a framework for private and verifiable Transformer inference in a hybrid setting where a trusted CPU enclave (SGX-like TEE) outsources most computation to untrusted GPUs or other accelerators. The paper identifies two bottlenecks that prior additive-outsourcing schemes leave inside the TEE: multiplicative attention matrix multiplications (Q·K^T and attention·V) and the non-linear SoftMax. It proposes OutAttnMult, which blinds both operands and embeds additional masked products into one outsourced multiplication to recover Q·K^T in the TEE; OutSoftMax, which masks SoftMax inputs and outsources the exponentials, recovering e^x by multiplying with precomputed e^r; and U-Verify, which inserts a random linear hash into the outsourced data and checks a product identity to detect tampering. The experiments report end-to-end speedups of 4.0x–6.1x over prior approaches on ViT, BERT, CLIP, and LLaMA, with at most a 1.9% accuracy drop, and additional measurements on FPGA and TPU accelerators.","tokens_in":23196,"tokens_out":6025,"duration_ms":75661,"significance":"If the protocols were fully specified and correct, this would be a meaningful advance over Slalom-style additive outsourcing: it would move the two most expensive attention-related operations out of the enclave while preserving data privacy, function privacy, and verifiable integrity. The paper is also commendable for evaluating on vision, language, and multimodal Transformers and for including accelerator diversity (GPU, FPGA, TPU). The main design idea—turning multiplicative attention products into embedded additive outsourcing, and using the exponential's homomorphic-like property to outsource SoftMax—is plausible and worth pursuing. However, the correctness of the entire contribution currently rests on an unspecified finite-field exponential map. Because the paper's headline accuracy, security, and speedup claims all depend on that primitive, the result cannot yet be regarded as established. The security proofs in the appendix are also informal at a load-bearing point.","major_comments":[{"comment":"The protocol is specified over F = Z_p with p = 2^24 - 3, but no finite-field exponential e is defined. The exact equalities e^{x'_i} · e^{r_i} = e^{x_i} in Eq. (12) and ∏(e^{x_i})^{a_i} = e^{Σ a_i x_i} in Eq. (15) require e to be a group homomorphism from the additive group (F,+) to the multiplicative group (F^×,·). Since the additive group has order p and the multiplicative group has order p-1, and gcd(p, p-1) = 1, the only such homomorphism is trivial; no non-constant e satisfies these identities exactly. If e is instead a fixed-point polynomial approximation of the real exponential, Eqs. (12) and (15) hold only approximately and the stated at-most-1.9% accuracy bound does not account for that approximation error. If one tries modular exponentiation g^x, the stated correction for negative values (adding p) gives g^{p-a} = g^{-(a-1)}, not g^{-a}, and g^x wraps for x larger than a few, so that choice also does not approximate the real SoftMax numerator. Please specify the exact function computed by the accelerator (base, polynomial approximation, overflow handling, dequantization) and provide a correctness/error analysis that supports the reported accuracy and the claimed 92.9% offload of SoftMax cost.","section":"V-B, Eqs. (9)-(14)"},{"comment":"The formal security claim for OutAttnMult rests on Lemma 1, which is asserted rather than proved. Lemma 1 states that an attacker cannot reconstruct QK^T from the observed ^QK^T and (QK^T)' because the transformations f and g are unknown; but in the protocol f and g are the published recovery and masking procedures, and only the random masks, scalars, and permutation keys are secret. The lemma therefore needs to be reduced to indistinguishability of those secret values. As written, Theorem 1 essentially restates the desired property rather than proving it. Theorem 2 also assumes without derivation that the attacker's choices (original vectors, masks, scalar coefficients, and permutation) are independent and uniform; this requires a proof or a precise statement of the distribution over the feasible set F(^X).","section":"Appendix, Theorem 1 and Lemma 1"},{"comment":"The U-Verify check for OutSoftMax inherits the same finite-field exponential problem: the equality ∏(e^{x_i})^{a_i} = e^{Σ a_i x_i} is exact only if e is a group homomorphism from the additive group to the multiplicative group. Consequently, the stated attack-success probability of 1/(n·2^d) in Section V-C is not meaningful for any non-trivial implementation. In addition, the main text says the coefficients a_i are drawn from a space of size 2^d, while Appendix A says the coefficients are integers in (−L, L) and gives a success factor (1/2L)^k; these two descriptions should be reconciled, and the forgery probability should be derived with respect to the actual distribution used.","section":"V-C, Eq. (15) and Security Analysis"},{"comment":"The accuracy evaluation compares the original floating-point model with a quantized model, not with the full TwinShield protocol. The reported at-most-1.9% drop therefore does not include any error introduced by the outsourced exponentiation, the scalar recovery/division steps, or modular arithmetic. Please report end-to-end accuracy/perplexity of the complete TwinShield pipeline (including GPU execution and TEE recovery) against the floating-point baseline, ideally with a breakdown of quantization error versus protocol error.","section":"VI, Table VI"}],"minor_comments":[{"comment":"The text says 'For an input vector X ∈ F^n', but the SoftMax input in a real Transformer is real-valued; please clarify where fixed-point quantization and dequantization occur relative to Eqs. (9)–(14).","section":"V-B"},{"comment":"The sentence 'For negative values, a correction p is applied' should specify the representative range and explain how multiplication and division modulo p interact with the fixed-point scale 2^l, especially because p = 2^24 - 3 is not a power of two.","section":"VI"},{"comment":"The abstract reports 4.0x–6.1x speedups, while the conclusion says 3.9x–6.1x for private verifiable inference; make these numbers consistent.","section":"VIII"},{"comment":"The feasible-set construction uses t−n random masks and a parameter r ('obfuscation ratio') that is not defined in the protocol; please define t, r, and their relation to the matrix dimensions in Section V-A.","section":"Appendix A"}],"recommendation":"major_revision","confidential_remarks":"The reported experiments are extensive and I see no evidence of fabrication, but the central correctness and security claims currently depend on an unspecified finite-field exponential. This is a mathematical gap rather than a mere presentation issue, so I recommend requesting a revised version that defines the exact exponential computation, proves (or rigorously bounds) its approximation error and the resulting security guarantees, and reports end-to-end accuracy of the full protocol. If such a definition and analysis are provided, the paper could become suitable for publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about this one. First, the OutAttnMult protocol is a real, inventive step: it extends the additive-outsourcing trick (masking, then subtracting precomputed mask products) to multiplicative attention operations by embedding scaled masks and using permutations, and it does so in a way that prior Slalom/DarKnight-style systems did not. The U-Verify product check for softmax is also a clever Freivalds-style variant for a non-linear operation. Second, the OutSoftMax primitive, which is the paper's main selling point, is not a defined primitive as written. The protocol requires an element e in Z_p, p = 2^24-3, such that e^{x+r} = e^x * e^r exactly. Over a finite field the additive group has order p and the multiplicative group has order p-1; gcd(p, p-1) = 1, so the only exact homomorphism is the trivial one. No nontrivial e satisfies Equation (12). If instead e is a fixed-point approximation, the protocol holds only approximately, and the claimed 1.9% accuracy drop does not account for the homomorphism error. The paper never specifies the base or approximation, and the quantization section does not fill that gap. That is not a documentation detail; it is the mechanism that offloads 92.9% of softmax cost and drives the 4-6x speedups.\n\nThe paper does some things well. The ablation study is thorough, the latency breakdowns are useful, and the evaluation spans multiple model families and accelerators. The security appendix, though, is informal in a way that matters: Lemma 1 is asserted as a postulate, and Theorem 1's proof leans on that postulate, so the confidentiality argument for OutAttnMult is not fully established. That alone would merit revision, but the OutSoftMax gap is load-bearing.\n\nWho gets value from this paper? Anyone working on TEE-based ML outsourcing will want to read the OutAttnMult idea and the U-Verify product-check construction, because those are salvageable and probably worth building on. The paper deserves a serious referee, but not acceptance in its current form. My recommendation: send it to review with a request that the authors specify the finite-field exponential and its error analysis, or provide code and measurements that demonstrate it actually works, and formalize the security lemmas. As it stands, I would not cite it for the softmax result, and I would flag the OutSoftMax equations for the authors before any publication.","headline":"OutAttnMult is a genuine extension of prior outsourcing work, but OutSoftMax's field exponential is not implementable as written and the headline speedups rest on it.","tokens_in":23703,"tokens_out":2190,"would_cite":false,"duration_ms":27062,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TwinShield claims attention multiplication and SoftMax can run on untrusted GPUs without leaking data or model, at 4.0x–6.1x speedups.","keywords":["trusted execution environment","secure outsourced inference","Transformer attention","SoftMax outsourcing","verifiable computation","secret sharing","GPU offloading","privacy-preserving machine learning"],"falsifier":"Re-implement OutSoftMax exactly as specified — 8-bit fixed-point inputs, field $\\mathbb{Z}_p$ with $p = 2^{24}-3$, masked values sent to a GPU that returns field exponentials — and measure end-to-end accuracy on ImageNet (ViT, CLIP), SST-2 (BERT), and WikiText perplexity (LLaMA). Unless some concrete definition of 'computes $e^{x_i}$' in $\\mathbb{Z}_p$ reproduces the reported at-most-1.9% accuracy drop and 0.21 perplexity increase, the correctness claim is not yet supported.","tokens_in":22587,"feed_emoji":"🔒","tokens_out":14338,"duration_ms":139523,"temperature":0.7,"pith_summary":"TwinShield is a scheme for running Transformer inference across a trusted CPU enclave and an untrusted GPU, and its central claim is that the two operations that dominate private inference — the attention product $QK^T$ and the SoftMax — can be handed to the accelerator without revealing the input data or the model and with results that can be checked. Prior hybrid schemes could outsource only linear layers whose weights are constants, because the attention product multiplies two runtime matrices and SoftMax is nonlinear; both therefore stayed in the enclave and became the bottleneck. TwinShield masks $Q$ and $K^T$ with random matrices and hides scaled copies of the masks inside permuted blocks so the GPU cannot tell data from mask, and it outsources exponentials by exploiting $e^{x - r} e^{r} = e^x$, leaving only sums and divisions inside the enclave. If the claim holds, about 87% of Transformer computation leaves the trusted hardware, with 4.0x to 6.1x faster verified inference than earlier secure schemes at no more than 1.9% accuracy loss.","feed_headline":"87% of Transformer compute moves to GPUs without leaking","feed_subtitle":"Attention and SoftMax leave the enclave at 4x–6x speedups over prior secure-outsourcing schemes.","key_machinery":"Three paired mechanisms carry the argument. The embedded additive outsource (OutAttnMult) is the central object for multiplicative attention: rather than precomputing a mask–weight product (impossible when both operands are runtime matrices), it stacks $Q + R_Q$ with a scaled mask block $a R_Q$ (and likewise for $K^T$), permutes the blocks with secret indices, and outsources one enlarged product, from which the enclave recovers $QK^T$ by scalar multiplications and subtractions. The exponential homomorphism (OutSoftMax) is the mechanism for the nonlinear step: the identity $e^{x - r} e^r = e^x$ moves $n$ enclave exponentiations to the GPU and leaves $2n$ multiplications and $n$ additions in the enclave. The check-product protocol (U-Verify) is the mechanism for integrity: a secret random vector $a$ hashes the input before masking, and verification is the identity $\\prod_i (e^{x_i})^{a_i} = e^{\\sum_i a_i x_i}$ for SoftMax and $h_Q (QK^T) = (h_Q Q) K^T$ for attention — both cheaper to check than to recompute, and both protected by fresh one-time masks.","core_discovery":"On the paper's own terms, the discovery is that neither blocker to outsourcing is fundamental. For the attention multiplication, OutAttnMult blinds $Q$ and $K^T$ with random masks $R_Q$ and $R_{K^T}$, concatenates scaled masks $a R_Q$ and $b R_{K^T}$ into the blinded matrices, and permutes rows and columns before sending them to the GPU; the GPU's single enlarged product contains all the cross terms, and the enclave recovers $QK^T$ with scalar multiplications and additions, having turned a cubic enclave computation into quadratic recovery work. For SoftMax, OutSoftMax relies on the identity $e^{x_i} = e^{x_i - r_i} \\cdot e^{r_i}$: the enclave sends masked values $x_i - r_i$, the GPU returns $e^{x_i - r_i}$, and the enclave restores $e^{x_i}$ by one multiplication with the precomputed $e^{r_i}$, keeping only the normalization sum and divisions inside. For integrity, U-Verify inserts a randomly weighted hash of the input — $\\sum_i a_i x_i$ for SoftMax, a hash row $h_Q \\cdot Q$ for attention — before masking, and afterwards checks a product identity such as $\\prod_i (e^{x_i})^{a_i} = e^{\\sum_i a_i x_i}$, which a tampering GPU cannot satisfy without knowing the coefficients, the masks, and where the hash was inserted. The paper reports roughly 87% of computation offloaded, 4.0x to 6.1x speedups with verification over prior schemes across vision, language, and multimodal Transformers, and at most 1.9% accuracy loss under 8-bit fixed-point quantization into the field $\\mathbb{Z}_p$ with $p = 2^{24} - 3$.","pith_inferences":["The OutSoftMax trick belongs to a general family: any function obeying $f(x + r) = f(x) \\cdot g(r)$ with $g$ precomputable can be outsourced identically, so other nonlinearities (for instance exponentials inside GeLU or normalization) are natural candidates for the same treatment.","The practical correctness claim rests on an unstated implementation detail: the paper does not say how $e^x$ is approximated inside $\\mathbb{Z}_{2^{24}-3}$, so a published, reproducible instantiation of that step with a full error analysis is the direct next test of the claimed 1.9% accuracy bound.","The privacy argument's weakest spot is the indistinguishability of the scaled-mask blocks from the blinded-data blocks after permutation; a statistical distinguishing experiment on $[Q + R_Q; a R_Q]$ across repeated inferences would stress-test exactly that assumption.","The enclave still performs the SoftMax sum and the divisions, so the $O(N)$ normalization step remains trusted; outsourcing the denominator itself would require a masking identity for division and is the natural next scale-up for very long sequences."],"forward_implications":["The enclave's attention work drops from cubic matrix multiplication to quadratic vector–matrix and element-wise work, so the speedup grows with sequence length: the paper reports 2.8x at 64 tokens rising to 10.7x at 256 tokens with verification.","Because SoftMax exponentiation leaves the enclave, long-context inputs — where the $O(N^2)$ attention map would otherwise dominate enclave time — become the regime where TwinShield gains the most.","U-Verify also improves verification of already-outsourced linear layers: embedding a hash row cuts the enclave check from three vector–matrix products to two, about 33% faster than Freivalds' algorithm on attention multiplication.","The same protocols run on FPGAs and TPUs as well as GPUs (1.93x–3.25x and 7.43x–10.91x latency reductions over TEE-only execution), so the approach does not depend on which accelerator the cloud happens to have."],"supporting_citations":[{"why":"States the Transformer attention formula $Attention(Q,K,V) = SoftMax(QK^T/\\sqrt{d_h})V$ that TwinShield targets for outsourcing.","marker":"[1]"},{"why":"The all-in-enclave inference baseline that all experiments are compared against.","marker":"[18]"},{"why":"Supplies the additive-outsourcing recipe of masking inputs and precomputing the mask–weight product, which TwinShield adapts and must beat.","marker":"[19]"},{"why":"The prior additive-outsource framework whose quantization approach TwinShield extends to multiplicative and nonlinear operations.","marker":"[22]"},{"why":"The randomized matrix-verification algorithm U-Verify replaces for linear checks and that cannot verify SoftMax, motivating the check-product protocol.","marker":"[25]"},{"why":"The secret-sharing foundation for the claim that a random mask share hides the input from the accelerator.","marker":"[36]"}],"fun_headline_variants":["Attention and SoftMax leave the enclave at 4x–6x speedups","TwinShield offloads 87% of Transformer compute to GPUs securely","Secure offloading of Attention and SoftMax: 4x–6x faster inference","Crypto-protected GPUs enable dual protection for Transformer inference","With TwinShield, attention and softmax safely offload from TEEs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme's correctness rests on an unstated implementation choice: the real-valued exponentials in SoftMax are assumed to be computable inside the paper's small finite field (prime $p = 2^{24} - 3$) with an approximation accurate enough that accuracy drops at most 1.9%, but the paper never specifies what that computation is.","fun_headline_variants_meta":{"raw":{"variants":["Attention and SoftMax leave the enclave at 4x–6x speedups","TwinShield offloads 87% of Transformer compute to GPUs securely","Secure offloading of Attention and SoftMax: 4x–6x faster inference","Crypto-protected GPUs enable dual protection for Transformer inference","With TwinShield, attention and softmax safely offload from TEEs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000477,"raw_usage":{"total_tokens":2506,"prompt_tokens":1228,"completion_tokens":1278,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":844,"completion_tokens_details":{"reasoning_tokens":1173}},"tokens_in":844,"tokens_out":1278,"duration_ms":12195,"temperature":1.0,"reasoning_tokens":1173,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T20:15:34.075676+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-implement OutSoftMax exactly as specified — 8-bit fixed-point inputs, field $\\mathbb{Z}_p$ with $p = 2^{24}-3$, masked values sent to a GPU that returns field exponentials — and measure end-to-end accuracy on ImageNet (ViT, CLIP), SST-2 (BERT), and WikiText perplexity (LLaMA). Unless some concrete definition of 'computes $e^{x_i}$' in $\\mathbb{Z}_p$ reproduces the reported at-most-1.9% accuracy drop and 0.21 perplexity increase, the correctness claim is not yet supported.","supporting_citations":[{"cited_title":"Mlcapsule: Guarded offline deployment of machine learning as a service,","cited_arxiv_id":null,"evidence_quote":"The all-in-enclave inference baseline that all experiments are compared against."},{"cited_title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,","cited_arxiv_id":null,"evidence_quote":"Supplies the additive-outsourcing recipe of masking inputs and precomputing the mask–weight product, which TwinShield adapts and must beat."},{"cited_title":"Darknight: An accelerated framework for privacy and integrity preserving deep learning using trusted hardware,","cited_arxiv_id":null,"evidence_quote":"The prior additive-outsource framework whose quantization approach TwinShield extends to multiplicative and nonlinear operations."},{"cited_title":"Probabilistic machines can use less running time","cited_arxiv_id":null,"evidence_quote":"The randomized matrix-verification algorithm U-Verify replaces for linear checks and that cannot verify SoftMax, motivating the check-product protocol."},{"cited_title":"Cramer, I","cited_arxiv_id":null,"evidence_quote":"The secret-sharing foundation for the claim that a random mask share hides the input from the accelerator."}],"review_version":1}