Pith. sign in

REVIEW 3 major objections 5 minor 33 references

Cascade: Token-Sharded Private LLM Inference

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Cascade proposes token-sharded multi-party inference that trades cryptographic guarantees for statistical privacy, claiming resistance to a generalized vocab-matching attack while running orders of magnitude faster than SMPC.

desk verdict Cascade's advertised privacy does not hold: under the recommended m-split, any CompNode can recover out-of-shard tokens with an O(V) match per token, bypassing the paper's V^rho security barrier. read the letter →

arxiv 2507.05228 v1 pith:FVD2ZJGC submitted 2025-07-07 cs.LG cs.CR

Rahul Thomas , Louai Zahran , Erica Choi , Akilesh Potti , Micah Goldblum , Arka Pal This is my paper
classification cs.LGcs.CR
keywords privateLLMinferencetokenshardingvocab-matchingattackstatisticalprivacysecuremulti-partycomputationtransformerhiddenstateinversion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Cascade aims to make third-party LLM inference private without the cost of secure multi-party computation. The paper's proposal is to shard a user's prompt along the token dimension across several non-colluding nodes, so no single node sees consecutive hidden states at small gaps; an adversary must then pay a cost of $V^g$ forward passes, where $V$ is the vocabulary size and $g$ is the largest gap between the shards it sees. The paper claims that with gaps at least the vocab-matching threshold $\rho$, this cost is infeasible, and that learning-based hidden-state inversion also fails for shards of width at least eight clusters. If correct, Cascade gives a practical middle ground: it preserves model accuracy, adds little latency, and runs orders of magnitude faster than SMPC baselines, at the price of statistical rather than cryptographic privacy.

What carries the argument

The load-bearing object is a $(c,\delta)$-sharding of the sequence: each node holds token indices in arithmetic clusters of $c$ consecutive positions repeated every $\delta$ positions. The argument runs through the generalized vocab-matching attack's cost bound: given hidden states at indices $i_1<\dots<i_k$, the attack needs at most $V^{i_1}+V^{i_2-i_1}+\dots+V^{i_k-i_{k-1}}$ forward passes, dominated by $V^g$ for the maximum gap $g$. Cascade's nodes are CompNodes, which process sharded hidden states as batch-like rows, and AttnNodes, which compute partial attention outputs; a post-pass recombines the partial outputs with a numerically stable weighted average of the row maximums $m$, expsums $e$, and partial value outputs $u$. Choosing $(c,\delta)$ so that $\delta-c+1$ is at least $\rho$ makes the dominant term $V^{\delta-c+1}$ infeasible under the paper's adversarial-cost assumption, and the learning-based experiments confirm the same parameter regime.

What would settle it

Run the generalized vocab-matching attack on a Cascade deployment with enough compute to attempt $V^3$ forward passes on the victim model; for Gemma-2-2B-IT this is roughly $1.7\times 10^{16}$ forward passes at $V\approx 256{,}000$, and completing it within a plausible attack budget would falsify the $\rho=3$ threshold, showing the recommended gaps are too small.

Watch

Extended reading notes

Core claim

The central claim is that token-level sharding, not cryptography, is enough to stop hidden-state reconstruction attacks on causal LLMs. The paper generalizes the vocab-matching attack to sharded hidden states and shows that its cost scales as $V^g$ for the largest gap $g$ between revealed token indices; defining the vocab-matching threshold $\rho$ as the smallest gap for which $V^\rho$ forward passes is infeasible, it proves (Theorem 6.2) that a shard whose clusters are separated by gaps of at least $\rho$ blocks the attack. Cascade distributes hidden rows $R_i$ among CompNodes and Q/K/V rows $S_j$ among AttnNodes using $(c,\delta)$-sharding, and the paper reports that reconstruction quality from learning-based attacks falls to ROUGE-L below 0.25 for $c,\alpha\ge 8$. A stated limitation is that layer-0 embeddings are directly reversible, so token-level security requires a hybrid with SMPC on early layers.

Load-bearing premise

The load-bearing premise is that no realistic adversary can afford $V^3$ forward passes for the model's vocabulary size $V$, since the paper's recommended shard gaps are chosen to make that workload infeasible.

Editorial extensions

If this is right

  • If Cascade holds up, private inference on open-weight models becomes a deployment problem rather than a cryptographic one: the bottleneck is node count and gap size, not protocol overhead.
  • It preserves model quality exactly, because no approximation of non-linearities is needed, unlike MPCFormer- or Puma-style schemes.
  • Its communication cost scales mainly with sequence length and AttnNode count, not model depth, so the protocol extends to the largest current LLMs.
  • KV-caching carries over to the sharded setting, so after the first generated token only one CompNode and its associated AttnNodes are active.
  • A hybrid Cascade-SMPC protocol can protect tokens that must never be revealed, while keeping most of Cascade's speed on later layers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the asserted $\rho=3$ threshold is the real linchpin; a security evaluation that prices a cubed-vocabulary number of forward passes on current GPU hardware would either validate or overturn every recommended parameter.
  • My inference: since colluding nodes merely union their shards, Cascade's guarantees degrade sharply when even a small coalition forms; designing shards that maximize the union gap under a given number of colluding nodes is a direct next step.
  • My inference: layer-0 reversibility means the practical deployment envelope is prompts whose worst-case token leakage is acceptable, or the hybrid schedule; measuring how much leakage survives after one or two Transformer layers would sharpen where the hybrid split should be.
  • My inference: the same sequence-gap argument could be applied to bidirectional architectures by treating each causal direction separately, and the paper's attack generalization itself gives a standard metric for evaluating future statistical obfuscation schemes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Cascade, a statistical multi-party protocol for private LLM inference in the open-weights setting. Instead of SMPC, the protocol shards the token dimension: CompNodes hold disjoint hidden-state shards R_i, AttnNodes compute partial attention statistics on Q/K/V shards, and CompNodes recombine the m/e/u shards through a numerically stable weighted average. The paper generalizes the authors' earlier vocab-matching attack to sharded hidden states, proves (Theorem 6.2) that protection requires (k,l)-gaps of size at least rho, introduces (c,delta)-sharding to satisfy this, and reports ROUGE-L/BLEU experiments plus benchmarks showing orders-of-magnitude speedups over MPCFormer and Puma. The central claims are that Cascade is resistant to the generalized vocab-matching attack and to learning-based attacks.

Significance. If the security claims were correct, this would be a significant step: a practical, scalable private-inference scheme with near-vanilla performance, communication that scales linearly in beta, careful cost formulas in Section 7 and Appendix D, and a clean aggregation identity in Section 5.2.3. The generalization of the vocab-matching attack is also a useful contribution. However, the central privacy claim is currently undermined by an attack in the paper's own threat model, and the empirical security evaluation is not sufficiently documented to support the learning-based-attack claims. The protocol may be repairable by reworking the S-sharding, but the paper as written does not establish Cascade's security.

major comments (3)
  1. [Section 6.4 / Theorem 6.2] The recommended m-split S-sharding enables a CompNode to recover every token outside its own shard in O(V) time per token, contradicting the security conclusion. Fix a CompNode i and a key shard S_k, and write R_i = {r_1 < ... < r_m}. As the proof of Theorem 6.2 itself shows, CompNode i can compute Y_l = exp(a_{r_l,S_k})v_{S_k} = sum_{s in S_k, s<r_l} exp(q_{r_l}^T k_s) v_s for every row r_l. Under the m-split construction of Section 6.4 (each S_k contains one element per period delta), the set {s in S_k : r_l < s < r_{l+1}} has size at most one for every consecutive pair r_l, r_{l+1}. Having recovered or knowing all earlier tokens in S_k, the node subtracts their exactly computable contributions at row r_{l+1}; the remainder is a single summand exp(q_{r_{l+1}}^T k_{s*})v_{s*}. Enumerating the V vocabulary entries identifies s* in O(V) time. Repeating over l and k recovers every token outside R_i. This directly contradicts the claim that delta-c+1 >= rho+1 suffices: for the m-split, the (k,l)-gap of Theorem 6.2 is 1, not delta-c+1, so the theorem's own condition fails. The recommended settings c,alpha >= 8 and m >= 4 are therefore not private against the paper's own generalized attack, regardless of rho.
  2. [Section 6.2, Tables 3-5] The evidence for resistance to learning-based attacks is not sufficient to support the claim. Tables 3, 4, and 5 report ROUGE-L and BLEU means for Gemma-2-2B-IT and Llama-3.1-8B-Instruct without stating the number of test prompts, the split of FineWeb-Edu used, or the training hyperparameters, and without error bars or multiple seeds. No code is released. The assertion that a ROUGE-L score below 0.25 indicates 'significant reconstruction difficulty' is not calibrated against any baseline such as random infilling or an n-gram prior. Because these experiments are the only support for the 'resistant to learning-based attacks' contribution, that part of the abstract is currently unsupported.
  3. [Section 4.2, Definition 4.1] The statement that 'the vocab-matching threshold of any adversary is likely no more than rho=3 in practice' is an unquantified assertion about adversary compute, and it is load-bearing for every asymptotic security statement in Sections 6.2 and 6.3 and Appendix E. The paper should either derive rho from an explicit cost model (FLOPs, memory, wall-clock time) or treat it purely as a user-supplied parameter and present all results as a function of rho. This concern is secondary to the attack in the first major comment, since that attack works even for rho=3, but it still needs to be fixed if the theoretical analysis is to be meaningful.
minor comments (5)
  1. [Section 6.4] The definition of R_{i,x} says it contains elements 'at indices x, x+delta, ..., x+(t-1)delta', but the example partitions sorted R_i into every c-th position; the formula should read 'x, x+c, ..., x+(t-1)c' or an equivalent expression.
  2. [Theorem 6.2] The proof refers to 'the vocab-matching threshold rho, as defined in Theorem 4.1', but rho is defined in Definition 4.1, not in a theorem.
  3. [Section 6.4] The sentence 'Experiments are conducted with the same dataset and model setup as described .' is incomplete and should be finished or removed.
  4. [Section 1] The phrase 'recently, various SMPC schemes have been formulated for for LLMs' contains a duplicated 'for'.
  5. [Appendix E] Assumption (B2) is essentially the security claim itself; the reduction to a vector subset-sum problem does not establish intractability for the specific distributions of the candidate sets A_x. The authors do acknowledge this, but the text should make clearer that Appendix E does not provide a proof of security.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the security claim rests on the authors' own vocab-matching threshold and prior attack, but external learning-based attack evaluations provide independent support.

full rationale

The paper's central security argument is conditional rather than circular. Section 4.2 defines the vocab-matching threshold as rho := t_max + 1 and asserts that 'the vocab-matching threshold of any adversary is likely no more than rho=3 in practice.' Sections 6.2 and 6.3 then choose (c, delta)-sharding so that cluster gaps exceed this threshold. This threat model is self-referential, since the generalized attack extends the authors' own prior work (Thomas et al., 2025), but the scheme's resistance is not obtained by fitting parameters to the evaluation results. The ROUGE and BLEU experiments against learning-based attacks (Wan et al., 2024; Morris et al., 2023) are external checks that do not define rho or the gap condition. No equation is defined in terms of the target claim, and no fitted parameter is renamed as a prediction. The main weakness is a correctness risk rather than circularity: the asserted rho <= 3 bound is load-bearing and unproven, and the proof of Theorem 6.2 closely mirrors the definition of rho. That said, this is an assumption about adversary resources, not a circular derivation, so the paper earns only a low score for self-citation without independent verification of the threshold.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central security claims depend on user-chosen parameters (rho, sharding geometry, ROUGE-L cutoff) and on unproven assumptions about adversary compute, non-collusion, and the representativeness of trained attackers. These are transparently stated in the paper, but they mean the result is a heuristic security argument rather than a formal guarantee.

free parameters (3)
  • vocab-matching threshold rho = t_max + 1, assumed at most 3 in practice
    Defined in Definition 4.1 as a user-set security parameter; the paper asserts that real adversaries satisfy rho at most 3, and all sharding requirements in Sections 6.2 and 6.3 depend on this bound.
  • sharding parameters (c, delta, alpha) = for example c=8, alpha=8 in experiments
    Chosen by hand to balance security and node count; the security claims and communication costs are functions of these values, and the paper does not provide a principled selection method.
  • ROUGE-L security threshold = 0.25
    Used in Section 6.2 to declare reconstruction 'difficult'; the cutoff appears to be set after observing the results rather than justified in advance.
assumptions (5)
  • domain assumption The target LLM uses unidirectional self-attention.
    Invoked in Section 2 and used in Theorem 6.2 to bound which tokens influence each hidden state.
  • domain assumption All parties are semi-honest and non-colluding.
    The security analysis assumes nodes follow the protocol but may inspect messages; Appendix G shows that colluding nodes can union their shards and reveal the prompt.
  • ad hoc to paper The adversary cannot perform V^rho forward passes.
    The resistance to vocab-matching is only as strong as this externally imposed compute bound, asserted in Section 4.2.
  • domain assumption Non-collision of forward-pass outputs for candidate token sequences.
    The generalized attack is assumed to succeed when feasible; the paper takes non-collision as a worst-case assumption for the defender in Section 4.2.
  • ad hoc to paper Prior independence across shards (B1) and intractability of the Layer-0 linear program (B2).
    These unproven assumptions in Appendix E are needed for the sufficiency argument for (c,delta)-sharding; the authors admit that learning-based attacks may violate B1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cascade: Token-Sharded Private LLM Inference." pith.science (2026). https://pith.science/paper/FVD2ZJGC

@misc{pith2026250705228,
  author       = {Pith},
  title        = {Pith review of: Cascade: Token-Sharded Private LLM Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FVD2ZJGC}},
  note         = {Machine review of arXiv:2507.05228}
}
read the original abstract

As LLMs continue to increase in parameter size, the computational resources required to run them are available to fewer parties. Therefore, third-party inference services -- where LLMs are hosted by third parties with significant computational resources -- are becoming increasingly popular. However, third party inference raises critical concerns about user data privacy. To mitigate these risks, privacy researchers have developed provably secure schemes for third-party inference, such as Secure Multi-Party Computation (SMPC). However, SMPC protocols have significant computational and communication overhead, and do not scale to large models. In this work, we propose a new multi-party inference protocol, Cascade, that avoids these punitive costs by leveraging sharding in the sequence dimension to maintain privacy, trading off cryptographic privacy guarantees for increased performance and scalability. We demonstrate that Cascade is resistant to a generalization of a recent attack that is highly effective against other statistical privacy schemes, and that it is further resistant to learning-based attacks. As Cascade is orders of magnitude faster than existing schemes, our findings offer practical solutions for secure deployment of modern state-of-the-art LLMs.

Figures

Figures reproduced from arXiv: 2507.05228 by the authors.

Figure 1
Figure 1. Schematic representation of our proposed privacy-preserving multi-party inference scheme, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. ROUGE-L scores for Layer 0 token prediction using ModernBERT-Large, as a function of c, the number of ‘clusters’ in the sharding scheme, and α, the number of CompNodes. Higher α and higher c tend towards lower ROUGE-L, increasing security. One objection to this line of argument is that if the adversary has a strong prior on the input text distribution, they can eliminate unlikely tokens from forward passes in the ge… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

33 extracted references · 6 canonical work pages

  1. [1]

    Privformer: Privacy-preserving transformer with mpc

    Yoshimasa Akimoto, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Privformer: Privacy-preserving transformer with mpc. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 392--410, 2023. doi:10.1109/EuroSP57164.2023.00031

    arXiv 2023

  2. [2]

    DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei Feng, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai D...

    arXiv 2025

  3. [3]

    Bert: Pre-training of deep bidirectional transformers for language understanding, 2019

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding, 2019. URL https://arxiv.org/abs/1810.04805

    arXiv 2019

  4. [4]

    Puma: Secure inference of llama-7b in five minutes, 2023

    Ye Dong, Wen jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Chen. Puma: Secure inference of llama-7b in five minutes, 2023. URL https://arxiv.org/abs/2307.12533

    arXiv 2023

  5. [5]

    Goldreich, S

    O. Goldreich, S. Micali, and A. Wigderson. How to play any mental game. In Proceedings of the Nineteenth Annual ACM Symposium on Theory of Computing, STOC '87, page 218–229, New York, NY, USA, 1987. Association for Computing Machinery. ISBN 0897912217. doi:10.1145/28395.28420. URL https://doi.org/10.1145/28395.28420

    arXiv 1987

  6. [6]

    Iron: Private inference on transformers

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. In Advances in Neural Information Processing Systems, volume 35, pages 15718--15731, 2022

    work page 2022

  7. [7]

    Cheetah: Lean and fast secure two-party deep neural network inference

    Zhicong Huang, Wen jie Lu, Cheng Hong, and Jiansheng Ding. Cheetah: Lean and fast secure two-party deep neural network inference. In 31st USENIX Security Symposium (USENIX Security 22), pages 809--826, 2022

    work page 2022

  8. [8]

    Chatgpt for good? on opportunities and challenges of large language models for education

    Enkelejda Kasneci, Kathrin Seßler, Stefan Küchemann, Maria Bannert, Daryna Dementieva, Frank Fischer, Urs Gasser, Georg Groh, Stephan Günnemann, Eyke Hüllermeier, Stephan Krusche, Gitta Kutyniok, Tilman Michaeli, Claudia Nerdel, Juergen Pfeffer, Oleksandra Poquet, Michael Sailer, Albrecht Schmidt, Tina Seidel, and Gjergji Kasneci. Chatgpt for good? on opp...

    arXiv 2023

Show all 33 references
  1. [9]

    Xing, and Hao Zhang

    Dacheng Li, Rulin Shao, Hongyi Wang, Han Guo, Eric P. Xing, and Hao Zhang. Mpcformer: fast, performant and private transformer inference with mpc, 2023. URL https://arxiv.org/abs/2211.01452

    2023 arXiv

  2. [10]

    Nimbus: Secure and efficient two-party inference for transformers, 2024

    Zhengyi Li, Kang Yang, Jin Tan, Wen jie Lu, Haoqi Wu, Xiao Wang, Yu Yu, Derun Zhao, Yancheng Zheng, Minyi Guo, and Jingwen Leng. Nimbus: Secure and efficient two-party inference for transformers, 2024. URL https://arxiv.org/abs/2411.15707

    2024 arXiv

  3. [11]

    ROUGE : A package for automatic evaluation of summaries

    Chin-Yew Lin. ROUGE : A package for automatic evaluation of summaries. In Text Summarization Branches Out, pages 74--81, Barcelona, Spain, July 2004. Association for Computational Linguistics. URL https://aclanthology.org/W04-1013/

    2004

  4. [12]

    Roberta: A robustly optimized bert pretraining approach, 2019

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach, 2019. URL https://arxiv.org/abs/1907.11692

    2019 arXiv

  5. [13]

    Centaur: Bridging the impossible trinity of privacy, efficiency, and performance in privacy-preserving transformer inference, 2024 a

    Jinglong Luo, Guanzhong Chen, Yehong Zhang, Shiyu Liu, Hui Wang, Yue Yu, Xun Zhou, Yuan Qi, and Zenglin Xu. Centaur: Bridging the impossible trinity of privacy, efficiency, and performance in privacy-preserving transformer inference, 2024 a . URL https://arxiv.org/abs/2412.10652

    2024 arXiv

  6. [14]

    Secformer: Towards fast and accurate privacy-preserving inference for large language models

    Jinglong Luo, Yehong Zhang, Zhuo Zhang, Jiaqi Zhang, Xin Mu, Hui Wang, Yue Yu, and Zenglin Xu. Secformer: Towards fast and accurate privacy-preserving inference for large language models. arXiv preprint arXiv:2401.00793, 2024 b

    2024 arXiv

  7. [15]

    Jordan, and Ion Stoica

    Philipp Moritz, Robert Nishihara, Stephanie Wang, Alexey Tumanov, Richard Liaw, Eric Liang, Melih Elibol, Zongheng Yang, William Paul, Michael I. Jordan, and Ion Stoica. Ray: A distributed framework for emerging ai applications, 2018. URL https://arxiv.org/abs/1712.05889

    2018 arXiv

  8. [16]

    Morris, Wenting Zhao, Justin T

    John X. Morris, Wenting Zhao, Justin T. Chiu, Vitaly Shmatikov, and Alexander M. Rush. Language model inversion, 2023. URL https://arxiv.org/abs/2311.13647

    2023 arXiv

  9. [17]

    BOLT : Privacy-preserving, accurate and efficient inference for transformers

    Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. BOLT : Privacy-preserving, accurate and efficient inference for transformers. Cryptology ePrint Archive, Paper 2023/1893, 2023. URL https://eprint.iacr.org/2023/1893

    2023

  10. [18]

    Bleu: a method for automatic evaluation of machine translation

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311--318, 2002

    2002

  11. [19]

    Qwen2.5 technical report, 2025

    Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, ...

    2025 arXiv

  12. [20]

    Large language models in medicine

    Arun James Thirunavukarasu, Darren Shu Jeng Ting, Kabilan Elangovan, Laura Gutierrez, Ting Fang Tan, and Daniel Shu Wei Ting. Large language models in medicine. Nature Medicine, 29: 0 1930--1940, 2023. doi:10.1038/s41591-023-02459-w. URL https://www.nature.com/articles/s41591-...

    1930 doi

  13. [21]

    An attack to break permutation-based private third-party inference schemes for llms

    Rahul Thomas, Louai Zahran, Erica Choi, Akilesh Potti, Micah Goldblum, and Arka Pal. An attack to break permutation-based private third-party inference schemes for llms. arXiv preprint arXiv:2505.18332, 2025

    2025 arXiv

  14. [22]

    Information leakage from embedding in large language models, 2024

    Zhipeng Wan, Anda Cheng, Yinggui Wang, and Lei Wang. Information leakage from embedding in large language models, 2024. URL https://arxiv.org/abs/2405.11916

    2024 arXiv

  15. [23]

    Smarter, better, faster, longer: A modern bidirectional encoder for fast, memory efficient, and long context finetuning and inference, 2024

    Benjamin Warner, Antoine Chaffin, Benjamin Clavié, Orion Weller, Oskar Hallström, Said Taghadouini, Alexis Gallagher, Raja Biswas, Faisal Ladhak, Tom Aarsen, Nathan Cooper, Griffin Adams, Jeremy Howard, and Iacopo Poli. Smarter, better, faster, longer: A modern bidirectional e...

    2024 arXiv

  16. [24]

    Permutation equivariance of transformers and its applications, 2024

    Hengyuan Xu, Liyao Xiang, Hangyu Ye, Dixi Yao, Pengzhi Chu, and Baochun Li. Permutation equivariance of transformers and its applications, 2024. URL https://arxiv.org/abs/2304.07735

    2024 arXiv

  17. [25]

    Andrew C. Yao. Protocols for secure computations. In 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982), pages 160--164, 1982. doi:10.1109/SFCS.1982.38

    1982 doi

  18. [26]

    Secure transformer inference protocol, 2024

    Mu Yuan, Lan Zhang, and Xiang-Yang Li. Secure transformer inference protocol, 2024. URL https://arxiv.org/abs/2312.00025

    2024 arXiv

  19. [27]

    Permllm: Private inference of large language models within 3 seconds under wan, 2024

    Fei Zheng, Chaochao Chen, Zhongxuan Han, and Xiaolin Zheng. Permllm: Private inference of large language models within 3 seconds under wan, 2024. URL https://arxiv.org/abs/2405.18744

    2024 arXiv

  20. [28]

    Multilingual machine translation with large language models: Empirical results and analysis, 2024

    Wenhao Zhu, Hongyi Liu, Qingxiu Dong, Jingjing Xu, Shujian Huang, Lingpeng Kong, Jiajun Chen, and Lei Li. Multilingual machine translation with large language models: Empirical results and analysis, 2024. URL https://arxiv.org/abs/2304.04675

    2024 arXiv

  21. [29]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  22. [30]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  23. [31]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  24. [32]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  25. [33]

    Invernet: An Inversion Attack Framework to Infer Fine-Tuning Datasets through Word Embeddings

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.