Pith. sign in

REVIEW 4 major objections 4 minor 69 references

Securing Transformer-based AI Execution via Unified TEEs and Crypto-protected Accelerators

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TwinShield claims attention multiplication and SoftMax can run on untrusted GPUs without leaking data or model, at 4.0x–6.1x speedups.

desk verdict OutAttnMult is a genuine extension of prior outsourcing work, but OutSoftMax's field exponential is not implementable as written and the headline speedups rest on it. read the letter →

arxiv 2507.03278 v2 pith:HXPG2IUQ submitted 2025-07-04 cs.CR cs.LG

Jiaqi Xue , Yifei Zhao , Mengxin Zheng , Fan Yao , Yan Solihin , Qian Lou This is my paper · ORCID
classification cs.CRcs.LG
keywords trustedexecutionenvironmentsecureoutsourcedinferenceTransformerattentionSoftMaxoutsourcingverifiablecomputationsecretsharingGPUoffloadingprivacy-preservingmachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TwinShield is a scheme for running Transformer inference across a trusted CPU enclave and an untrusted GPU, and its central claim is that the two operations that dominate private inference — the attention product $QK^T$ and the SoftMax — can be handed to the accelerator without revealing the input data or the model and with results that can be checked. Prior hybrid schemes could outsource only linear layers whose weights are constants, because the attention product multiplies two runtime matrices and SoftMax is nonlinear; both therefore stayed in the enclave and became the bottleneck. TwinShield masks $Q$ and $K^T$ with random matrices and hides scaled copies of the masks inside permuted blocks so the GPU cannot tell data from mask, and it outsources exponentials by exploiting $e^{x - r} e^{r} = e^x$, leaving only sums and divisions inside the enclave. If the claim holds, about 87% of Transformer computation leaves the trusted hardware, with 4.0x to 6.1x faster verified inference than earlier secure schemes at no more than 1.9% accuracy loss.

What carries the argument

Three paired mechanisms carry the argument. The embedded additive outsource (OutAttnMult) is the central object for multiplicative attention: rather than precomputing a mask–weight product (impossible when both operands are runtime matrices), it stacks $Q + R_Q$ with a scaled mask block $a R_Q$ (and likewise for $K^T$), permutes the blocks with secret indices, and outsources one enlarged product, from which the enclave recovers $QK^T$ by scalar multiplications and subtractions. The exponential homomorphism (OutSoftMax) is the mechanism for the nonlinear step: the identity $e^{x - r} e^r = e^x$ moves $n$ enclave exponentiations to the GPU and leaves $2n$ multiplications and $n$ additions in the enclave. The check-product protocol (U-Verify) is the mechanism for integrity: a secret random vector $a$ hashes the input before masking, and verification is the identity $\prod_i (e^{x_i})^{a_i} = e^{\sum_i a_i x_i}$ for SoftMax and $h_Q (QK^T) = (h_Q Q) K^T$ for attention — both cheaper to check than to recompute, and both protected by fresh one-time masks.

What would settle it

Re-implement OutSoftMax exactly as specified — 8-bit fixed-point inputs, field $\mathbb{Z}_p$ with $p = 2^{24}-3$, masked values sent to a GPU that returns field exponentials — and measure end-to-end accuracy on ImageNet (ViT, CLIP), SST-2 (BERT), and WikiText perplexity (LLaMA). Unless some concrete definition of 'computes $e^{x_i}$' in $\mathbb{Z}_p$ reproduces the reported at-most-1.9% accuracy drop and 0.21 perplexity increase, the correctness claim is not yet supported.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that neither blocker to outsourcing is fundamental. For the attention multiplication, OutAttnMult blinds $Q$ and $K^T$ with random masks $R_Q$ and $R_{K^T}$, concatenates scaled masks $a R_Q$ and $b R_{K^T}$ into the blinded matrices, and permutes rows and columns before sending them to the GPU; the GPU's single enlarged product contains all the cross terms, and the enclave recovers $QK^T$ with scalar multiplications and additions, having turned a cubic enclave computation into quadratic recovery work. For SoftMax, OutSoftMax relies on the identity $e^{x_i} = e^{x_i - r_i} \cdot e^{r_i}$: the enclave sends masked values $x_i - r_i$, the GPU returns $e^{x_i - r_i}$, and the enclave restores $e^{x_i}$ by one multiplication with the precomputed $e^{r_i}$, keeping only the normalization sum and divisions inside. For integrity, U-Verify inserts a randomly weighted hash of the input — $\sum_i a_i x_i$ for SoftMax, a hash row $h_Q \cdot Q$ for attention — before masking, and afterwards checks a product identity such as $\prod_i (e^{x_i})^{a_i} = e^{\sum_i a_i x_i}$, which a tampering GPU cannot satisfy without knowing the coefficients, the masks, and where the hash was inserted. The paper reports roughly 87% of computation offloaded, 4.0x to 6.1x speedups with verification over prior schemes across vision, language, and multimodal Transformers, and at most 1.9% accuracy loss under 8-bit fixed-point quantization into the field $\mathbb{Z}_p$ with $p = 2^{24} - 3$.

Load-bearing premise

The scheme's correctness rests on an unstated implementation choice: the real-valued exponentials in SoftMax are assumed to be computable inside the paper's small finite field (prime $p = 2^{24} - 3$) with an approximation accurate enough that accuracy drops at most 1.9%, but the paper never specifies what that computation is.

Editorial extensions

If this is right

  • The enclave's attention work drops from cubic matrix multiplication to quadratic vector–matrix and element-wise work, so the speedup grows with sequence length: the paper reports 2.8x at 64 tokens rising to 10.7x at 256 tokens with verification.
  • Because SoftMax exponentiation leaves the enclave, long-context inputs — where the $O(N^2)$ attention map would otherwise dominate enclave time — become the regime where TwinShield gains the most.
  • U-Verify also improves verification of already-outsourced linear layers: embedding a hash row cuts the enclave check from three vector–matrix products to two, about 33% faster than Freivalds' algorithm on attention multiplication.
  • The same protocols run on FPGAs and TPUs as well as GPUs (1.93x–3.25x and 7.43x–10.91x latency reductions over TEE-only execution), so the approach does not depend on which accelerator the cloud happens to have.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The OutSoftMax trick belongs to a general family: any function obeying $f(x + r) = f(x) \cdot g(r)$ with $g$ precomputable can be outsourced identically, so other nonlinearities (for instance exponentials inside GeLU or normalization) are natural candidates for the same treatment.
  • The practical correctness claim rests on an unstated implementation detail: the paper does not say how $e^x$ is approximated inside $\mathbb{Z}_{2^{24}-3}$, so a published, reproducible instantiation of that step with a full error analysis is the direct next test of the claimed 1.9% accuracy bound.
  • The privacy argument's weakest spot is the indistinguishability of the scaled-mask blocks from the blinded-data blocks after permutation; a statistical distinguishing experiment on $[Q + R_Q; a R_Q]$ across repeated inferences would stress-test exactly that assumption.
  • The enclave still performs the SoftMax sum and the divisions, so the $O(N)$ normalization step remains trusted; outsourcing the denominator itself would require a masking identity for division and is the natural next scale-up for very long sequences.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. TwinShield is a framework for private and verifiable Transformer inference in a hybrid setting where a trusted CPU enclave (SGX-like TEE) outsources most computation to untrusted GPUs or other accelerators. The paper identifies two bottlenecks that prior additive-outsourcing schemes leave inside the TEE: multiplicative attention matrix multiplications (Q·K^T and attention·V) and the non-linear SoftMax. It proposes OutAttnMult, which blinds both operands and embeds additional masked products into one outsourced multiplication to recover Q·K^T in the TEE; OutSoftMax, which masks SoftMax inputs and outsources the exponentials, recovering e^x by multiplying with precomputed e^r; and U-Verify, which inserts a random linear hash into the outsourced data and checks a product identity to detect tampering. The experiments report end-to-end speedups of 4.0x–6.1x over prior approaches on ViT, BERT, CLIP, and LLaMA, with at most a 1.9% accuracy drop, and additional measurements on FPGA and TPU accelerators.

Significance. If the protocols were fully specified and correct, this would be a meaningful advance over Slalom-style additive outsourcing: it would move the two most expensive attention-related operations out of the enclave while preserving data privacy, function privacy, and verifiable integrity. The paper is also commendable for evaluating on vision, language, and multimodal Transformers and for including accelerator diversity (GPU, FPGA, TPU). The main design idea—turning multiplicative attention products into embedded additive outsourcing, and using the exponential's homomorphic-like property to outsource SoftMax—is plausible and worth pursuing. However, the correctness of the entire contribution currently rests on an unspecified finite-field exponential map. Because the paper's headline accuracy, security, and speedup claims all depend on that primitive, the result cannot yet be regarded as established. The security proofs in the appendix are also informal at a load-bearing point.

major comments (4)
  1. [V-B, Eqs. (9)-(14)] The protocol is specified over F = Z_p with p = 2^24 - 3, but no finite-field exponential e is defined. The exact equalities e^{x'_i} · e^{r_i} = e^{x_i} in Eq. (12) and ∏(e^{x_i})^{a_i} = e^{Σ a_i x_i} in Eq. (15) require e to be a group homomorphism from the additive group (F,+) to the multiplicative group (F^×,·). Since the additive group has order p and the multiplicative group has order p-1, and gcd(p, p-1) = 1, the only such homomorphism is trivial; no non-constant e satisfies these identities exactly. If e is instead a fixed-point polynomial approximation of the real exponential, Eqs. (12) and (15) hold only approximately and the stated at-most-1.9% accuracy bound does not account for that approximation error. If one tries modular exponentiation g^x, the stated correction for negative values (adding p) gives g^{p-a} = g^{-(a-1)}, not g^{-a}, and g^x wraps for x larger than a few, so that choice also does not approximate the real SoftMax numerator. Please specify the exact function computed by the accelerator (base, polynomial approximation, overflow handling, dequantization) and provide a correctness/error analysis that supports the reported accuracy and the claimed 92.9% offload of SoftMax cost.
  2. [Appendix, Theorem 1 and Lemma 1] The formal security claim for OutAttnMult rests on Lemma 1, which is asserted rather than proved. Lemma 1 states that an attacker cannot reconstruct QK^T from the observed ^QK^T and (QK^T)' because the transformations f and g are unknown; but in the protocol f and g are the published recovery and masking procedures, and only the random masks, scalars, and permutation keys are secret. The lemma therefore needs to be reduced to indistinguishability of those secret values. As written, Theorem 1 essentially restates the desired property rather than proving it. Theorem 2 also assumes without derivation that the attacker's choices (original vectors, masks, scalar coefficients, and permutation) are independent and uniform; this requires a proof or a precise statement of the distribution over the feasible set F(^X).
  3. [V-C, Eq. (15) and Security Analysis] The U-Verify check for OutSoftMax inherits the same finite-field exponential problem: the equality ∏(e^{x_i})^{a_i} = e^{Σ a_i x_i} is exact only if e is a group homomorphism from the additive group to the multiplicative group. Consequently, the stated attack-success probability of 1/(n·2^d) in Section V-C is not meaningful for any non-trivial implementation. In addition, the main text says the coefficients a_i are drawn from a space of size 2^d, while Appendix A says the coefficients are integers in (−L, L) and gives a success factor (1/2L)^k; these two descriptions should be reconciled, and the forgery probability should be derived with respect to the actual distribution used.
  4. [VI, Table VI] The accuracy evaluation compares the original floating-point model with a quantized model, not with the full TwinShield protocol. The reported at-most-1.9% drop therefore does not include any error introduced by the outsourced exponentiation, the scalar recovery/division steps, or modular arithmetic. Please report end-to-end accuracy/perplexity of the complete TwinShield pipeline (including GPU execution and TEE recovery) against the floating-point baseline, ideally with a breakdown of quantization error versus protocol error.
minor comments (4)
  1. [V-B] The text says 'For an input vector X ∈ F^n', but the SoftMax input in a real Transformer is real-valued; please clarify where fixed-point quantization and dequantization occur relative to Eqs. (9)–(14).
  2. [VI] The sentence 'For negative values, a correction p is applied' should specify the representative range and explain how multiplication and division modulo p interact with the fixed-point scale 2^l, especially because p = 2^24 - 3 is not a power of two.
  3. [VIII] The abstract reports 4.0x–6.1x speedups, while the conclusion says 3.9x–6.1x for private verifiable inference; make these numbers consistent.
  4. [Appendix A] The feasible-set construction uses t−n random masks and a parameter r ('obfuscation ratio') that is not defined in the protocol; please define t, r, and their relation to the matrix dimensions in Section V-A.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: TwinShield's protocols are built on standard masked multiplication and Freivalds-style verification, and its accuracy/speedup claims are evaluated against external baselines; the finite-field exponential gap is a correctness defect, not a circular derivation.

full rationale

TwinShield's derivation chain is self-contained. OutAttnMult implements a standard randomized masking protocol: the TEE samples R_Q and R_K^T, permutes the blinded operands, outsources the product to the GPU, and recovers QK^T by subtracting precomputed cross terms; the masks and scalars are design choices, not fitted to the reported speedups. U-Verify is Freivalds' algorithm with an embedded hash row, and its probabilistic soundness rests on random coefficients rather than on any target metric. OutSoftMax is the only fragile component: its equations require a nontrivial exponential over F_p with p=2^24-3 satisfying e^{x+r}=e^x e^r, which cannot exist because gcd(p,p-1)=1, and the offline phase still performs n exponentiations inside the TEE; however, these are mathematical implementability and accounting gaps, not a case of a conclusion being equivalent to its premises. Accuracy (at most 1.9% drop) and latency gains are measured against external Keras/TensorFlow pretrained models and prior TEE-only/additive-outsourcing baselines, with quantization parameters (l=8, p=2^24-3, a_max) selected as constants rather than fitted to the evaluation metrics. The only self-citations ([12],[13]) appear as contextual examples of private Transformer inference and are not load-bearing. No equation in the paper reduces by construction to its own input.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

No new cryptographic entities or forces are introduced. The security rests on standard primitives plus two unproven assumptions: that field exponentiation matches real softmax, and that the permutation-based blinding is sound. The free parameters are design choices, not fitted to the experimental outcomes.

free parameters (4)
  • Quantization fractional bits l = 8
    Chosen by hand in Section VI; sets fixed-point scaling and directly affects accuracy drop.
  • Finite field prime p = 2^24 - 3
    Selected as the arithmetic field for all outsourced computation; not justified by any security requirement.
  • Verification coefficient range amax = bounded by 3
    Efficiency/security tradeoff in Section V-C; smaller amax keeps verification multiplications low but weakens the checksum.
  • Scaling scalars a, b in OutAttnMult = not specified
    Used to hide mask rows in Section V-A; their bit width and value range are part of the security claim but never reported.
assumptions (5)
  • domain assumption TEE hardware (e.g., Intel SGX) provides confidentiality, integrity, and function privacy for enclave code
    The whole protocol treats the enclave as the root of trust; side-channel attacks are explicitly excluded in Section II.
  • standard math Additive secret sharing over F_p is information-theoretically secure
    Assumed in Sections III-C and V-B for the masking of Q, K, and X.
  • standard math Freivalds' algorithm gives a valid randomized matrix-product check with error bound 1/|S|
    Used as the basis for U-Verify reasoning in Sections III-D, V-C, and Appendix B.
  • ad hoc to paper Exponentiation in Z_p with an unspecified base approximates the real softmax exponential
    OutSoftMax (Section V-B) computes e^{x_i} in the field but never defines the base or approximation; the accuracy experiments are the only evidence it works.
  • ad hoc to paper The permutation and scalar blinding in OutAttnMult make masked rows indistinguishable from true rows
    Security analysis in Section V-A and Appendix A is informal; Lemma 1 is postulated rather than proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing Transformer-based AI Execution via Unified TEEs and Crypto-protected Accelerators." pith.science (2026). https://pith.science/paper/HXPG2IUQ

@misc{pith2026250703278,
  author       = {Pith},
  title        = {Pith review of: Securing Transformer-based AI Execution via Unified TEEs and Crypto-protected Accelerators},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HXPG2IUQ}},
  note         = {Machine review of arXiv:2507.03278}
}
read the original abstract

Recent advances in Transformer models, e.g., large language models (LLMs), have brought tremendous breakthroughs in various artificial intelligence (AI) tasks, leading to their wide applications in many security-critical domains. Due to their unprecedented scale and prohibitively high development cost, these models have become highly valuable intellectual property for AI stakeholders and are increasingly deployed via machine learning as a service (MLaaS). However, MLaaS often runs on untrusted cloud infrastructure, exposing data and models to potential breaches. Mainstream protection mechanisms leverage trusted execution environments (TEEs) where confidentiality and integrity for secretive data are shielded using hardware-based encryption and integrity checking. Unfortunately, running model inference entirely within TEEs is subject to non-trivial slowdown, which is further exacerbated in LLMs due to the substantial computation and memory footprint involved. Recent studies reveal that the hybrid TEE-based scheme offloading partial model inference operations to the untrusted accelerators (e.g., GPU) is a promising solution. However, prior offloading schemes fail to ensure dual protection of data and model in Transformer inference, as they cannot securely offload critical operations, i.e., Attention and SoftMax, forcing these computations to remain confined within TEEs. To address these challenges, we propose TwinShield, a framework enabling secure Transformer inference in heterogeneous TEE and accelerator systems with dual protection for both model and data. TwinShield offloads ~87% of computation to GPUs and delivers 4.0x - 6.1x speedups over previous approaches across various Transformer models.

Figures

Figures reproduced from arXiv: 2507.03278 by the authors.

Figure 1
Figure 1. (a) OutAttnMult’s operations within TEEs. (b) OutSoftMax outsources time-consuming exponential calculations in the SoftMax to enhance effi￾ciency. (c) U-Verify is performed after recovering the outsourced computation to verify the integrity of the computation by checking the product. The starting point is to securely outsource the additive linear operations. We adapt method from prior work [19] and integrate our pro… view at source ↗
Figure 2
Figure 2. Illustration of Outsource Multiplicative attention operation: [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Outsourcing non-linear SoftMax: OutSoftMax Complexity Analysis. In the offline phase, Outsource Masked e X, the TEEs prepare for the SoftMax operation by sampling and precomputing the exponentiations of n random values, one for each element of the input vector. During the first online phase, the TEEs mask each input element by performing n subtractions. The masked values are then outsourced to the accelerator for fu… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: U-Verify on OutSoftMax [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: U-Verify on OutAttnMult. However, multiple barriers prevent such an attack. First, the permutation procedure in OutAttnMult obscures hashQ within a mixture of hashQ and Q, making it impossible for the attacker to identify hashQ. Second, the additive masks ap￾plied duri…
Figure 6
Figure 6. Figure 6: TwinShield obtains higher performance speedup on long-token inputs. the same CPU, but outside SGX enclave mode. Table II demonstrates benchmarks for BERT and ViT on a single core with either direct computation or various secure out￾sourcing schemes. On the BERT, by out…
Figure 7
Figure 7. Figure 7: Performance comparison of OutAttnMult (a) and OutSoftMax (b) over TEE-only execution. 0.216 s, achieving a substantial 83.3% reduction for a single BERT inference. TABLE III ABLATION STUDY OF PROPOSED TECHNIQUES. TEE-ONLY NATIVELY PROVIDES INTEGRITY GUARANTEE. Techniqu…
Figure 8
Figure 8. Figure 8: Comparison between Freivalds’ algorithm and [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 54 canonical work pages

  1. [1]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  2. [2]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

    arXiv 2010

  3. [3]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805, 2018

    arXiv 2018

  4. [4]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar et al. , “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    arXiv 2023

  5. [5]

    Gpt-3: Its nature, scope, limits, and consequences,

    L. Floridi and M. Chiriatti, “Gpt-3: Its nature, scope, limits, and consequences,” Minds and Machines , vol. 30, pp. 681–694, 2020

    2020

  6. [6]

    Applications of machine learning to diagnosis and treatment of neu- rodegenerative diseases,

    M. A. Myszczynska, P. N. Ojamies, A. M. Lacoste, D. Neil, A. Saffari, R. Mead, G. M. Hautbergue, J. D. Holbrook, and L. Ferraiuolo, “Applications of machine learning to diagnosis and treatment of neu- rodegenerative diseases,” Nature Reviews Neurology, vol. 16, no. 8, pp. 440–456, 2020. 12

    work page 2020

  7. [7]

    Improving the accuracy of med- ical diagnosis with causal machine learning,

    J. G. Richens, C. M. Lee, and S. Johri, “Improving the accuracy of med- ical diagnosis with causal machine learning,” Nature communications, vol. 11, no. 1, p. 3923, 2020

    work page 2020

  8. [8]

    Deep learning for finance: deep portfolios,

    J. B. Heaton, N. G. Polson, and J. H. Witte, “Deep learning for finance: deep portfolios,” Applied Stochastic Models in Business and Industry , vol. 33, no. 1, pp. 3–12, 2017

    work page 2017

Show all 69 references
  1. [9]

    Hey alexa. . . examine the variables influencing the use of artificial intelligent in-home voice assistants,

    G. McLean and K. Osei-Frimpong, “Hey alexa. . . examine the variables influencing the use of artificial intelligent in-home voice assistants,” Computers in Human Behavior , vol. 99, pp. 28–37, 2019

    2019

  2. [10]

    Learning to communicate with deep multi-agent reinforcement learning,

    J. Foerster, I. A. Assael, N. De Freitas, and S. Whiteson, “Learning to communicate with deep multi-agent reinforcement learning,” Advances in neural information processing systems , vol. 29, 2016

    2016

  3. [11]

    Chex-mix: Com- bining homomorphic encryption with trusted execution environments for oblivious inference in the cloud,

    D. Natarajan, A. Loveless, W. Dai, and R. Dreslinski, “Chex-mix: Com- bining homomorphic encryption with trusted execution environments for oblivious inference in the cloud,” in 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P) . IEEE, 2023, pp. 73– 91

    2023

  4. [12]

    Cipherprune: Efficient and scalable private transformer inference,

    Y . Zhang, J. Xue, M. Zheng, M. Xie, M. Zhang, L. Jiang, and Q. Lou, “Cipherprune: Efficient and scalable private transformer inference,” in The Thirteenth International Conference on Learning Representations

  5. [13]

    Primer: Fast private transformer inference on encrypted data,

    M. Zheng, Q. Lou, and L. Jiang, “Primer: Fast private transformer inference on encrypted data,” DAC 2023, 2023

    2023

  6. [14]

    Breakingformation: Orca security research team discovers aws cloudformation vulnerability,

    T. Pahima, “Breakingformation: Orca security research team discovers aws cloudformation vulnerability,” Complete Cloud Security in Minutes- Orca Security, 2022

    2022

  7. [15]

    Google cloud: Here are the six’best’vulnerabilities security researchers found last year,

    L. Tung, “Google cloud: Here are the six’best’vulnerabilities security researchers found last year,” ZDNET, Mar, 2021

    2021

  8. [16]

    Intel® software guard extensions (intel® sgx) developer guide,

    “Intel® software guard extensions (intel® sgx) developer guide,” https://www.intel.com/content/www/us/en/developer/tools/ software-guard-extensions/overview.html, 2023

    2023

  9. [17]

    Intel® software guard extensions (intel® sgx) developer guide,

    “Intel® software guard extensions (intel® sgx) developer guide,” https://www.intel.com/content/www/us/en/developer/tools/ software-guard-extensions/attestation-services.html, 2023

    2023

  10. [18]

    Mlcapsule: Guarded offline deployment of machine learning as a service,

    L. Hanzlik, Y . Zhang, K. Grosse, A. Salem, M. Augustin, M. Backes, and M. Fritz, “Mlcapsule: Guarded offline deployment of machine learning as a service,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 3300–3309

    2021

  11. [19]

    Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,

    F. Tramer and D. Boneh, “Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,” in International Conference on Learning Representations, 2018

    2018

  12. [20]

    Shad- ownet: A secure and efficient on-device model inference system for convolutional neural networks,

    Z. Sun, R. Sun, C. Liu, A. R. Chowdhury, L. Lu, and S. Jha, “Shad- ownet: A secure and efficient on-device model inference system for convolutional neural networks,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 1596–1612

    2023

  13. [21]

    {SOTER}: Guarding black-box inference for general neural networks at the edge,

    T. Shen, J. Qi, J. Jiang, X. Wang, S. Wen, X. Chen, S. Zhao, S. Wang, L. Chen, X. Luo et al. , “ {SOTER}: Guarding black-box inference for general neural networks at the edge,” in 2022 USENIX Annual Technical Conference (USENIX ATC 22) , 2022, pp. 723–738

    2022

  14. [22]

    Darknight: An accelerated framework for privacy and integrity preserving deep learning using trusted hardware,

    H. Hashemi, Y . Wang, and M. Annavaram, “Darknight: An accelerated framework for privacy and integrity preserving deep learning using trusted hardware,” in MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture, 2021, pp. 212–224

    2021

  15. [23]

    Trinity: A general purpose fhe accelerator,

    X. Deng, S. Fan, Z. Hu, Z. Tian, Z. Yang, J. Yu, D. Cao, D. Meng, R. Hou, M. Li et al. , “Trinity: A general purpose fhe accelerator,” Accepted by MICRO’24 , 2024

    2024

  16. [24]

    Boostcom: Towards efficient universal fully homomorphic encryption by boosting the word-wise comparisons,

    A. W. B. Yudha, J. Xue, Q. Lou, H. Zhou, and Y . Solihin, “Boostcom: Towards efficient universal fully homomorphic encryption by boosting the word-wise comparisons,” in(PACT’24) The International Conference on Parallel Architectures and Compilation Techniques (PACT) , 2024

    2024

  17. [25]

    Probabilistic machines can use less running time

    R. Freivalds, “Probabilistic machines can use less running time.” in IFIP congress, vol. 839, 1977, p. 842

    1977

  18. [26]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    2023 arXiv

  19. [27]

    Medical gpt,

    “Medical gpt,” https://www.medicalgpt.info/, 2024

    2024

  20. [28]

    Finance gpt,

    “Finance gpt,” https://financegpt.uk/, 2024

    2024

  21. [29]

    Foreshadow: Extracting the keys to the intel {SGX} kingdom with transient {Out- of-Order} execution,

    J. Van Bulck, M. Minkin, O. Weisse, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, T. F. Wenisch, Y . Yarom, and R. Strackx, “Foreshadow: Extracting the keys to the intel {SGX} kingdom with transient {Out- of-Order} execution,” in 27th USENIX Security Symposium (USENIX Se...

    2018

  22. [30]

    Ridl: Rogue in-flight data load,

    S. Van Schaik, A. Milburn, S. ¨Osterlund, P. Frigo, G. Maisuradze, K. Razavi, H. Bos, and C. Giuffrida, “Ridl: Rogue in-flight data load,” in 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 2019, pp. 88–105

    2019

  23. [31]

    Fallout: Leaking data on meltdown-resistant cpus,

    C. Canella, D. Genkin, L. Giner, D. Gruss, M. Lipp, M. Minkin, D. Moghimi, F. Piessens, M. Schwarz, B. Sunar et al., “Fallout: Leaking data on meltdown-resistant cpus,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019, pp. 769–784

    2019

  24. [32]

    Dr. sgx: Automated and adjustable side-channel protection for sgx using data location randomization,

    F. Brasser, S. Capkun, A. Dmitrienko, T. Frassetto, K. Kostiainen, and A.-R. Sadeghi, “Dr. sgx: Automated and adjustable side-channel protection for sgx using data location randomization,” in Proceedings of the 35th Annual Computer Security Applications Conference , 2019, pp. 788–800

    2019

  25. [33]

    A survey of microarchitectural side-channel vulnerabilities, attacks, and defenses in cryptography,

    X. Lou, T. Zhang, J. Jiang, and Y . Zhang, “A survey of microarchitectural side-channel vulnerabilities, attacks, and defenses in cryptography,” ACM Computing Surveys (CSUR) , vol. 54, no. 6, pp. 1–37, 2021

    2021

  26. [34]

    Controlled-channel attacks: Deter- ministic side channels for untrusted operating systems,

    Y . Xu, W. Cui, and M. Peinado, “Controlled-channel attacks: Deter- ministic side channels for untrusted operating systems,” in 2015 IEEE Symposium on Security and Privacy . IEEE, 2015, pp. 640–656

    2015

  27. [35]

    Nvidia hopper h100 gpu: Scaling performance,

    J. Choquette, “Nvidia hopper h100 gpu: Scaling performance,” IEEE Micro, vol. 43, no. 3, pp. 9–17, 2023

    2023

  28. [36]

    Cramer, I

    R. Cramer, I. B. Damg ˚ard et al. , Secure multiparty computation . Cambridge University Press, 2015

    2015

  29. [37]

    Aby-a framework for efficient mixed-protocol secure two-party computation

    D. Demmler, T. Schneider, and M. Zohner, “Aby-a framework for efficient mixed-protocol secure two-party computation.” in NDSS, 2015

    2015

  30. [38]

    She: A fast and accurate deep neural network for encrypted data,

    Q. Lou and L. Jiang, “She: A fast and accurate deep neural network for encrypted data,” in Advances in Neural Information Processing Systems (NeurIPS) 2019, 2019, pp. 10 035–10 043

    2019

  31. [39]

    The-v: Verifiable privacy-preserving neural network via trusted homomorphic execution,

    Y . Wei, X. Wang, S. Bian, W. Zhao, and Y . Jin, “The-v: Verifiable privacy-preserving neural network via trusted homomorphic execution,” in 2023 IEEE/ACM International Conference on Computer Aided Design (ICCAD). IEEE, 2023, pp. 1–9

    2023

  32. [40]

    Tensorscone: A secure tensorflow framework using intel sgx,

    R. Kunkel, D. L. Quoc, F. Gregor, S. Arnautov, P. Bhatotia, and C. Fetzer, “Tensorscone: A secure tensorflow framework using intel sgx,” arXiv preprint arXiv:1902.04413 , 2019

    1902 arXiv

  33. [41]

    Occlumency: Privacy-preserving remote deep-learning inference using sgx,

    T. Lee, Z. Lin, S. Pushp, C. Li, Y . Liu, Y . Lee, F. Xu, C. Xu, L. Zhang, and J. Song, “Occlumency: Privacy-preserving remote deep-learning inference using sgx,” in The 25th Annual International Conference on Mobile Computing and Networking , 2019, pp. 1–17

    2019

  34. [42]

    Nnsplitter: an active defense solu- tion for dnn model via automated weight obfuscation,

    T. Zhou, Y . Luo, S. Ren, and X. Xu, “Nnsplitter: an active defense solu- tion for dnn model via automated weight obfuscation,” in Proceedings of the 40th International Conference on Machine Learning , ser. ICML’23. JMLR.org, 2023

    2023

  35. [43]

    No privacy left outside: On the (in-) security of tee-shielded dnn partition for on-device ml,

    Z. Zhang, C. Gong, Y . Cai, Y . Yuan, B. Liu, D. Li, Y . Guo, and X. Chen, “No privacy left outside: On the (in-) security of tee-shielded dnn partition for on-device ml,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2023, pp. 52–52

    2024

  36. [44]

    Mirrornet: A tee-friendly framework for secure on-device dnn inference,

    Z. Liu, Y . Luo, S. Duan, T. Zhou, and X. Xu, “Mirrornet: A tee-friendly framework for secure on-device dnn inference,” in 2023 IEEE/ACM International Conference on Computer Aided Design (ICCAD) . IEEE, 2023, pp. 1–9

    2023

  37. [45]

    Teeslice: slicing dnn models for secure and efficient deployment,

    Z. Zhang, L. K. Ng, B. Liu, Y . Cai, D. Li, Y . Guo, and X. Chen, “Teeslice: slicing dnn models for secure and efficient deployment,” in Proceedings of the 2nd ACM International Workshop on AI and Software Testing/Analysis, 2022, pp. 1–8

    2022

  38. [46]

    A public key cryptosystem and a signature scheme based on discrete logarithms,

    T. ElGamal, “A public key cryptosystem and a signature scheme based on discrete logarithms,” IEEE transactions on information theory , vol. 31, no. 4, pp. 469–472, 1985

    1985

  39. [47]

    Public-key cryptosystems based on composite degree residu- osity classes,

    P. Paillier, “Public-key cryptosystems based on composite degree residu- osity classes,” in International conference on the theory and applications of cryptographic techniques . Springer, 1999, pp. 223–238

    1999

  40. [48]

    Tempo: Confidentiality preservation in cloud-based neural network training,

    R. Xu and Z. Fang, “Tempo: Confidentiality preservation in cloud-based neural network training,” arXiv preprint arXiv:2401.11531 , 2024

    2024 arXiv

  41. [49]

    Introduction to modern cryptography,

    M. Bellare and P. Rogaway, “Introduction to modern cryptography,” Lecture Notes, 2001

    2001

  42. [50]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natural language supervision,” in International conference on machine learning . PMLR, 2021, pp. 8748–8763

    2021

  43. [51]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition . Ieee, 2009, pp. 248–255

    2009

  44. [52]

    Recursive deep models for semantic compositionality over a 13 sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y . Ng, and C. Potts, “Recursive deep models for semantic compositionality over a 13 sentiment treebank,” in Proceedings of the 2013 conference on empirical methods in natural language processing , 2013, pp. 1631–1642

    2013

  45. [53]

    Pointer sentinel mixture models,

    S. Merity, C. Xiong, J. Bradbury, and R. Socher, “Pointer sentinel mixture models,” arXiv preprint arXiv:1609.07843 , 2016

    2016 arXiv

  46. [54]

    Eigen v3,

    G. Guennebaud, B. Jacob et al., “Eigen v3,” http://eigen.tuxfamily.org, 2010

    2010

  47. [55]

    Chollet et al., “Keras,” https://keras.io, 2015

    F. Chollet et al., “Keras,” https://keras.io, 2015

    2015

  48. [56]

    Post-training quantization for vision transformer,

    Z. Liu, Y . Wang, K. Han, W. Zhang, S. Ma, and W. Gao, “Post-training quantization for vision transformer,” Advances in Neural Information Processing Systems, vol. 34, pp. 28 092–28 103, 2021

    2021

  49. [57]

    I-bert: Integer-only bert quantization,

    S. Kim, A. Gholami, Z. Yao, M. W. Mahoney, and K. Keutzer, “I-bert: Integer-only bert quantization,” in International conference on machine learning. PMLR, 2021, pp. 5506–5518

    2021

  50. [58]

    Hugging face

    “Hugging face.” https://huggingface.co/, 2024

    2024

  51. [59]

    Katz and Y

    J. Katz and Y . Lindell, Introduction to modern cryptography: principles and protocols. Chapman and hall/CRC, 2007. APPENDIX In this section, we will outline the method to construct the feasible set, F ( ˆX) for a given transformed matrix ˆX (the X could be Q or K T ). We refe...

    2007

  52. [60]

    Select the set of t − n indices uniformly at random: Ω ⊂R [m], |Ω| = t − n (17) Ω represents a possible set of indices that correspond to the mask vectors

  53. [61]

    The corresponding set of mask vectors is: ΦΩ = { ˆxi|i ∈ Ω} (18)

  54. [62]

    Additionally, let X = [x1, ...,xn] where xi ∈ ΦΩ and xi ̸= xj, i, j∈ [n], i ̸= j

    Let ΦΩ = { ˆxi|i ∈ [n]\Ω} be the set of transformed original vectors. Additionally, let X = [x1, ...,xn] where xi ∈ ΦΩ and xi ̸= xj, i, j∈ [n], i ̸= j

  55. [63]

    Thus X α = [xσ(1), ...,xσ(n)] represents a possi- ble transformed matrix

    Sample a random permutation σ to recover the shuffled matrix. Thus X α = [xσ(1), ...,xσ(n)] represents a possi- ble transformed matrix

  56. [64]

    Compute ∀i ∈ [n] F i Ω,σ( ˆX) = {x|x = d · (xσ(i) − ˆx′), d∈ R, ˆx′ ⊂R ΦΩ} (19) F i Ω,σ( ˆX) denotes the set of possible values for the vector xi for the give Ω and σ

  57. [65]

    Additionlly, it is evident that F ( ˆXa) ⊃ F( ˆXb) where ta = | ˆXa| > | ˆXb| = tb (equivalently, ta > tb)

    Clearly, we have F ( ˆX) = [ Ω [ σ FΩ,σ( ˆX) (20) Clearly, larger the value of obfuscation ratio r, greater is the size of Ω and consequently, F ( ˆX). Additionlly, it is evident that F ( ˆXa) ⊃ F( ˆXb) where ta = | ˆXa| > | ˆXb| = tb (equivalently, ta > tb). For the transform...

  58. [66]

    Selection of Original Vectors: The correct identification of the original n vectors from a total of 2n vectors is represented by the combinatorial ratio ( n n) ( 2n n ), indicating the statistical likelihood of choosing the exact subset of original vectors

  59. [67]

    Mask Identification: In the obfuscation process, correctly identifying the appropriate masks from the remaining n vectors has a probability of 1 2n−n n , assuming each choice is independent and uniform

  60. [68]

    Thus, the probability of correctly guessing all coefficients is 1 2L n

    Scalar Coefficients: The scalar coefficients, which are integers within the range (−L, L), have a uniform prob- ability distribution. Thus, the probability of correctly guessing all coefficients is 1 2L n

  61. [69]

    Given the transformed vector X ′ = [ x1 − r1, ..., xi − ri], it is infeasible for an attacker to recover the original vector X = [ x1, x2, ..., xi]

    Order Recovery: The likelihood of correctly re- establishing the original sequence in the shuffled matrix is represented by the permutation probability 1 n!. Given the transformed vector X ′ = [ x1 − r1, ..., xi − ri], it is infeasible for an attacker to recover the original v...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.