Pith. sign in

REVIEW 3 major objections 4 minor 67 references

Breaking the Layer Barrier: Remodeling Private Transformer Inference with Hybrid CKKS and MPC

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Private Transformer inference can shed most of its cryptographic overhead by fusing fine-grained linear operators across layer boundaries and converting between CKKS ciphertexts and MPC shares through a new, provably secure protocol.

desk verdict A genuinely fast private Transformer inference system with real communication gains, but the CKKS-to-MPC conversion's security proof has a distributional gap that must be fixed before the security claim is credible. read the letter →

arxiv 2508.19525 v2 pith:YZ2HDADT submitted 2025-08-27 cs.CR

Tianshi Xu , Wen-jie Lu , Jiangrui Yu , Chen Yi , Chenqi Lin , Runsheng Wang , Meng Li This is my paper · ORCID
classification cs.CR
keywords privatetransformerinferencehomomorphicencryptionCKKSsecuremulti-partycomputationoperatorfusionCKKS-to-MPCconversionmatrixmultiplicationpackingcommunicationoverhead
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BLB's claim is that the layer-wise evaluation paradigm is what makes private Transformer inference expensive, and that breaking layers into fine-grained operators unlocks large savings. Adjacent linear operators from LayerNorm, fully connected layers, and GeLU are fused so that HE/MPC conversions and truncation rounds disappear. To make fusion feasible without blowing up ciphertext width, BLB uses the CKKS scheme and contributes what it calls the first secure CKKS-to-MPC conversion, replacing a prior conversion that masked with a narrowly distributed FFT-encoded polynomial. On BERT-base, BERT-large, and GPT2-base, the paper reports a $21\times$ communication reduction and a $13\times$ GPU-latency reduction relative to earlier hybrid systems, with accuracy within about one point of plaintext inference.

What carries the argument

The load-bearing object is the CKKS-to-MPC conversion in Algorithm 1: after CKKS evaluates a fused linear operator, the server adds a uniformly random polynomial $\hat{r}\in A_{N,q}$ to the plaintext polynomial inside the ciphertext, sends the masked ciphertext to the client, and both parties switch the additive shares from the prime field $\mathbb{Z}_q$ to the ring $\mathbb{Z}_{2^\ell}$ before applying the CKKS decoding map locally. Uniformity of $\hat{r}$ is what makes the client's view independent of the server's weights, and the proof of Theorem 1 is the argument that this holds. The second mechanism, FineGrainFusion, is an operator taxonomy with a fusion table: same-category operators share packing, and legal fusions are selected so that no repacking of intermediate ciphertexts is needed. The third mechanism is the diagonal-packing MatMul, which produces partial sums of diagonals of the output matrix directly, so that fewer rotations are needed than in earlier protocols.

What would settle it

Run Algorithm 1 repeatedly for a fixed server weight vector with $N=8192$ and $q\approx 2^{60}$, then test the client's final share for statistical dependence on the high-order bits of the weight vector; a mutual-information or chi-square test that distinguishes the empirical share distribution from the ideal functionality's uniform distribution would falsify Theorem 1.

Watch

Extended reading notes

Core claim

The central discovery is that most communication in hybrid HE/MPC inference is not the linear algebra itself but the bookkeeping between operators: fixed-point truncations after every multiplication and conversions between HE ciphertexts and MPC shares. BLB removes the layer barrier by treating a Transformer as a graph of primitive operators, classifying linear operators as Identity, Expansion, Reduction, or Transformation, and fusing eligible neighbors; in a Transformer block this yields five fused linear blocks. The cryptographic centerpiece is Algorithm 1, a CKKS-to-MPC conversion in which the server masks the CKKS plaintext polynomial by adding a polynomial sampled uniformly from the ring $A_{N,q}$, then both parties switch shares from $\mathbb{Z}_q$ to $\mathbb{Z}_{2^\ell}$ with a Field-to-Ring protocol and locally decode. Theorem 1 asserts this conversion securely realizes the ideal functionality $\mathcal{F}_{\text{C2M}}$ against honest-but-curious adversaries. The paper also contributes a rotation-efficient ciphertext-ciphertext MatMul built on diagonal packing, multi-head packing, and baby-step-giant-step, cutting homomorphic rotations by factors of 8 to 29.

Load-bearing premise

The entire scheme is only as secure as the assumption that the uniform polynomial mask remains perfectly random after the protocol's rounding, modulus-switch, and decoding steps; if any of those steps introduces a correlation with the server's weights, information about the model could leak.

Editorial extensions

If this is right

  • Private Transformer inference becomes feasible in WAN settings: BLB reports 3.0 GB communication for BERT-base, 7.8 GB for BERT-large, and 1.5 GB for GPT2-base, down from tens of gigabytes in earlier layer-wise hybrid systems.
  • Truncation communication is eliminated entirely; fixed-point truncation is folded into local decoding on an enlarged ring with failure probability below $2^{-40}$.
  • The fusion-aware MatMul reduces homomorphic rotations by factors of 8 to 29 relative to earlier fused-MatMul protocols, turning HE rotations from a bottleneck into a minor cost.
  • Without any fine-tuning, private inference accuracy stays within about one point of plaintext accuracy on standard classification benchmarks, and on some datasets the approximation noise acts as a mild regularizer.
  • With GPU acceleration, BLB becomes faster than its baselines under every tested network condition, with latency reductions from $1.5\times$ to $13\times$ depending on model and network.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same uniform-polynomial masking could be applied to any CKKS-to-MPC handoff, since the flaw it fixes lives in the encoding distribution rather than in any Transformer-specific structure.
  • If the security proof were ever refuted, the performance story would not automatically survive: the communication savings come from fusion, but the confidentiality guarantee rests entirely on Theorem 1, so the two claims should be tracked separately.
  • FineGrainFusion is architecture-agnostic in principle: residual networks and other architectures with adjacent linear operators around nonlinearities could be fused the same way, with CKKS rescale absorbing the extra bit-width growth.
  • Against non-interactive FHE-only alternatives, the batched-input experiment suggests the real comparison is amortized throughput: BLB's per-query latency and accuracy advantages narrow when many queries from the same user are processed together.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes BLB, a hybrid CKKS/MPC framework for private Transformer inference. It breaks the conventional layer-wise evaluation into fine-grained linear-operator fusion, uses CKKS for the fused linear operators to control ciphertext bit-width growth, and introduces a CKKS-to-MPC (and reverse) conversion protocol claimed to be the first secure one. It also designs a rotation-efficient ciphertext-ciphertext MatMul protocol with multi-head packing and BSGS optimization. The evaluation reports large communication and latency improvements over BOLT and Bumblebee on BERT-base, BERT-large, and GPT2-base, with accuracy close to plaintext inference. The central security claim is Theorem 1, which asserts that the CKKS-to-MPC conversion in Algorithm 1 securely realizes the FC2M functionality in Figure 9.

Significance. If the results hold, BLB is a practically significant step for private Transformer inference: it reduces communication by roughly an order of magnitude compared to BOLT, improves GPU latency, and preserves accuracy without fine-tuning. The paper includes a concrete artifact DOI and reports comparisons against multiple baselines on the same hardware, which is a strength. The fine-grained fusion taxonomy and the diagonal-packing MatMul protocol are useful technical contributions. However, the load-bearing security proof of the CKKS-to-MPC conversion has a distributional gap, and the end-to-end performance claim contains an internal inconsistency in Section 7.3. The significance is therefore conditional on a corrected security argument and a reconciled performance statement.

major comments (3)
  1. [Appendix A, proof of Theorem 1; Algorithm 1; Figure 9] The proof's assertion that the real protocol outputs are 'exactly how Algorithm 1 computes' the ideal outputs is not correct under the definitions given. In Algorithm 1, after decryption P0 holds (Encode(x)+r mod q), and after Field-to-Ring (Appendix C.3: signed extension plus local mod reduction) the pre-decode share is ((Encode(x)+r mod q) mod 2^l). Since r is uniform over Z_q, this value is independent of Encode(x). In the ideal functionality FC2M (Figure 9), P0's pre-decode value is Encode(x)+r mod 2^l with r drawn uniformly from the same Z_q; because r mod 2^l is non-uniform when q is not a multiple of 2^l, this distribution depends on Encode(x). The proof's claim that both real and ideal outputs are decoded results of uniformly distributed polynomials over A_{N,2^l} is therefore not established. Appendix C.3 describes Field-to-Ring as a deterministic signed extension followed by local reduction, so the proof also does not show that this step re-randomizes the shares to the ideal distribution. This is a load-bearing gap in the paper's central security claim; please either prove Theorem 1 with a correctly specified functionality (for example, one that samples the actual post-reduction distribution) or provide a formal analysis of the full Field-to-Ring composition.
  2. [Section 7.3, Communication Breakdown Analysis; Figure 11; Table 9] The text states that BLB reduces communication by 'approximately 4x and 2x across three models compared to BOLT and Bumblebee, respectively.' This is inconsistent with the abstract's 21x/2x claim and with Table 9, where BERT-base BOLT is 63.6 GB versus BLB 3.0 GB (21.2x), GPT2-base BOLT is 34.8 GB versus BLB 1.5 GB (23.2x), and BERT-large BOLT is 158.9 GB versus BLB 7.8 GB (20.4x). Figure 11's '4x' label is also ambiguous. Please correct the text and figure or clearly state what quantity is being compared; as written, the headline performance claim is internally inconsistent.
  3. [Section 3 and Appendix A, overall security claim] The paper describes BLB as a private inference framework and assumes an honest-but-curious adversary, but the only formal security statement is Theorem 1 for Algorithm 1. The security of the complete protocol, including Algorithm 2 (MPC-to-CKKS), the fused MatMul protocols, and the probabilistic truncation in Appendix C.4, is not covered by a stated composition argument. Since the truncation functionality in Figure 16 intentionally leaks the cutoff point to the adversary, the interplay between that leakage and the FC2M simulator needs an explicit treatment. Please either state an end-to-end security theorem for the full BLB protocol or clearly delimit the security guarantee to the conversion building block.
minor comments (4)
  1. [Figure 5] The figure label 'Nonliner' should be 'Nonlinear'.
  2. [Section 9 and abstract] The abstract states a '13x' latency reduction without qualification, while Section 9 says 'up to 13x'. The qualified form is more accurate given Table 9 (the 13x figure appears only for BERT-large at WAN2 on GPU), so please use 'up to' consistently.
  3. [Appendix C.4] The proof of the modified probabilistic truncation functionality is delegated to 'Section 3 in [19]' rather than being summarized or stated in the paper. At minimum, the realized functionality and the simulation argument should be specified, since the truncation protocol is used in the full inference pipeline.
  4. [Section 7.1 and Table 9] The paper says OT primitives do not affect protocol construction, but Table 9 explicitly uses VOLE-OT for BLB while Figures 12 and 13 report BLB with both IKNP and VOLE variants. Please make the OT-primitive choice explicit in every comparison so readers can reproduce the numbers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the performance and protocol claims are derived from external benchmarks, operation counts, and standard building blocks, not from fitted inputs or self-referential definitions.

full rationale

BLB's headline communication and latency reductions are measured against external baselines (BOLT and Bumblebee) on the same machine, and the complexity figures in Table 5 and Table 7 are operation counts rather than fitted values. The FineGrainFusion operator classification is a design taxonomy, not a derived prediction; the fusion patterns are justified by packing rules and correctness arguments. HE parameters are set by a target MSE, and the ablation in Table 11 separates the fusion/conversion contribution from the MatMul contribution, so the performance claims do not reduce to their inputs. The paper does adopt nonlinear-layer protocols from Bumblebee and BOLT, and Bumblebee has an overlapping author, but this is a normal building-block dependency: the central fusion, CKKS/MPC conversion, and fused MatMul claims are not justified by those citations alone. The main weakness is in the proof sketch of Theorem 1: the proof asserts that the real Field-to-Ring/Decode outputs are 'exactly how Algorithm 1 computes' the ideal outputs, without proving that the distribution after reduction modulo 2^l matches the FC2M ideal distribution. That is a security-proof gap, not circularity, because Algorithm 1 is not fitted to the functionality's conclusion and the underlying Field-to-Ring protocol is cited from external prior work. No load-bearing derivation in the paper is equivalent to its own inputs by construction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rest on standard cryptographic assumptions, fixed-point parameters chosen by hand, and inherited nonlinear approximations. No new primitives or entities are introduced beyond the protocols themselves.

free parameters (3)
  • Fixed-point scale s = 13
    Chosen in Section 7.1 to balance accuracy and ciphertext size for nonlinear operators; affects rounding error but is not fitted to the reported speedups.
  • Ring bit width l = 43
    Set in Section 7.1 for secret shares over Z_{2^43}; chosen for accuracy and communication efficiency, not fitted to the headline results.
  • MSE threshold = 10^-11
    Used in Section 7.1 to select CKKS parameters per block via the EVA compiler; a design choice for accuracy, not a fitted constant of the result.
assumptions (4)
  • domain assumption Honest-but-curious two-party security model
    Stated in Section 2.3; both parties follow the protocol but try to learn extra information. The security proof in Appendix A relies on this model.
  • standard math CKKS and underlying MPC/OT primitives are secure
    Section 2.4 and Appendix A assume the security of CKKS [8] and the Field-to-Ring protocols from [49,51] without reproving them.
  • domain assumption Piecewise linear approximations of GeLU, Softmax, LayerNorm from BOLT/Bumblebee are accurate enough
    The framework inherits these approximations (Section 7.1, Appendix B) and relies on them to preserve inference accuracy; validation is empirical via Table 8.
  • domain assumption CKKS computation error remains below the MSE threshold after fusion
    Section 7.1 requires MSE < 10^-11 per block using EVA; the accuracy results in Table 8 provide empirical support but no formal error bound.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Breaking the Layer Barrier: Remodeling Private Transformer Inference with Hybrid CKKS and MPC." pith.science (2026). https://pith.science/paper/YZ2HDADT

@misc{pith2026250819525,
  author       = {Pith},
  title        = {Pith review of: Breaking the Layer Barrier: Remodeling Private Transformer Inference with Hybrid CKKS and MPC},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YZ2HDADT}},
  note         = {Machine review of arXiv:2508.19525}
}
abstract

This paper presents an efficient framework for private Transformer inference that combines Homomorphic Encryption (HE) and Secure Multi-party Computation (MPC) to protect data privacy. Existing methods often leverage HE for linear layers (e.g., matrix multiplications) and MPC for non-linear layers (e.g., Softmax activation functions), but the conversion between HE and MPC introduces significant communication costs. The proposed framework, dubbed BLB, overcomes this by breaking down layers into fine-grained operators and further fusing adjacent linear operators, reducing the need for HE/MPC conversions. To manage the increased ciphertext bit width from the fused linear operators, BLB proposes the first secure conversion protocol between CKKS and MPC and enables CKKS-based computation of the fused operators. Additionally, BLB proposes an efficient matrix multiplication protocol for fused computation in Transformers. Extensive evaluations on BERT-base, BERT-large, and GPT2-base show that BLB achieves a $21\times$ reduction in communication overhead compared to BOLT (S\&P'24) and a $2\times$ reduction compared to Bumblebee (NDSS'25), along with latency reductions of $13\times$ and $1.8\times$, respectively, when leveraging GPU acceleration.

Figures

Figures reproduced from arXiv: 2508.19525 by the authors.

Figure 1
Figure 1. (a) Illustration of hybrid HE/MPC-based private [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. (a) Previous layer-wise (LW) paradigm; (b) Our proposed BLB paradigm; (c) BLB reduces communication costs by [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. (a) CKKS can maintain the operand scale at [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: A Transformer block in BERT [38]. with a “hat” symbol (e.g., xˆ) to represent a polynomial. We use 1{P} to denote the indicator function, which is 1 when P is true and 0 otherwise. 2.2 Transformer Model [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: provides an overview of the BLB framework, which integrates MPC and CKKS HE schemes to evaluate linear and nonlinear operators, respectively. BLB features three key com￾ponents: firstly, BLB proposes FineGrainFusion paradigm to systematically explore the fusion pattern…
Figure 6
Figure 6. Figure 6: A toy example comparing NEXUS’s packing algo [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: A toy example for matmulcc : (a) Multiplying matrices A and B in plaintext; (b) Observation 1: Element-wise multiplication of A’s columns and B’s rows generates the partial sums of C’s diagonals. We use [i] to denote the index of the diagonal and (j) to denote the inde…
Figure 8
Figure 8. Figure 8: This example demonstrates the distribution of the [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: CKKS-to-MPC Conversion Functionality • Server then masks the ciphertext through homomorphic addition: C = Enc(Encode(m))⊞rˆ. • The masked ciphertext C is then sent to the client, who obtains his share u0 = ⌊∆·Decode(Dec(C))⌉ mod q after decryption. The server’s share i…
Figure 10
Figure 10. Figure 10: Five blocks of fused linear operators in a Trans [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Communication comparison between BLB, BOLT and Bumblebee. The ones using the same OT primitive are grouped. [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]
Figure 12
Figure 12. Figure 12: Latency comparison between BLB and BOLT on BERT-base model on CPU and GPU. The bandwidths and round-trip times of four network conditions are: LAN:{ 1Gbps, 0.3ms}, WAN1:{400Mbps, 4ms}, WAN2:{100Mbps, 4ms}, WAN3:{100Mbps, 80ms} [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]
Figure 13
Figure 13. Figure 13: Latency comparison between BLB and Bumblebee on BERT-base model on CPU and GPU. The bandwidths and round-trip times of four network conditions are: LAN:{ 1Gbps, 0.3ms}, WAN1:{400Mbps, 4ms}, WAN2:{100Mbps, 4ms}, WAN3:{100Mbps, 80ms}. computation, leading to a 1.4 ∼ 1.6…
Figure 14
Figure 14. Figure 14: Applying BSGS optimization to the step 2 of our matmul [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]
Figure 15
Figure 15. Figure 15: An example for BLB’s modified ct-pt MatMul protocol for Att×WO: (a) Multiplying matrices C and W in plaintext. (b) If the output dimension of Vh in the previous step Softmax(·)×Vh is half the input dimension, we pad Vh with zeros and perform the matmulcc. Afterward, w…
Figure 16
Figure 16. Figure 16: The modified probabilistic truncation functionality [PITH_FULL_IMAGE:figures/full_fig_p020_16.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

67 extracted references · 58 canonical work pages

  1. [1]

    https://github.com/ Microsoft/SEAL, November 2020

    Microsoft SEAL (release 3.6). https://github.com/ Microsoft/SEAL, November 2020

    work page 2020

  2. [2]

    Privformer: Privacy-preserving trans- former with mpc

    Yoshimasa Akimoto, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Privformer: Privacy-preserving trans- former with mpc. In 2023 IEEE 8th EuroS&P, pages 392–410. IEEE, 2023

    work page 2023

  3. [3]

    Heliks: He lin- ear algebra kernels for secure inference

    Shashank Balla and Farinaz Koushanfar. Heliks: He lin- ear algebra kernels for secure inference. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 2306–2320, 2023

    work page 2023

  4. [4]

    Ezpc: Programmable, efficient, and scalable secure two-party computation for machine learning

    Nishanth Chandran and Divya Gupta et al. Ezpc: Programmable, efficient, and scalable secure two-party computation for machine learning. Cryptology ePrint Archive, 2017

    work page 2017

  5. [5]

    Accelerating Private Large Transformers Inference through Fine-grained Collaborative Computation

    Yuntian Chen and Zhanyong Tang et al. Accelerat- ing private large transformers inference through fine- grained collaborative computation. arXiv preprint arXiv:2412.16537, 2024

    work page Pith review arXiv 2024

  6. [6]

    Personal voice assistant security and privacy—a survey

    Peng Cheng and Utz Roedig. Personal voice assistant security and privacy—a survey. Proceedings of the IEEE, 110(4):476–507, 2022

    work page 2022

  7. [7]

    A full rns variant of approx- imate homomorphic encryption

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song. A full rns variant of approx- imate homomorphic encryption. In Selected Areas in Cryptography–SAC 2018: 25th International Confer- ence, pages 347–368. Springer, 2019

    work page 2018

  8. [8]

    Homomorphic encryption for arithmetic of approximate numbers

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yong- soo Song. Homomorphic encryption for arithmetic of approximate numbers. In Advances in Cryptology– ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Infor- mation Security, pages 409–437. Springer, 2017

    work page 2017

Show all 67 references
  1. [9]

    Eva: An encrypted vector arithmetic language and compiler for efficient homomorphic computation

    Roshan Dathathri and Blagovesta Kostova et al. Eva: An encrypted vector arithmetic language and compiler for efficient homomorphic computation. In Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation, 2020

    2020

  2. [10]

    Puma: Secure in- ference of llama-7b in five minutes

    Ye Dong and Wen jie Lu et al. Puma: Secure in- ference of llama-7b in five minutes. arXiv preprint arXiv:2307.12533, 2023

    2023

  3. [11]

    Language models are unsupervised multitask learners

    Alec Radford et al. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019

    2019

  4. [12]

    Securegpt: A framework for multi- party privacy-preserving transformer inference in gpt

    Chenkai Zeng et al. Securegpt: A framework for multi- party privacy-preserving transformer inference in gpt. IEEE Transactions on Information Forensics and Secu- rity, 2024

    2024

  5. [13]

    Cryptflow2: Practical 2-party secure inference

    Deevashwer Rathee et al. Cryptflow2: Practical 2-party secure inference. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 325–342, 2020

    2020

  6. [14]

    Efficient two-round ot extension and silent non-interactive secure computation

    Elette Boyle et al. Efficient two-round ot extension and silent non-interactive secure computation. In Proceed- ings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

    2019

  7. [15]

    Mp2ml: A mixed-protocol ma- chine learning framework for private inference

    Fabian Boemer et al. Mp2ml: A mixed-protocol ma- chine learning framework for private inference. In Pro- ceedings of the 15th International Conference on Avail- ability, Reliability and Security, pages 1–10, 2020

    2020

  8. [16]

    Llama: Open and efficient founda- tion language models

    Hugo Touvron et al. Llama: Open and efficient founda- tion language models. arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  9. [17]

    Rhombus: Fast homomorphic matrix- vector multiplication for secure two-party inference

    Jiaxing He et al. Rhombus: Fast homomorphic matrix- vector multiplication for secure two-party inference. In CCS, 2024

    2024

  10. [18]

    Secure transformer-based neural network inference for protein sequence classification

    Jingwei Chen et al. Secure transformer-based neural network inference for protein sequence classification. Cryptology ePrint Archive, 2024

    2024

  11. [19]

    Curl: Private llms through wavelet-encoded look-up tables

    Manuel B Santos et al. Curl: Private llms through wavelet-encoded look-up tables. Conference on Applied Machine Learning for Information Security, 2024

    2024

  12. [20]

    Craterlake: a hardware acceler- ator for efficient unbounded computation on encrypted data

    Nikola Samardzic et al. Craterlake: a hardware acceler- ator for efficient unbounded computation on encrypted data. In Proceedings of the 49th Annual International Symposium on Computer Architecture, 2022

    2022

  13. [21]

    Delphi: A cryptographic infer- ence service for neural networks, Jan 2020

    Pratyush Mishra et al. Delphi: A cryptographic infer- ence service for neural networks, Jan 2020

    2020

  14. [22]

    Hyena: Balancing packing, reuse, and rotations for encrypted inference

    Sarabjeet Singh et al. Hyena: Balancing packing, reuse, and rotations for encrypted inference. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 107–

    2024

  15. [23]

    Coinn: Crypto/ml codesign for oblivious inference via neural networks

    Siam Umar Hussain et al. Coinn: Crypto/ml codesign for oblivious inference via neural networks. In Proceed- ings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 3266–3281, 2021

    2021

  16. [24]

    Privcirnet: Efficient private inference via block circulant transformation

    Tianshi Xu et al. Privcirnet: Efficient private inference via block circulant transformation. Neural Information Processing Systems (NeurIPS), 2024

    2024

  17. [25]

    Characterization of mpc-based private inference for transformer-based models

    Yongqin Wang et al. Characterization of mpc-based private inference for transformer-based models. In 2022 IEEE ISPASS, pages 187–197

    2022

  18. [26]

    Nimbus: Secure and efficient two-party inference for transformers

    Zhengyi Li et al. Nimbus: Secure and efficient two-party inference for transformers. NeurIPS, 2024

    2024

  19. [27]

    F1: A fast and programmable ac- celerator for fully homomorphic encryption

    Samardzic Nikola et el. F1: A fast and programmable ac- celerator for fully homomorphic encryption. In MICRO- 54: 54th Annual IEEE/ACM International Symposium on Microarchitecture, pages 238–252, 2021

    2021

  20. [28]

    Secure multi-party computation

    Oded Goldreich. Secure multi-party computation. Manuscript. Preliminary version, 78(110):1–108, 1998

    1998

  21. [29]

    The Foundations of Cryptography - Volume 2: Basic Applications

    Oded Goldreich. The Foundations of Cryptography - Volume 2: Basic Applications. Cambridge University Press, 2004

    2004

  22. [30]

    Sigma: Secure gpt inference with func- tion secret sharing

    Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nis- hanth Chandran, Divya Gupta, Ashish Panwar, and Rahul Sharma. Sigma: Secure gpt inference with func- tion secret sharing. Cryptology ePrint Archive, 2023

    2023

  23. [31]

    Iron: Private inference on transformers

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. In Advances in Neural Information Processing Systems, 2022

    2022

  24. [32]

    Secbert: Privacy- preserving pre-training based neural network inference system

    Hai Huang and Yongjian Wang. Secbert: Privacy- preserving pre-training based neural network inference system. Neural Networks, 172:106135, 2024

    2024

  25. [33]

    Cheetah: Lean and fast secure{Two-Party} deep neural network inference

    Zhicong Huang, Wen-jie Lu, Cheng Hong, and Jian- sheng Ding. Cheetah: Lean and fast secure{Two-Party} deep neural network inference. In USENIX Security Symposium 2022, pages 809–826, 2022

    2022

  26. [34]

    https://huggingface.co/

    Huggingface. https://huggingface.co/

  27. [35]

    Secure outsourced matrix computation and application to neural networks

    Xiaoqian Jiang, Miran Kim, Kristin Lauter, and Yong- soo Song. Secure outsourced matrix computation and application to neural networks. In Proceedings of the 2018 ACM SIGSAC conference on computer and com- munications security, pages 1209–1222, 2018

    2018

  28. [36]

    Neujeans: Private neural net- work inference with joint optimization of convolution and bootstrapping

    Jae Hyung Ju, Jaiyoung Park, Jongmin Kim, Donghwan Kim, and Jung Ho Ahn. Neujeans: Private neural net- work inference with joint optimization of convolution and bootstrapping. The ACM Conference on Computer and Communications Security (CCS), 2024

    2024

  29. [37]

    Chandrakasan

    Chiraag Juvekar, Vinod Vaikuntanathan, and AnanthaP. Chandrakasan. GAZELLE: A low latency framework for secure neural network inference, Jan 2018

    2018

  30. [38]

    Bert: Pre-training of deep bidirectional trans- formers for language understanding

    Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional trans- formers for language understanding. In Proceedings of naacL-HLT, volume 1, page 2, 2019

    2019

  31. [39]

    Optimized privacy- preserving cnn inference with fully homomorphic en- cryption

    Dongwoo Kim and Cyril Guyot. Optimized privacy- preserving cnn inference with fully homomorphic en- cryption. IEEE Transactions on Information Forensics and Security, 18:2175–2187, 2023

    2023

  32. [40]

    Improved ot extension for transferring short secrets

    Vladimir Kolesnikov and Ranjit Kumaresan. Improved ot extension for transferring short secrets. In Advances in Cryptology–CRYPTO 2013: 33rd Annual Cryptology Conference, 2013., pages 54–70, 2013

    2013

  33. [41]

    Crypt- flow: Secure tensorflow inference

    Nishant Kumar, Mayank Rathee, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. Crypt- flow: Secure tensorflow inference. In 2020 IEEE Sym- posium on Security and Privacy (SP), 2020

    2020

  34. [42]

    Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions

    Eunsang Lee, Joon-Woo Lee, Junghyun Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, and Woosuk Choi. Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions. In International Conference on Machine Learning, page...

    2022

  35. [43]

    Mpcformer: fast, performant and private transformer inference with mpc

    Dacheng Li, Rulin Shao, Hongyi Wang, Han Guo, Eric P Xing, and Hao Zhang. Mpcformer: fast, performant and private transformer inference with mpc. arXiv preprint arXiv:2211.01452, 2022

    2022 arXiv

  36. [44]

    Efficient 3pc for binary circuits with application to maliciously-secure dnn inference

    Yun Li, Yufei Duan, Zhicong Huang, Cheng Hong, Chao Zhang, and Yifan Song. Efficient 3pc for binary circuits with application to maliciously-secure dnn inference. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5377–5394, 2023

    2023

  37. [45]

    Bumblebee: Secure two-party inference frame- work for large transformers

    Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Kui Ren, Cheng Hong, Tao Wei, and WenGuang Chen. Bumblebee: Secure two-party inference frame- work for large transformers. Network and Distributed System Security (NDSS), 2025

    2025

  38. [46]

    Secformer: Fast and accurate privacy-preserving inference for trans- former models via smpc

    Jinglong Luo and Yehong Zhang et al. Secformer: Fast and accurate privacy-preserving inference for trans- former models via smpc. In Findings of the Association for Computational Linguistics ACL, 2024

    2024

  39. [47]

    Secureml: A system for scalable privacy-preserving machine learning

    Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy-preserving machine learning. In 2017 IEEE symposium on security and privacy (SP), pages 19–38. IEEE, 2017

    2017

  40. [48]

    THOR: Secure transformer inference with homomorphic encryption

    Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, and Mi- ran Kim. THOR: Secure transformer inference with homomorphic encryption. Cryptology ePrint Archive, Paper 2024/1881, 2024

    2024

  41. [49]

    Q. Pang, J. Zhu, H. Möllering, W. Zheng, and T. Schnei- der. Bolt: Privacy-preserving, accurate and efficient in- ference for transformers. In 2024 IEEE Symposium on Security and Privacy (SP), pages 133–133, Los Alami- tos, CA, USA, may 2024. IEEE Computer Society

    2024

  42. [50]

    Pow- erformer: Efficient privacy-preserving transformer with batch rectifier-power max function and optimized homo- morphic attention

    Dongjin Park, Eunsang Lee, and Joon-Woo Lee. Pow- erformer: Efficient privacy-preserving transformer with batch rectifier-power max function and optimized homo- morphic attention. Cryptology ePrint Archive, 2024

    2024

  43. [51]

    Sirnn: A math library for secure rnn inference

    Deevashwer Rathee, Mayank Rathee, Rahul Kranti Ki- ran Goli, Divya Gupta, Rahul Sharma, Nishanth Chan- dran, and Aseem Rastogi. Sirnn: A math library for secure rnn inference. In 2021 IEEE Symposium on Se- curity and Privacy (SP), pages 1003–1020. IEEE, 2021

    2021

  44. [52]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler and Andrew Howard et al. Mobilenetv2: Inverted residuals and linear bottlenecks. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4510–4520, 2018

    2018

  45. [53]

    Transformer-based person re-identification: a comprehensive review.IEEE Transactions on Intelligent Vehicles, 2024

    Prodip Kumar Sarker, Qingjie Zhao, and Md Kamal Uddin. Transformer-based person re-identification: a comprehensive review.IEEE Transactions on Intelligent Vehicles, 2024

    2024

  46. [54]

    Transformers in medical imaging: A survey

    Fahad Shamshad and Salman Khan et al. Transformers in medical imaging: A survey. Medical Image Analysis, 88:102802, 2023

    2023

  47. [55]

    Leveraging gpu in homomorphic encryption: Framework design and anal- ysis of bfv variants

    Shiyu Shen and Hao Yang et al. Leveraging gpu in homomorphic encryption: Framework design and anal- ysis of bfv variants. IEEE Transactions on Computers, 73(12):2817–2829, 2024

    2024

  48. [56]

    Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R. Bowman. Glue: A multi-task benchmark and analysis platform for natural language understanding, 2019

    2019

  49. [57]

    Mpcvit: Searching for mpc-friendly vision transformer with heterogeneous attention

    Wenxuan Zeng, Meng Li, Wenjie Xiong, Wenjie Lu, Jin Tan, Runsheng Wang, and Ru Huang. Mpcvit: Searching for mpc-friendly vision transformer with heterogeneous attention. arXiv preprint arXiv:2211.13955, 2022

    2022 arXiv

  50. [58]

    Secure trans- former inference made non-interactive

    Jiawen Zhang and Xinpeng Yang et al. Secure trans- former inference made non-interactive. Network and Distributed System Security (NDSS), 2025

    2025

  51. [59]

    From individual computation to allied optimization: Remodeling privacy-preserving neural inference with function input tuning

    Qiao Zhang, Tao Xiang, Chunsheng Xin, and Hongyi Wu. From individual computation to allied optimization: Remodeling privacy-preserving neural inference with function input tuning. In 2024 IEEE Symposium on Security and Privacy (SP), pages 101–101. A Security Discussion Securit...

    2024

  52. [61]

    S0 simulates these messages by: ❶ S0 inputs with random generated key and O0 where O0 is the decoded result of a uniform plaintext polynomial

    the secret key, 2) the masked CKKS ciphertext, and 3) its view in the Field-to-Ring sub-protocol [51]. S0 simulates these messages by: ❶ S0 inputs with random generated key and O0 where O0 is the decoded result of a uniform plaintext polynomial. Then, S0 encodes O0 to the unif...

  53. [62]

    Reconstruct m from sharing JmK

  54. [63]

    Set m(s) =⌊m/2s⌋ and m(s) = (m mod 2s)

  55. [64]

    Pick cutoff point s(s) at random in Z2s

  56. [65]

    Set m′ = m(s) + u where u = 1{m(s) > s(s)}

  57. [66]

    Generate a random sharing Jm′K of m′

  58. [67]

    Figure 16: The modified probabilistic truncation functionality Table 12: Amortized latency comparison on BERT-base

    Output Jm′K and leak s(s) to the adversary. Figure 16: The modified probabilistic truncation functionality Table 12: Amortized latency comparison on BERT-base. Framework Amortized Latency (min) LAN W AN2 W AN3 BLB 2 .5 6 .6 13 .2 BLB +batch size 32 0 .79 2 .1 4 .1 NEXUS+batch ...

  59. [107]

    IEEE Computer Society, 2024

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.