{"id":"3eec9da1-28cd-44d0-9b13-73d4dc6f7c90","arxiv_id":"2508.19525","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"BLB combines operator-level fusion with a new secure CKKS-to-MPC conversion, reporting up to 21x less communication and 13x lower GPU latency than BOLT for private Transformer inference.","lead":"BLB is a new framework for private Transformer inference that fuses fine-grained linear operators and adds a secure CKKS-to-MPC conversion, cutting communication and latency versus leading hybrid HE/MPC systems. If the numbers hold, privacy-preserving BERT and GPT inference becomes dramatically cheaper over real networks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's proof compares Algorithm 1 to an ideal functionality whose P0 share distribution does not match the real field-to-ring output; the security guarantee for the CKKS-to-MPC conversion is unproven as stated.","rationale":"The reader's weakest assumption pointed at the same region: whether the uniform mask in AN,q remains statistically close to uniform after modulus switching to Z_{2^43} and coefficient-wise decoding. My review sharpens this into a concrete mismatch: the proof compares against an ideal functionality whose P0 input to Decode is (x+r mod 2^l), whereas the real protocol feeds Decode with ((x+r mod q) mod 2^l). These distributions differ, and the difference is not a negligible-rounding artifact; it is structural whenever q is not a multiple of 2^l. The proof's invocation of the field-to-ring simulator does not bridge this gap because Appendix C.3's conversion is deterministic given the q-shares. The protocol may still be secure under a correctly formulated functionality, but the paper's stated Theorem 1 is not proven by the supplied argument. I do not escalate to REJECT because the concern is about the proof artifact and ideal specification, not a demonstrated attack on the real protocol; the conditional verdict remains appropriate. Separately, the abstract's 13x latency reduction versus BOLT is not supported by Table 9, which shows at most about 6.6x GPU speedup over BOLT; this is a second, less load-bearing inconsistency that should be corrected in a revision. The reader's conditional verdict already captures the need for a stronger security argument, so I leave the verdict unchanged.","tokens_in":31042,"tokens_out":13945,"duration_ms":129059,"concrete_test":"Implement a toy instance of Algorithm 1 and Figure 9 with q=17, 2^l=4, N=1 (or any small q,l). For each x in Z_q, enumerate r in Z_q and compare the distribution of P0's real pre-decode share, ((x+r mod q) mod 2^l), with the ideal Figure 9 value ((x+r) mod 2^l). The distributions differ, falsifying Theorem 1 as stated. Then test the fix: replace Figure 9's step 3 with sampling a share from the real distribution and setting P1's share so the two sum to Encode(x) mod 2^l; verify that the real protocol's joint output is computationally indistinguishable from this corrected ideal, which would salvage the protocol under a revised theorem.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central security claim is Theorem 1 (Appendix A): Algorithm 1 securely realizes FC2M in Figure 9. The proof's output step asserts that in both real and ideal executions the parties receive decoded results of uniformly distributed polynomials over A_{N,2^l}, so the joint distributions match. This is where the argument breaks. In Algorithm 1, before Field-to-Ring the shares are (Encode(x)+r) mod q and -r mod q. After the field-to-ring extension of Appendix C.3 and local reduction modulo 2^l, P0's pre-decode share is ((Encode(x)+r mod q) mod 2^l). Because r is uniform in Z_q, the inner value is uniform over Z_q, so after reduction this share has a fixed distribution independent of Encode(x). In the ideal FC2M, P0's input to Decode is (Encode(x)+r mod 2^l) (Figure 9, step 3). Since r mod 2^l is biased whenever q is not a multiple of 2^l (here q~2^60, l=43), this distribution shifts with Encode(x). Concretely with q=7, 2^l=4, x=1, r=6: real share=(1+6 mod 7) mod 4=0; ideal=1+6 mod 4=3. The two distributions are not identical, so the proof's 'exactly how Algorithm 1 computes' sentence is false. The proof also does not show that field-to-ring re-randomizes shares to the ideal distribution; Appendix C.3 describes only signed extension plus local mod reduction, which is deterministic. Consequently Theorem 1, as stated, is not established. This does not prove the protocol insecure; a corrected functionality sampling the real pre-decode distribution might admit a simulator, but that corrected theorem is absent.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BLB, a hybrid CKKS/MPC framework for private Transformer inference. It breaks the conventional layer-wise evaluation into fine-grained linear-operator fusion, uses CKKS for the fused linear operators to control ciphertext bit-width growth, and introduces a CKKS-to-MPC (and reverse) conversion protocol claimed to be the first secure one. It also designs a rotation-efficient ciphertext-ciphertext MatMul protocol with multi-head packing and BSGS optimization. The evaluation reports large communication and latency improvements over BOLT and Bumblebee on BERT-base, BERT-large, and GPT2-base, with accuracy close to plaintext inference. The central security claim is Theorem 1, which asserts that the CKKS-to-MPC conversion in Algorithm 1 securely realizes the FC2M functionality in Figure 9.","tokens_in":31423,"tokens_out":6403,"duration_ms":59769,"significance":"If the results hold, BLB is a practically significant step for private Transformer inference: it reduces communication by roughly an order of magnitude compared to BOLT, improves GPU latency, and preserves accuracy without fine-tuning. The paper includes a concrete artifact DOI and reports comparisons against multiple baselines on the same hardware, which is a strength. The fine-grained fusion taxonomy and the diagonal-packing MatMul protocol are useful technical contributions. However, the load-bearing security proof of the CKKS-to-MPC conversion has a distributional gap, and the end-to-end performance claim contains an internal inconsistency in Section 7.3. The significance is therefore conditional on a corrected security argument and a reconciled performance statement.","major_comments":[{"comment":"The proof's assertion that the real protocol outputs are 'exactly how Algorithm 1 computes' the ideal outputs is not correct under the definitions given. In Algorithm 1, after decryption P0 holds (Encode(x)+r mod q), and after Field-to-Ring (Appendix C.3: signed extension plus local mod reduction) the pre-decode share is ((Encode(x)+r mod q) mod 2^l). Since r is uniform over Z_q, this value is independent of Encode(x). In the ideal functionality FC2M (Figure 9), P0's pre-decode value is Encode(x)+r mod 2^l with r drawn uniformly from the same Z_q; because r mod 2^l is non-uniform when q is not a multiple of 2^l, this distribution depends on Encode(x). The proof's claim that both real and ideal outputs are decoded results of uniformly distributed polynomials over A_{N,2^l} is therefore not established. Appendix C.3 describes Field-to-Ring as a deterministic signed extension followed by local reduction, so the proof also does not show that this step re-randomizes the shares to the ideal distribution. This is a load-bearing gap in the paper's central security claim; please either prove Theorem 1 with a correctly specified functionality (for example, one that samples the actual post-reduction distribution) or provide a formal analysis of the full Field-to-Ring composition.","section":"Appendix A, proof of Theorem 1; Algorithm 1; Figure 9"},{"comment":"The text states that BLB reduces communication by 'approximately 4x and 2x across three models compared to BOLT and Bumblebee, respectively.' This is inconsistent with the abstract's 21x/2x claim and with Table 9, where BERT-base BOLT is 63.6 GB versus BLB 3.0 GB (21.2x), GPT2-base BOLT is 34.8 GB versus BLB 1.5 GB (23.2x), and BERT-large BOLT is 158.9 GB versus BLB 7.8 GB (20.4x). Figure 11's '4x' label is also ambiguous. Please correct the text and figure or clearly state what quantity is being compared; as written, the headline performance claim is internally inconsistent.","section":"Section 7.3, Communication Breakdown Analysis; Figure 11; Table 9"},{"comment":"The paper describes BLB as a private inference framework and assumes an honest-but-curious adversary, but the only formal security statement is Theorem 1 for Algorithm 1. The security of the complete protocol, including Algorithm 2 (MPC-to-CKKS), the fused MatMul protocols, and the probabilistic truncation in Appendix C.4, is not covered by a stated composition argument. Since the truncation functionality in Figure 16 intentionally leaks the cutoff point to the adversary, the interplay between that leakage and the FC2M simulator needs an explicit treatment. Please either state an end-to-end security theorem for the full BLB protocol or clearly delimit the security guarantee to the conversion building block.","section":"Section 3 and Appendix A, overall security claim"}],"minor_comments":[{"comment":"The figure label 'Nonliner' should be 'Nonlinear'.","section":"Figure 5"},{"comment":"The abstract states a '13x' latency reduction without qualification, while Section 9 says 'up to 13x'. The qualified form is more accurate given Table 9 (the 13x figure appears only for BERT-large at WAN2 on GPU), so please use 'up to' consistently.","section":"Section 9 and abstract"},{"comment":"The proof of the modified probabilistic truncation functionality is delegated to 'Section 3 in [19]' rather than being summarized or stated in the paper. At minimum, the realized functionality and the simulation argument should be specified, since the truncation protocol is used in the full inference pipeline.","section":"Appendix C.4"},{"comment":"The paper says OT primitives do not affect protocol construction, but Table 9 explicitly uses VOLE-OT for BLB while Figures 12 and 13 report BLB with both IKNP and VOLE variants. Please make the OT-primitive choice explicit in every comparison so readers can reproduce the numbers.","section":"Section 7.1 and Table 9"}],"recommendation":"major_revision","confidential_remarks":"The engineering and evaluation are strong, and the artifact DOI is a positive signal. The main risk is the security proof of Theorem 1: the described distributional mismatch is a genuine gap that must be fixed before the 'first secure CKKS-to-MPC conversion' claim can be accepted. I would recommend that the revised version be checked by a referee with detailed simulation-based cryptography expertise, and that the Section 7.3 communication numbers be reconciled with Table 9."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The real contribution here is the engineering: BLB fuses linear operators across layer boundaries, uses CKKS to keep fused ciphertext widths manageable, and adds a rotation-conscious MatMul protocol with multi-head packing and BSGS. The reported 21x communication cut versus BOLT and ~2x versus Bumblebee are visible in Table 9, and the ablation study shows each component earning its keep. The MatMul section is the strongest part: the diagonal-rotation idea is clearly explained and the rotation counts are substantially lower than BOLT and PowerFormer. I also appreciate the candid discussion of why the prior MP2ML CKKS-to-MPC conversion is insecure; that analysis looks right.\n\nThe soft spots are real, and one is load-bearing. The proof of Theorem 1, as written, does not go through. The stress-test note is correct: in Algorithm 1, after Field-to-Ring and local reduction, P0's pre-decode share is ((Encode(x)+r mod q) mod 2^l), while the ideal FC2M functionality uses (Encode(x)+r mod 2^l) with r uniform over Z_q. Since q is not a multiple of 2^l, r mod 2^l is biased, so the two distributions differ. The proof's assertion that both outputs are decoded uniformly random polynomials over A_{N,2^l} is false. This does not prove the protocol insecure; a corrected functionality or a simulator over the real distribution might exist. But as stated, Theorem 1 is unsupported, and the paper's overall security claim leans on it.\n\nThe other issues are less severe but should be cleaned up. Section 7.3 says BLB reduces communication by about 4x versus BOLT, while the abstract and Table 9 say 21x; that is a factor-of-five mismatch, likely a typo but confusing. The abstract's 13x GPU latency reduction versus BOLT does not appear in Table 9 or Figure 12 (which shows 3.6-4.9x); the authors need to state the configuration where 13x holds or correct the number. Also, the evaluation is single-run without error bars, and while the artifact DOI is cited, full code release is deferred, so independent replication is not yet possible.\n\nBottom line: this is a serious systems paper with a credible engineering story and strong experimental evidence for the performance claims. It deserves peer review, but not acceptance in its current form. The authors need to fix the security proof or explicitly downgrade the claim, align the abstract with the measured numbers, and release enough code for verification. I would read a revised version carefully, but I would not cite the current version for its security guarantees.","headline":"A genuinely fast private Transformer inference system with real communication gains, but the CKKS-to-MPC conversion's security proof has a distributional gap that must be fixed before the security claim is credible.","tokens_in":31983,"tokens_out":3224,"would_cite":false,"duration_ms":30472,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Private Transformer inference can shed most of its cryptographic overhead by fusing fine-grained linear operators across layer boundaries and converting between CKKS ciphertexts and MPC shares through a new, provably secure protocol.","keywords":["private transformer inference","homomorphic encryption","CKKS","secure multi-party computation","operator fusion","CKKS-to-MPC conversion","matrix multiplication packing","communication overhead"],"falsifier":"Run Algorithm 1 repeatedly for a fixed server weight vector with $N=8192$ and $q\\approx 2^{60}$, then test the client's final share for statistical dependence on the high-order bits of the weight vector; a mutual-information or chi-square test that distinguishes the empirical share distribution from the ideal functionality's uniform distribution would falsify Theorem 1.","tokens_in":30845,"feed_emoji":"🔐","tokens_out":12096,"duration_ms":104178,"temperature":0.7,"pith_summary":"BLB's claim is that the layer-wise evaluation paradigm is what makes private Transformer inference expensive, and that breaking layers into fine-grained operators unlocks large savings. Adjacent linear operators from LayerNorm, fully connected layers, and GeLU are fused so that HE/MPC conversions and truncation rounds disappear. To make fusion feasible without blowing up ciphertext width, BLB uses the CKKS scheme and contributes what it calls the first secure CKKS-to-MPC conversion, replacing a prior conversion that masked with a narrowly distributed FFT-encoded polynomial. On BERT-base, BERT-large, and GPT2-base, the paper reports a $21\\times$ communication reduction and a $13\\times$ GPU-latency reduction relative to earlier hybrid systems, with accuracy within about one point of plaintext inference.","feed_headline":"CKKS-MPC bridge cuts private Transformer inference traffic 21x","feed_subtitle":"Operator fusion plus the first secure CKKS/MPC conversion also cuts GPU latency by up to 13x.","key_machinery":"The load-bearing object is the CKKS-to-MPC conversion in Algorithm 1: after CKKS evaluates a fused linear operator, the server adds a uniformly random polynomial $\\hat{r}\\in A_{N,q}$ to the plaintext polynomial inside the ciphertext, sends the masked ciphertext to the client, and both parties switch the additive shares from the prime field $\\mathbb{Z}_q$ to the ring $\\mathbb{Z}_{2^\\ell}$ before applying the CKKS decoding map locally. Uniformity of $\\hat{r}$ is what makes the client's view independent of the server's weights, and the proof of Theorem 1 is the argument that this holds. The second mechanism, FineGrainFusion, is an operator taxonomy with a fusion table: same-category operators share packing, and legal fusions are selected so that no repacking of intermediate ciphertexts is needed. The third mechanism is the diagonal-packing MatMul, which produces partial sums of diagonals of the output matrix directly, so that fewer rotations are needed than in earlier protocols.","core_discovery":"The central discovery is that most communication in hybrid HE/MPC inference is not the linear algebra itself but the bookkeeping between operators: fixed-point truncations after every multiplication and conversions between HE ciphertexts and MPC shares. BLB removes the layer barrier by treating a Transformer as a graph of primitive operators, classifying linear operators as Identity, Expansion, Reduction, or Transformation, and fusing eligible neighbors; in a Transformer block this yields five fused linear blocks. The cryptographic centerpiece is Algorithm 1, a CKKS-to-MPC conversion in which the server masks the CKKS plaintext polynomial by adding a polynomial sampled uniformly from the ring $A_{N,q}$, then both parties switch shares from $\\mathbb{Z}_q$ to $\\mathbb{Z}_{2^\\ell}$ with a Field-to-Ring protocol and locally decode. Theorem 1 asserts this conversion securely realizes the ideal functionality $\\mathcal{F}_{\\text{C2M}}$ against honest-but-curious adversaries. The paper also contributes a rotation-efficient ciphertext-ciphertext MatMul built on diagonal packing, multi-head packing, and baby-step-giant-step, cutting homomorphic rotations by factors of 8 to 29.","pith_inferences":["The same uniform-polynomial masking could be applied to any CKKS-to-MPC handoff, since the flaw it fixes lives in the encoding distribution rather than in any Transformer-specific structure.","If the security proof were ever refuted, the performance story would not automatically survive: the communication savings come from fusion, but the confidentiality guarantee rests entirely on Theorem 1, so the two claims should be tracked separately.","FineGrainFusion is architecture-agnostic in principle: residual networks and other architectures with adjacent linear operators around nonlinearities could be fused the same way, with CKKS rescale absorbing the extra bit-width growth.","Against non-interactive FHE-only alternatives, the batched-input experiment suggests the real comparison is amortized throughput: BLB's per-query latency and accuracy advantages narrow when many queries from the same user are processed together."],"forward_implications":["Private Transformer inference becomes feasible in WAN settings: BLB reports 3.0 GB communication for BERT-base, 7.8 GB for BERT-large, and 1.5 GB for GPT2-base, down from tens of gigabytes in earlier layer-wise hybrid systems.","Truncation communication is eliminated entirely; fixed-point truncation is folded into local decoding on an enlarged ring with failure probability below $2^{-40}$.","The fusion-aware MatMul reduces homomorphic rotations by factors of 8 to 29 relative to earlier fused-MatMul protocols, turning HE rotations from a bottleneck into a minor cost.","Without any fine-tuning, private inference accuracy stays within about one point of plaintext accuracy on standard classification benchmarks, and on some datasets the approximation noise acts as a mild regularizer.","With GPU acceleration, BLB becomes faster than its baselines under every tested network condition, with latency reductions from $1.5\\times$ to $13\\times$ depending on model and network."],"supporting_citations":[{"why":"Defines the CKKS scheme, its encoding and decoding maps, rescaling, and approximate arithmetic that BLB relies on for fused linear operators.","marker":"[8]"},{"why":"Introduces the earlier CKKS-to-MPC conversion whose narrowly distributed FFT-encoded mask BLB identifies as insecure and replaces.","marker":"[15]"},{"why":"Provides the layer-wise hybrid baseline and the LayerNorm and Softmax operator decompositions that BLB fuses.","marker":"[45]"},{"why":"Provides the layer-wise hybrid baseline, the prior fusion of two attention MatMuls, and the field-to-ring conversion BLB adapts.","marker":"[49]"},{"why":"Supplies the most optimized prior fused ciphertext-ciphertext MatMul that BLB compares against in rotation count.","marker":"[50]"},{"why":"Supplies the field-to-ring and ring-to-field conversion protocols and truncation primitives used in Algorithm 1 and the nonlinear operators.","marker":"[51]"},{"why":"Supplies the probabilistic truncation method that BLB extends to a larger ring to eliminate truncation communication.","marker":"[47]"},{"why":"Provides the simulation-based security framework used in the proof of Theorem 1.","marker":"[29]"},{"why":"Presents the earlier ciphertext-ciphertext MatMul protocol that BLB's diagonal-packing protocol builds on and improves.","marker":"[35]"}],"fun_headline_variants":["Fusing CKKS and MPC cuts Transformer inference traffic 21x","First CKKS-to-MPC conversion enables 21x communication cut","Hybrid CKKS-MPC: 21x less traffic, 13x faster inference","Operator fusion and secure conversion cut private inference traffic 21x"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire scheme is only as secure as the assumption that the uniform polynomial mask remains perfectly random after the protocol's rounding, modulus-switch, and decoding steps; if any of those steps introduces a correlation with the server's weights, information about the model could leak.","fun_headline_variants_meta":{"raw":{"variants":["Fusing CKKS and MPC cuts Transformer inference traffic 21x","First CKKS-to-MPC conversion enables 21x communication cut","Hybrid CKKS-MPC: 21x less traffic, 13x faster inference","Operator fusion and secure conversion cut private inference traffic 21x"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000849,"raw_usage":{"total_tokens":3722,"prompt_tokens":1003,"completion_tokens":2719,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":619,"completion_tokens_details":{"reasoning_tokens":2640}},"tokens_in":619,"tokens_out":2719,"duration_ms":17009,"temperature":1.0,"reasoning_tokens":2640,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:50:48.403155+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 1 repeatedly for a fixed server weight vector with $N=8192$ and $q\\approx 2^{60}$, then test the client's final share for statistical dependence on the high-order bits of the weight vector; a mutual-information or chi-square test that distinguishes the empirical share distribution from the ideal functionality's uniform distribution would falsify Theorem 1.","supporting_citations":[{"cited_title":"Homomorphic encryption for arithmetic of approximate numbers","cited_arxiv_id":null,"evidence_quote":"Defines the CKKS scheme, its encoding and decoding maps, rescaling, and approximate arithmetic that BLB relies on for fused linear operators."},{"cited_title":"Mp2ml: A mixed-protocol ma- chine learning framework for private inference","cited_arxiv_id":null,"evidence_quote":"Introduces the earlier CKKS-to-MPC conversion whose narrowly distributed FFT-encoded mask BLB identifies as insecure and replaces."},{"cited_title":"Bumblebee: Secure two-party inference frame- work for large transformers","cited_arxiv_id":null,"evidence_quote":"Provides the layer-wise hybrid baseline and the LayerNorm and Softmax operator decompositions that BLB fuses."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the layer-wise hybrid baseline, the prior fusion of two attention MatMuls, and the field-to-ring conversion BLB adapts."},{"cited_title":"Pow- erformer: Efficient privacy-preserving transformer with batch rectifier-power max function and optimized homo- morphic attention","cited_arxiv_id":null,"evidence_quote":"Supplies the most optimized prior fused ciphertext-ciphertext MatMul that BLB compares against in rotation count."},{"cited_title":"Secure outsourced matrix computation and application to neural networks","cited_arxiv_id":null,"evidence_quote":"Presents the earlier ciphertext-ciphertext MatMul protocol that BLB's diagonal-packing protocol builds on and improves."}],"review_version":2}