{"id":"eea6f728-d28c-4cf5-ae84-c666d0b89edf","arxiv_id":"2606.09551","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"FuseFSS compiles scalar fixed-point operators into packed comparison and interval-lookup FSS evaluations, delivering 1.24-1.50x end-to-end speedup and 9-16% lower online communication on BERT/GPT models while preserving accuracy.","lead":"FuseFSS is a compiler that unifies protocol design for fixed-point nonlinear operators in two-server secure LLM inference by emitting two batched function secret sharing evaluations from a compact operator specification. A smart generalist might read it to see how privacy-preserving AI queries could become faster and more practical on GPUs without custom per-operator engineering.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Correctness of per-operator specs compiled to batched FSS evaluations lacks explicit error bounds or formal invariants","rationale":"The reader's weakest_assumption already isolates the single unverified step on which both the functional correctness and the reported speedups rest. Full-text inspection does not add a formal argument or machine-checked proof that would remove this dependency, so the provisional UNVERDICTED verdict is unaffected.","tokens_in":1739,"tokens_out":332,"duration_ms":18541,"concrete_test":"Take the ReLU or GELU spec from the paper, re-derive the active polynomial on each interval from the published partition, and compare the compiled FSS output bit-for-bit against a direct fixed-point reference implementation on 10^6 random masked inputs; if any output differs by more than the baseline's own rounding tolerance, the compilation step is the source of accuracy risk.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The speedup and accuracy-preservation claims require that each operator's interval partition + low-degree pieces + predicate bits, when turned into one packed comparison FSS and one vector lookup FSS, produce exactly the same fixed-point result (or within the tolerance already accepted by the baseline) as the original nonlinear operator. The manuscript supplies no derivation showing that the emitted FSS circuits preserve the original function on every interval, nor any bound on the approximation error introduced by the low-degree pieces under fixed-point rounding. Empirical accuracy numbers on BERT/GPT therefore only show that the tested specs happened to be good enough for those models; a different operator or deeper network could expose divergence.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces FuseFSS, a compiler for two-server secure LLM inference based on function secret sharing (FSS). For each fixed-point nonlinear operator, a compact specification of interval partitions, low-degree arithmetic pieces, and predicate bits is compiled into two batched FSS evaluations (one packed comparison returning predicate bits, one vector lookup returning coefficients). The system is evaluated on BERT and GPT-style models and claims to preserve accuracy while delivering 1.24×–1.50× end-to-end speedup, 9%–16% lower online communication, and lighter preprocessing relative to prior FSS-based GPU secure inference.","tokens_in":1875,"tokens_out":611,"duration_ms":23916,"significance":"If the per-operator FSS circuits are shown to be correct, the unified compilation pipeline would reduce the engineering burden of bespoke protocols for nonlinearities and helper operations, potentially improving the practicality of FSS-based secure inference for large models. The reported speedups and communication savings on standard architectures are concrete and would be of interest to the secure-computation community if the underlying correctness assumptions hold.","major_comments":[{"comment":"Abstract: the accuracy-preservation claim rests on the assumption that each operator's interval partition + low-degree pieces + predicate bits, when compiled into one packed comparison FSS and one vector lookup FSS, produce exactly the same fixed-point result as the original operator. No derivation, invariant, or error bound is supplied showing that the emitted circuits preserve the function on every interval or quantifying the approximation error under fixed-point rounding.","section":"Abstract"},{"comment":"Compiler pipeline description: the manuscript supplies no formal argument or verification procedure establishing that the chosen low-degree pieces and predicate bits, once turned into batched FSS evaluations, implement the original nonlinear function without accuracy loss or security degradation for arbitrary operators; the empirical numbers on BERT/GPT therefore only demonstrate that the tested specifications happened to be adequate for those models.","section":"Compiler pipeline"},{"comment":"Experimental section: the central performance claims (1.24×–1.50× speedup, 9%–16% communication reduction) are presented without reported controls for the choice of interval partitions or degree of the arithmetic pieces, nor any sensitivity analysis showing how accuracy would degrade if a different operator or deeper network were substituted.","section":"Experiments"}],"minor_comments":[{"comment":"Notation for the packed comparison and vector lookup FSS primitives could be introduced earlier and used consistently to improve readability of the compilation pipeline.","section":null},{"comment":"The abstract and introduction would benefit from a brief statement of the threat model and the precise security notion (e.g., semi-honest two-server) under which the FSS evaluations are claimed to be secure.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive comments. We address each major point below and indicate planned revisions.","responses":[{"response":"The emitted circuits preserve the function exactly by construction: the supplied specifications define interval partitions and low-degree pieces that match the original fixed-point operator on each interval (with predicate bits selecting the active piece), and the FSS evaluations compute these without additional error. We will add a short derivation of this invariant to the revised abstract and compiler section.","revision_made":"yes","referee_comment":"[Abstract] Abstract: the accuracy-preservation claim rests on the assumption that each operator's interval partition + low-degree pieces + predicate bits, when compiled into one packed comparison FSS and one vector lookup FSS, produce exactly the same fixed-point result as the original operator. No derivation, invariant, or error bound is supplied showing that the emitted circuits preserve the function on every interval or quantifying the approximation error under fixed-point rounding."},{"response":"For any operator whose specification is accurate, the batched FSS evaluations implement the piecewise function exactly, with security inherited unchanged from the underlying FSS primitives. The BERT/GPT results validate the framework on standard models. We will expand the compiler pipeline section with an explicit argument establishing this property for arbitrary operators.","revision_made":"yes","referee_comment":"[Compiler pipeline] Compiler pipeline description: the manuscript supplies no formal argument or verification procedure establishing that the chosen low-degree pieces and predicate bits, once turned into batched FSS evaluations, implement the original nonlinear function without accuracy loss or security degradation for arbitrary operators; the empirical numbers on BERT/GPT therefore only demonstrate that the tested specifications happened to be adequate for those models."},{"response":"The reported speedups use interval partitions and polynomial degrees chosen to preserve exact accuracy on the evaluated BERT/GPT operators. We did not include sensitivity analysis because the contribution centers on the compiler rather than exhaustive operator tuning. We will add a brief discussion of how alternative specifications affect the accuracy-performance trade-off.","revision_made":"partial","referee_comment":"[Experiments] Experimental section: the central performance claims (1.24×–1.50× speedup, 9%–16% communication reduction) are presented without reported controls for the choice of interval partitions or degree of the arithmetic pieces, nor any sensitivity analysis showing how accuracy would degrade if a different operator or deeper network were substituted."}],"tokens_in":1512,"tokens_out":528,"duration_ms":25754,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper's main contribution is a single compilation pipeline that takes a compact spec of interval partitions, low-degree pieces, and predicate bits for each fixed-point nonlinearity and emits two batched FSS evaluations: one packed comparison and one vector lookup. This replaces the prior pattern of writing a separate protocol for every operator.\n\nIt does a reasonable job of identifying the remaining bottleneck once linear layers are handled efficiently with FSS on GPU. The reported 1.24–1.50× end-to-end speedup and 9–16% communication reduction on BERT and GPT-style models, plus lighter preprocessing, are concrete numbers that suggest the batching helps in practice.\n\nThe soft spot is the missing link between spec and result. The abstract states accuracy is preserved but gives no derivation showing that the low-degree pieces plus fixed-point rounding match the original operator on every interval, no bound on approximation error, and no security argument for the packed FSS. The empirical numbers therefore only demonstrate that the chosen specs worked for the tested models; nothing rules out divergence on other operators or deeper networks.\n\nThis is for researchers working on practical two-server secure inference. A reader already familiar with FSS would get value from the compiler framing if the full paper supplies the missing invariants.\n\nThe work deserves a serious referee because the engineering direction is worth checking, even though the current writeup needs explicit correctness material before the performance claims can be taken at face value.","headline":"FuseFSS's compiler for turning operator specs into batched FSS evaluations is the actual new piece, but the abstract supplies no correctness argument or error bounds for the emitted circuits.","tokens_in":2332,"tokens_out":373,"would_cite":false,"duration_ms":17252,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"FuseFSS compiles per-operator specs of interval partitions and low-degree pieces into two batched FSS evaluations for nonlinear layers.","keywords":["secure inference","function secret sharing","large language models","compiler","fixed-point arithmetic","nonlinear operators","two-server protocols","GPU acceleration"],"falsifier":"An accuracy drop or a successful privacy attack on a BERT or GPT model when its nonlinear layers are replaced by the compiled FuseFSS protocols would show the claim is false.","tokens_in":2638,"feed_emoji":"🔐","tokens_out":717,"duration_ms":20119,"temperature":0.7,"pith_summary":"The paper introduces FuseFSS as a compiler that unifies the handling of fixed-point nonlinear operators in two-server secure LLM inference based on function secret sharing. Instead of designing a separate protocol for each operator with its own comparisons and corrections, the system accepts a compact description of the operator's interval partition, arithmetic pieces, and predicate bits. From this description the compiler produces two batched FSS evaluations on the masked input value, one that packs all necessary comparisons and one that performs a vector lookup of the active coefficients. Experiments on BERT and GPT-style models show that the resulting protocols preserve accuracy while reducing end-to-end latency and online communication relative to prior per-operator FSS implementations. A reader would care because secure inference protects both client prompts and server model weights, and the dominant remaining cost has been the nonlinear layers.","feed_headline":"Fused FSS compiler speeds secure LLM inference 1.24-1.5×","feed_subtitle":"A single pipeline for interval partitions and batched evaluations cuts online communication 9-16% on BERT and GPT models while preserving ac","key_machinery":"The FuseFSS compiler that converts a per-operator specification of interval partition, low-degree pieces, and predicate bits into a packed comparison FSS and a vector interval-lookup FSS.","core_discovery":"FuseFSS replaces per-operator protocol design with a single compilation pipeline. For each scalar fixed-point operator, a compact specification lists its interval partition, low-degree arithmetic pieces, and required predicate bits. The compiler emits two batched FSS evaluations on the public masked value: one packed comparison that returns all predicate bits, and one vector interval lookup that returns the active coefficients and constants.","pith_inferences":["The same specification format could be reused for nonlinear functions outside current LLM layers once the arithmetic pieces are identified.","Lower design effort per operator may shorten the time needed to support new activation or normalization functions that appear in future models.","Smaller preprocessing material could make secure inference practical on hardware with tighter memory budgets for the two servers."],"forward_implications":["Accuracy is preserved on BERT and GPT-style models.","End-to-end latency improves by 1.24× to 1.50× over prior FSS-based GPU secure inference.","Online communication volume drops by 9% to 16%.","Preprocessing time for key generation falls by 14% to 23% and key sizes shrink by 20% to 24%."],"fun_headline_variants":["Compiler unifies FSS protocols for secure LLM inference","Single pipeline for batched FSS in LLM nonlinear layers","FuseFSS reduces online communication 9-16% on BERT GPT models","FuseFSS achieves 1.24-1.5x speedup in secure LLM inference"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"A compact per-operator specification of interval partition, low-degree arithmetic pieces, and predicate bits can be compiled into batched FSS evaluations that correctly realize the original nonlinear function.","fun_headline_variants_meta":{"raw":{"variants":["Compiler unifies FSS protocols for secure LLM inference","Single pipeline for batched FSS in LLM nonlinear layers","FuseFSS reduces online communication 9-16% on BERT GPT models","FuseFSS achieves 1.24-1.5x speedup in secure LLM inference"]},"model":"grok-4.3","cost_usd":0.006697,"raw_usage":{"total_tokens":3129,"prompt_tokens":685,"num_sources_used":0,"completion_tokens":75,"cost_in_usd_ticks":66974500,"prompt_tokens_details":{"text_tokens":685,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2369,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":685,"tokens_out":75,"duration_ms":16809,"temperature":1.0,"reasoning_tokens":2369,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T16:21:02.790185+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An accuracy drop or a successful privacy attack on a BERT or GPT model when its nonlinear layers are replaced by the compiled FuseFSS protocols would show the claim is false.","supporting_citations":[],"review_version":1}