Pith. sign in

REVIEW 3 major objections 6 minor 53 references

Private Transformer Inference in MLaaS: A Survey

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims to be the first survey of private transformer inference, organizing 2022–2025 solutions by a linear/non-linear layer taxonomy and comparing MPC, HE, and hybrid approaches.

desk verdict A useful but uneven first PTI survey: the taxonomy and comparative table earn their place, but the cross-paper runtime ranking needs an audit before it should be quoted. read the letter →

arxiv 2505.10315 v1 pith:M77JWURE submitted 2025-05-15 cs.CR cs.AI

Yang Li , Xinyu Zhou , Yitong Wang , Liangxin Qian , Jun Zhao This is my paper · ORCID
classification cs.CRcs.AI
keywords privatetransformerinferencesecuremulti-partycomputationhomomorphicencryptionmachinelearningasaservicetaxonomynon-linearlayersSoftmaxapproximationprivacy-preserving
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims to be the first survey devoted specifically to Private Transformer Inference, covering work from 2022 to 2025. It argues that every transformer layer can be sorted into linear or non-linear cryptographic operations, and that this split explains the design space: matrix multiplications are natively supported by MPC and homomorphic encryption, while Softmax, GELU, and LayerNorm dominate the cost and force accuracy-versus-efficiency trade-offs. The survey organizes existing protocols into MPC-only, HE-only, and hybrid categories and compares them on communication, runtime, and accuracy across BERT, GPT, Vision Transformer, and LLaMA models. A careful reader would care because the comparison gives a map of where the field stands and where the remaining bottlenecks are.

What carries the argument

The load-bearing mechanism is the binary taxonomy of transformer layers in cryptographic contexts: linear layers (embedding, attention MatMul, feed-forward) versus non-linear layers (Softmax, GELU, LayerNorm). This split determines which cryptographic tools apply and where overhead concentrates; the paper reports that non-linear layers account for more than 85% of runtime in one MPC baseline and about 60% in one hybrid baseline. The companion evaluation grid (communication, runtime, accuracy) is what makes the taxonomy yield an explicit comparison across studies.

What would settle it

A literature search for any earlier survey dedicated specifically to private transformer inference would settle the novelty claim, and re-running the Table 1 BERT-Base comparisons on a single hardware platform with the original code would settle whether the cross-paper numbers are comparable.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that private transformer inference can be usefully reviewed as a problem of matching cryptographic primitives to layer types. Linear layers (embedding, attention matrix multiplications, feed-forward networks) are treated by secure multiplication techniques such as Beaver triples, replicated secret sharing, or SIMD-encoded homomorphic operations; non-linear layers (Softmax, GELU, LayerNorm) are handled by substitution, polynomial approximation, lookup tables, or iterative reciprocal-square-root methods. The paper asserts that no earlier survey had this PTI-specific focus, and it uses its taxonomy to produce a cross-paper comparison table. The central pattern that emerges is a three-way trade-off: MPC-only schemes are fastest but communication-heavy, HE-only schemes are non-interactive and communication-light but slow, with bootstrapping a major cost, and hybrid schemes sit between; accuracy losses come mainly from non-linear approximations and can sometimes be repaired by knowledge distillation.

Load-bearing premise

The survey's utility rests on two assumptions: that it is genuinely the first survey focused on private transformer inference, and that the runtimes, communication volumes, and accuracies it tabulates from different, mostly non-open-source papers were measured under comparable conditions and are correctly attributed.

Editorial extensions

If this is right

  • A newcomer to PTI can use the taxonomy to decide whether their bottleneck is communication (choose HE or hybrid) or latency (choose MPC with function secret sharing).
  • Further speedups should target non-linear layers first, since they are the dominant cost in both MPC and HE settings.
  • HE-only systems already allow non-interactive inference; reducing bootstrapping cost is the clearest path to practical server-only private inference.
  • Knowledge distillation is an effective but expensive repair for accuracy loss from crypto-friendly approximations, while refined polynomial approximations reduce the loss without retraining.
  • GPU acceleration and evaluation on generation tasks remain open problems, since current benchmarks are mostly classification tasks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the linear/non-linear split generalizes, private inference for non-transformer sequence models with data-dependent gating would likely show the same pattern: linear projections are easy to secure, while activation and normalization functions dominate the cost.
  • The table's attributions should be independently checked before relying on its numbers: [Zheng et al., 2023] appears in the reference list but never in the text, while two rows are labeled [Zeng et al., 2023], so at least one row may belong to the wrong paper.
  • The non-interactive HE direction suggests a practical MLaaS pattern where a client uploads one ciphertext and disconnects; if GPU-accelerated HE matures, private inference could become a drop-in API with predictable communication.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript surveys private transformer inference (PTI) in the machine-learning-as-a-service setting, covering works from 2022 to 2025. It organizes the literature with a taxonomy of linear layers (matrix multiplication, embedding, feed-forward) versus non-linear layers (Softmax, GELU, LayerNorm) and of the underlying cryptographic primitives (MPC, HE, and hybrid MPC+HE). The paper also presents Table 1, which aggregates reported communication volumes, runtimes, accuracy values, and accuracy losses across roughly fifteen studies, and uses this table in Section 6 to draw conclusions about communication overhead, runtime ordering, and approximation accuracy. Section 7 lists future directions: GPU acceleration, evaluation on generation tasks, and real-world practicality. The paper claims to be the first survey focused specifically on PTI.

Significance. If its comparative claims survive a primary-source audit, this survey would be a useful entry point: the linear/non-linear taxonomy is clear, the table consolidates numbers that are otherwise scattered across many papers, and the discussion of non-linear-layer bottlenecks is grounded in concrete percentages from the cited works. The paper is also explicit about the semi-honest threat model and about the fact that most PTI studies are not open source. The contribution is organizational and comparative rather than technical; no new protocols, proofs, or reproducible artifacts are offered. The value is therefore gated by the accuracy and commensurability of Table 1 and by the internal consistency of the technique labels attached to each row.

major comments (3)
  1. [§3.3, §6.2, Table 1] The classification of [Hao et al., 2022] is internally inconsistent. Section 3.3 describes it as 'using HE', Section 6.2 describes it as 'using ASS', and Table 1 labels it 'MPC+HE'. Because Section 6.2 uses the communication figure 280.99 GB to support a claim about MPC-based studies, and Section 6.3 uses the same row in the runtime ordering, the primitive attribution is load-bearing for the survey's comparative conclusions. Please check the primary source and align all three statements.
  2. [Table 1, §6.3] The central runtime comparison is not commensurable as presented. Table 1 mixes network configurations (9.4 Gbps/0.05 ms, 5 Gbps/1 ms, 3 Gbps/0.8 ms, 1 Gbps/0.5 ms, 100 Mbps/2.3 ms, 100 Mbps/80 ms, and 44 Mbps/40 ms) and does not report CPU model or thread counts. Section 6.3 acknowledges that 'differences in experimental platforms may still affect the runtime performance,' but the following paragraph still concludes that MPC-only solutions are faster than hybrid and HE-only solutions, citing 1.84 s versus 185 s versus 857 s. This ordering is not established as a technique effect rather than a hardware/network effect. Please restrict the comparison to commensurable settings, or explicitly re-label the ordering as reflecting heterogeneous reported setups and remove the causal attribution to the cryptographic technique.
  3. [Table 1, References] The BERT-family block in Table 1 is attributed to [Zheng et al., 2023] (PRIMER), but the prose never cites Zheng et al.; the reference-list entry for [Zheng et al., 2023] appears only in the table. The CCT rows are attributed to [Zeng et al., 2023] (MPCViT). A reader therefore cannot verify from the manuscript alone whether the BERT row's numbers (for example MRPC: 0.9 GB, 10.6 s) come from PRIMER, or whether the row is a mislabeled duplicate of another source. Please add a prose citation for [Zheng et al., 2023] and audit the row against the primary source.
minor comments (6)
  1. [§1, §7] The novelty claim that 'surveys focusing on PTI do not exist so far' is supported only by two adjacent surveys; a broader, systematic related-work search would substantiate a 'first survey' claim.
  2. [§6.1] The phrase 'three NLU tasks and nine corresponding corpora' is confusing; GLUE has nine tasks grouped into three families (single-sentence, similarity/paraphrase, and inference). Please rephrase.
  3. [Table 1] For several HE-only rows the communication column is blank or contains '-'; the caption should state that communication overhead was not reported in those studies.
  4. [References] The reference [Zhang et al., 2023] contains a typo in the title: 'efficiefnt' should be 'efficient'.
  5. [Ethical Statement] The ethical statement says 'Our experiments use only open-source datasets,' but this paper is a survey and performs no experiments; please rephrase to describe the survey's data sources.
  6. [§4.1] The statement 'RSS requires at least three parties' is too broad; the replicated secret-sharing variant used in the cited works requires three parties under an honest-majority assumption, not secret sharing in general.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the survey compiles external primary-source results; its taxonomy and comparisons are descriptive rather than derived from its own inputs.

full rationale

This is a survey paper, not a derivation. It introduces no fitted parameters, no equations that predict results from earlier sections, and no claim that depends on the authors' own prior work. The taxonomy (linear vs non-linear layers; MPC vs HE vs hybrid) is a descriptive classification of the cited primary literature, and Table 1 compiles reported numbers from external papers. The central claims—that the paper is the first PTI-focused survey, that non-linear layers dominate PTI overhead, and that HE-only approaches tend to be slower—are supported by citations to independent, externally published studies. The acknowledged limitations in Section 6.3 (non-open-source implementations and platform differences) are reproducibility and comparability concerns, not circularity. The Zeng/Zheng reference inconsistency in Table 1 is an attribution issue, not a self-referential derivation. No load-bearing self-citation chain exists. Therefore no circular step can be exhibited, and a non-finding with score 0 is appropriate.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No free parameters or invented entities: this is a survey, not a derivation or empirical study. The main hidden costs are interpretive: faithful representation of cited work and commensurability of cross-paper benchmarks.

assumptions (3)
  • domain assumption The authors' representation of each cited PTI paper is faithful to the original source.
    The survey does not reproduce code or verify implementations; its taxonomy and Table 1 rest on correct interpretation of the cited papers. The duplicate [Zeng et al., 2023] blocks make this assumption questionable for at least one row.
  • standard math GLUE benchmark and dataset descriptions are standard background.
    Section 6.1 treats GLUE as a fixed benchmark; this is standard background from [Wang et al., 2018].
  • standard math Cryptographic primitives (MPC, HE, SS, OT) are correctly described as standard.
    Section 2.2 summarizes standard primitives; the survey relies on these descriptions without proof, which is appropriate for a survey.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Private Transformer Inference in MLaaS: A Survey." pith.science (2026). https://pith.science/paper/M77JWURE

@misc{pith2026250510315,
  author       = {Pith},
  title        = {Pith review of: Private Transformer Inference in MLaaS: A Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/M77JWURE}},
  note         = {Machine review of arXiv:2505.10315}
}
read the original abstract

Transformer models have revolutionized AI, powering applications like content generation and sentiment analysis. However, their deployment in Machine Learning as a Service (MLaaS) raises significant privacy concerns, primarily due to the centralized processing of sensitive user data. Private Transformer Inference (PTI) offers a solution by utilizing cryptographic techniques such as secure multi-party computation and homomorphic encryption, enabling inference while preserving both user data and model privacy. This paper reviews recent PTI advancements, highlighting state-of-the-art solutions and challenges. We also introduce a structured taxonomy and evaluation framework for PTI, focusing on balancing resource efficiency with privacy and bridging the gap between high-performance inference and data privacy.

Figures

Figures reproduced from arXiv: 2505.10315 by the authors.

Figure 1
Figure 1. MLaaS without privacy protection computational power, it also necessitates careful consider￾ation of privacy issues. Such concerns have prompted ac￾tions like Italy’s temporary ban of ChatGPT [Mauran, 2023; Lomas, 2023]. The tension between high-performance trans￾former services and privacy concerns highlights the need for Private Transformer Inference (PTI). Private inference is a cryptographic protocol that allows… view at source ↗
Figure 2
Figure 2. The architecture of a transformer encoder [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 40 canonical work pages

  1. [1]

    Priv- former: Privacy-preserving transformer with MPC

    [Akimoto et al., 2023] Yoshimasa Akimoto, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Priv- former: Privacy-preserving transformer with MPC. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 392–410. IEEE,

    work page 2023

  2. [6]

    SecureTLM: Private inference for transformer-based large model with MPC

    [Chen et al., 2024] Yuntian Chen, Xianjia Meng, Zhiying Shi, Zhiyuan Ning, and Jingzhi Lin. SecureTLM: Private inference for transformer-based large model with MPC. Information Sciences, 667:120429,

    work page 2024

  3. [9]

    East: Efficient and accurate secure transformer framework for inference

    [Ding et al., 2023] Yuanchao Ding, Hua Guo, Yewei Guan, Weixin Liu, Jiarong Huo, Zhenyu Guan, and Xiy- ong Zhang. East: Efficient and accurate secure transformer framework for inference. arXiv preprint arXiv:2308.09923,

    arXiv 2023

  4. [10]

    Puma: Secure inference of Llama-7b in five minutes

    [Dong et al., 2023] Ye Dong, Wen-jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Cheng. Puma: Secure inference of Llama-7b in five minutes. arXiv preprint arXiv:2307.12533,

    arXiv 2023

  5. [11]

    An image is worth 16x16 words: Transformers for image recognition at scale

    [Dosovitskiy et al., 2020] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Min- derer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929,

    arXiv 2020

  6. [12]

    A pragmatic introduction to secure multi-party computation

    [Evans et al., 2018] David Evans, Vladimir Kolesnikov, Mike Rosulek, et al. A pragmatic introduction to secure multi-party computation. Foundations and Trends® in Pri- vacy and Security, 2(2-3):70–246,

    work page 2018

  7. [15]

    Iron: Pri- vate inference on transformers

    [Hao et al., 2022] Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Pri- vate inference on transformers. Advances in neural infor- mation processing systems, 35:15718–15731,

    work page 2022

  8. [16]

    Escaping the big data paradigm with compact trans- formers

    [Hassani et al., 2021] Ali Hassani, Steven Walton, Nikhil Shah, Abulikemu Abuduweili, Jiachen Li, and Humphrey Shi. Escaping the big data paradigm with compact trans- formers. arXiv preprint arXiv:2104.05704,

    arXiv 2021

Show all 53 references
  1. [19]

    SecBERT: Privacy-preserving pre-training based neural network inference system

    [Huang and Wang, 2024] Hai Huang and Yongjian Wang. SecBERT: Privacy-preserving pre-training based neural network inference system. Neural Networks, 172:106135,

    2024

  2. [20]

    Cheetah: Lean and fast secure{Two-Party} deep neural network inference

    [Huang et al., 2022] Zhicong Huang, Wen-jie Lu, Cheng Hong, and Jiansheng Ding. Cheetah: Lean and fast secure{Two-Party} deep neural network inference. In 31st USENIX Security Symposium (USENIX Security

    2022

  3. [21]

    Orca: Fss-based secure training and inference with GPUs

    [Jawalkar et al., 2024] Neha Jawalkar, Kanav Gupta, Arkaprava Basu, Nishanth Chandran, Divya Gupta, and Rahul Sharma. Orca: Fss-based secure training and inference with GPUs. In 2024 IEEE Symposium on Security and Privacy (SP), pages 597–616. IEEE,

    2024

  4. [22]

    Tinybert: Distilling bert for natural language understand- ing

    [Jiao et al., 2019] Xiaoqi Jiao, Yichun Yin, Lifeng Shang, Xin Jiang, Xiao Chen, Linlin Li, Fang Wang, and Qun Liu. Tinybert: Distilling bert for natural language understand- ing. arXiv preprint arXiv:1909.10351,

    2019 arXiv

  5. [24]

    LLMs can understand encrypted prompt: Towards privacy- computing friendly transformers

    [Liu and Liu, 2023] Xuanqi Liu and Zhuotao Liu. LLMs can understand encrypted prompt: Towards privacy- computing friendly transformers. arXiv preprint arXiv:2305.18396,

    2023 arXiv

  6. [25]

    PPTIF: Privacy-preserving transformer inference framework for language translation

    [Liu and Su, 2024] Yanxin Liu and Qianqian Su. PPTIF: Privacy-preserving transformer inference framework for language translation. IEEE Access,

    2024

  7. [26]

    Italy orders ChatGPT blocked citing data protection concerns

    [Lomas, 2023] Natasha Lomas. Italy orders ChatGPT blocked citing data protection concerns. TechCrunch, March, 31,

    2023

  8. [27]

    Bumblebee: Secure two-party infer- ence framework for large transformers

    [Lu et al., 2023] Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Kui Ren, Cheng Hong, Tao Wei, and WenGuang Chen. Bumblebee: Secure two-party infer- ence framework for large transformers. Cryptology ePrint Archive,

    2023

  9. [28]

    Chatting about ChatGPT: how may AI and GPT impact academia and libraries? Library hi tech news , 40(3):26– 29,

    [Lund and Wang, 2023] Brady D Lund and Ting Wang. Chatting about ChatGPT: how may AI and GPT impact academia and libraries? Library hi tech news , 40(3):26– 29,

    2023

  10. [29]

    SecFormer: Fast and accurate privacy- preserving inference for transformer models via SMPC

    [Luo et al., 2024] Jinglong Luo, Yehong Zhang, Zhuo Zhang, Jiaqi Zhang, Xin Mu, Hui Wang, Yue Yu, and Zenglin Xu. SecFormer: Fast and accurate privacy- preserving inference for transformer models via SMPC. In Findings of the Association for Computational Linguistics ACL 2024, ...

    2024

  11. [30]

    {SecretFlow-SPU}: A performant and{User-Friendly} framework for{Privacy- Preserving} machine learning

    [Ma et al., 2023] Junming Ma, Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi Wu, Wenjing Fang, Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang. {SecretFlow-SPU}: A performant and{User-Friendly} framework for{Privacy- Preserving} machine learning. In 2023 USENIX Annual Technical Co...

    2023

  12. [31]

    Software division and square root using Goldschmidt’s algorithms

    [Markstein, 2004] Peter Markstein. Software division and square root using Goldschmidt’s algorithms. In Proceed- ings of the 6th Conference on Real Numbers and Comput- ers (RNC’6), volume 123, pages 146–157. Citeseer,

    2004

  13. [33]

    Pointer sentinel mixture models

    [Merity et al., 2016] Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. arXiv preprint arXiv:1609.07843,

    2016 arXiv

  14. [34]

    THOR: Secure transformer infer- ence with homomorphic encryption

    [Moon et al., 2024] Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, and Miran Kim. THOR: Secure transformer infer- ence with homomorphic encryption. Cryptology ePrint Archive,

    2024

  15. [35]

    BOLT: Privacy- preserving, accurate and efficient inference for transform- ers

    [Pang et al., 2024] Qi Pang, Jinhao Zhu, Helen M ¨ollering, Wenting Zheng, and Thomas Schneider. BOLT: Privacy- preserving, accurate and efficient inference for transform- ers. In 2024 IEEE Symposium on Security and Privacy (SP), pages 130–130. IEEE Computer Society,

    2024

  16. [36]

    Powerformer: Efficient privacy-preserving transformer with batch rectifier-power max function and optimized homomorphic attention

    [Park et al., 2024] Dongjin Park, Eunsang Lee, and Joon- Woo Lee. Powerformer: Efficient privacy-preserving transformer with batch rectifier-power max function and optimized homomorphic attention. Cryptology ePrint Archive,

    2024

  17. [37]

    Im- provements of homomorphic secure evaluation of inverse square root

    [Qu and Xu, 2023] Hongyuan Qu and Guangwu Xu. Im- provements of homomorphic secure evaluation of inverse square root. In International Conference on Information and Communications Security , pages 110–127. Springer,

    2023

  18. [38]

    Transformer-based language models and homo- morphic encryption: An intersection with bert-tiny

    [Rovida and Leporati, 2024] Lorenzo Rovida and Alberto Leporati. Transformer-based language models and homo- morphic encryption: An intersection with bert-tiny. In Proceedings of the 10th ACM International Workshop on Security and Privacy Analytics, pages 3–13,

    2024

  19. [39]

    What if the devil is my guardian angel: ChatGPT as a case study of using chatbots in education

    [Tlili et al., 2023] Ahmed Tlili, Boulus Shehata, Michael Agyemang Adarkwah, Aras Bozkurt, Daniel T Hickey, Ronghuai Huang, and Brighter Agyemang. What if the devil is my guardian angel: ChatGPT as a case study of using chatbots in education. Smart learning environments, 10(1):15,

    2023

  20. [40]

    Llama: Open and efficient founda- tion language models

    [Touvron et al., 2023] Hugo Touvron, Thibaut Lavril, Gau- tier Izacard, Xavier Martinet, Marie-Anne Lachaux, Tim- oth´ee Lacroix, Baptiste Rozi`ere, Naman Goyal, Eric Ham- bro, Faisal Azhar, et al. Llama: Open and efficient founda- tion language models. arXiv preprint arXiv:23...

    2023 arXiv

  21. [41]

    Attention is all you need

    [Vaswani et al., 2017] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30,

    2017

  22. [43]

    Characterization of MPC-based private inference for transformer-based mod- els

    [Wang et al., 2022] Yongqin Wang, G Edward Suh, Wenjie Xiong, Benjamin Lefaudeux, Brian Knott, Murali An- navaram, and Hsien-Hsin S Lee. Characterization of MPC-based private inference for transformer-based mod- els. In 2022 IEEE International Symposium on Perfor- mance Analys...

    2022

  23. [44]

    HE-Booster: an efficient polynomial arithmetic acceleration on gpus for fully homomorphic encryption

    [Wang et al., 2023] Zhiwei Wang, Peinan Li, Rui Hou, Zhihao Li, Jiangfeng Cao, XiaoFeng Wang, and Dan Meng. HE-Booster: an efficient polynomial arithmetic acceleration on gpus for fully homomorphic encryption. IEEE Transactions on Parallel and Distributed Systems , 34(4):1067–1081,

    2023

  24. [45]

    On protecting the data privacy of large language mod- els (LLMs): A survey

    [Yan et al., 2024] Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzhen Cheng. On protecting the data privacy of large language mod- els (LLMs): A survey. arXiv preprint arXiv:2403.05156,

    2024 arXiv

  25. [46]

    Phantom: a cuda- accelerated word-wise homomorphic encryption library

    [Yang et al., 2024] Hao Yang, Shiyu Shen, Wangchen Dai, Lu Zhou, Zhe Liu, and Yunlei Zhao. Phantom: a cuda- accelerated word-wise homomorphic encryption library. IEEE Transactions on Dependable and Secure Computing,

    2024

  26. [47]

    Protocols for secure computa- tions

    [Yao, 1982] Andrew C Yao. Protocols for secure computa- tions. In 23rd annual symposium on foundations of com- puter science (sfcs 1982), pages 160–164. IEEE,

    1982

  27. [49]

    Sal-vit: To- wards latency efficiefnt private inference on vit using se- lective attention search with a learnable softmax approx- imation

    [Zhang et al., 2023] Yuke Zhang, Dake Chen, Souvik Kundu, Chenghao Li, and Peter A Beerel. Sal-vit: To- wards latency efficiefnt private inference on vit using se- lective attention search with a learnable softmax approx- imation. In Proceedings of the IEEE/CVF International C...

    2023

  28. [50]

    Secure transformer inference made non-interactive

    [Zhang et al., 2025] Jiawen Zhang, Jian Liu, Xinpeng Yang, Yinghao Wang, Kejia Chen, Xiaoyang Hou, Kui Ren, and Xiaohu Yang. Secure transformer inference made non-interactive. Network and Distributed System Security (NDSS) Symposium,

    2025

  29. [52]

    Primer: Fast private transformer inference on en- crypted data

    [Zheng et al., 2023] Mengxin Zheng, Qian Lou, and Lei Jiang. Primer: Fast private transformer inference on en- crypted data. In 2023 60th ACM/IEEE Design Automation Conference (DAC), pages 1–6. IEEE,

    2023

  30. [53]

    Power-softmax: Towards secure LLM inference over encrypted data

    [Zimerman et al., 2024] Itamar Zimerman, Allon Adir, Ehud Aharoni, Matan Avitan, Moran Baruch, Nir Drucker, Jenny Lerner, Ramy Masalha, Reut Meiri, and Omri Soceanu. Power-softmax: Towards secure LLM inference over encrypted data. arXiv preprint arXiv:2410.09457 , 2024

    2024 arXiv

  31. [1982]

    Mpcvit: Searching for accurate and efficient MPC-friendly vision transformer with heterogeneous at- tention

    [Zeng et al., 2023] Wenxuan Zeng, Meng Li, Wenjie Xiong, Tong Tong, Wen-jie Lu, Jin Tan, Runsheng Wang, and Ru Huang. Mpcvit: Searching for accurate and efficient MPC-friendly vision transformer with heterogeneous at- tention. In Proceedings of the IEEE/CVF International Confe...

    2023

  32. [1992]

    The-x: Privacy-preserving trans- former inference with homomorphic encryption

    [Chen et al., 2022] Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. The-x: Privacy-preserving trans- former inference with homomorphic encryption. arXiv preprint arXiv:2206.00216,

    2022 arXiv

  33. [2004]

    Whoops, samsung work- ers accidentally leaked trade secrets via ChatGPT

    [Mauran, 2023] Cecily Mauran. Whoops, samsung work- ers accidentally leaked trade secrets via ChatGPT. Mashable [online]. Dostupn ´e z: https://mashable. com/article/samsungchatgpt-leak-details,

    2023

  34. [2006]

    Ciphergpt: Se- cure two-party GPT inference

    [Hou et al., 2023] Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen-jie Lu, Cheng Hong, and Kui Ren. Ciphergpt: Se- cure two-party GPT inference. Cryptology ePrint Archive,

    2023

  35. [2009]

    SIGMA: secure GPT inference with function secret sharing

    [Gupta et al., 2023] Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nishanth Chandran, Divya Gupta, Ashish Pan- war, and Rahul Sharma. SIGMA: secure GPT inference with function secret sharing. Cryptology ePrint Archive,

    2023

  36. [2016]

    Efficient multiparty proto- cols using circuit randomization

    [Beaver, 1992] Donald Beaver. Efficient multiparty proto- cols using circuit randomization. In Advances in Cryp- tology—CRYPTO’91: Proceedings 11 , pages 420–432. Springer,

    1992

  37. [2017]

    GLUE: A multi-task benchmark and analysis plat- form for natural language understanding

    [Wang et al., 2018] Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bow- man. GLUE: A multi-task benchmark and analysis plat- form for natural language understanding. arXiv preprint arXiv:1804.07461,

    2018 arXiv

  38. [2018]

    Fully homomorphic encryption using ideal lattices

    [Gentry, 2009] Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 169–178,

    2009

  39. [2019]

    MPCFORMER: Fast, performant and private transformer inference with MPC

    [Li et al., 2022] Dacheng Li, Hongyi Wang, Rulin Shao, Han Guo, Eric Xing, and Hao Zhang. MPCFORMER: Fast, performant and private transformer inference with MPC. In The Eleventh International Conference on Learning Representations,

    2022

  40. [2020]

    [Chitty-Venkata et al., 2023] Krishna Teja Chitty-Venkata, Sparsh Mittal, Murali Emani, Venkatram Vishwanath, and Arun K. Somani. A survey of techniques for optimizing transformer inference. Journal of Systems Architecture , 144:102990,

    2023

  41. [2021]

    A fast learning algorithm for deep belief nets

    [Hinton et al., 2006] Geoffrey E Hinton, Simon Osindero, and Yee-Whye Teh. A fast learning algorithm for deep belief nets. Neural computation, 18(7):1527–1554,

    2006

  42. [2022]

    RNA-ViT: Reduced- dimension approximate normalized attention vision trans- formers for latency efficient private inference

    [Chen et al., 2023] Dake Chen, Yuke Zhang, Souvik Kundu, Chenghao Li, and Peter A Beerel. RNA-ViT: Reduced- dimension approximate normalized attention vision trans- formers for latency efficient private inference. In 2023 IEEE/ACM International Conference on Computer Aided Des...

    2023

  43. [2023]

    High-throughput semi-honest secure three-party computation with an hon- est majority

    [Araki et al., 2016] Toshinori Araki, Jun Furukawa, Yehuda Lindell, Ariel Nof, and Kazuma Ohara. High-throughput semi-honest secure three-party computation with an hon- est majority. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pag...

    2016

  44. [2024]

    Efficient homomorphic comparison meth- ods with optimal complexity

    [Cheon et al., 2020] Jung Hee Cheon, Dongwoo Kim, and Duhyeong Kim. Efficient homomorphic comparison meth- ods with optimal complexity. In Advances in Cryptology– ASIACRYPT 2020: 26th International Conference on the Theory and Application of Cryptology and Information Se- curi...

    2020

  45. [2025]

    Secure multi-party computation: theory, prac- tice and applications

    [Zhao et al., 2019] Chuan Zhao, Shengnan Zhao, Minghao Zhao, Zhenxiang Chen, Chong-Zhi Gao, Hongwei Li, and Yu-an Tan. Secure multi-party computation: theory, prac- tice and applications. Information Sciences, 476:357–372,

    2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.