Pith. sign in

REVIEW 3 major objections 6 minor 41 references

ENSI: Efficient Non-Interactive Secure Inference for Large Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ENSI claims that non-interactive homomorphic-encryption inference for LLMs can be made practical by co-designing CKKS with BitNet: ternary weights make the dominant matrix multiplications multiplication-free, sigmoid attention replaces soft

desk verdict Clever PCMM and bootstrapping scheduling, but the retraining-free sigmoid claim is unproven and the BSGS-CCMM complexity claim is under-specified. read the letter →

arxiv 2509.09424 v1 pith:3EFAYXZL submitted 2025-09-11 cs.CR cs.AI

Zhiyu He , Maojiang Wang , Xinwen Gao , Yuchuan Luo , Lin Liu , Shaojing Fu This is my paper
classification cs.CRcs.AI MSC 94A6068T07
keywords homomorphicencryptionsecureinferencelargelanguagemodelsCKKSBitNetsigmoidattentionbootstrappingmatrixmultiplication
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to show that secure, non-interactive inference for large language models is practical when the encryption scheme and the model architecture are designed together. It pairs the CKKS homomorphic encryption scheme with BitNet, a ternary-weight LLM, and packs encrypted activations column-wise so that the most common matrix multiplications become pure additions and subtractions of ciphertexts. It also replaces softmax with sigmoid attention as a retraining-free drop-in, and embeds bootstrapping inside RMSNorm so that the costliest refresh operation runs once per layer instead of once per column. If these claims hold, plaintext-ciphertext matrix multiplication speeds up by roughly 8x, softmax by about 2.6x, and bootstrapping drops to roughly 1% of total runtime, enabling encrypted inference at 2048-token sequence lengths for the first time.

What carries the argument

The key mechanism is column-wise ciphertext encoding combined with BitNet's ternary weight structure: each column of the encrypted activation matrix lives in its own ciphertext, and each column of the output is a linear combination (with coefficients in {-1,0,1}) of those ciphertext columns, so plaintext-ciphertext matrix multiplication (PCMM) is nothing more than additions and subtractions. A baby-step giant-step (BSGS) element-expansion routine performs the same trick for ciphertext-ciphertext matrix multiplication (CCMM), reducing required rotations to logarithmic. For nonlinearities, sigmoid attention (sigma((QK^T)/sqrt(d))V with bias log(s)) replaces softmax without retraining; it is ev

What would settle it

Run the same BitNet b1.58-3B model in plaintext, with exact sigmoid attention (no homomorphic approximation, no encryption), on the PIQA, COPA, and SST benchmarks. If the plaintext sigmoid accuracy is substantially below the softmax baseline on PIQA, then the retraining-free claim is falsified for that benchmark. If the plaintext sigmoid accuracy matches softmax, then any drop in the encrypted system would be attributable to noise or approximation, and the swap itself is safe.

Watch

Extended reading notes

Core claim

The central finding is that the dominant linear operations in homomorphic LLM inference can be performed without any ciphertext-ciphertext multiplications. Because BitNet's weights are ternary (each weight is -1, 0, or +1) and the encrypted activations are packed column-wise, a plaintext-ciphertext matrix product reduces to a signed sum of ciphertext column vectors: each output column is assembled by adding or subtracting the appropriate encrypted input columns. For the ciphertext-ciphertext multiplications that remain (the attention QK^T and attention-value products), a baby-step giant-step extraction routine lowers the number of rotations from linear to logarithmic. The paper further shows

Load-bearing premise

The load-bearing premise is that sigmoid attention can replace the softmax in a pre-trained BitNet model without retraining while keeping accuracy acceptable; the paper's own table shows a noticeable PIQA drop and no plaintext sigmoid baseline is reported, so this swap has not yet been validated in isolation.

Editorial extensions

If this is right

  • Encrypted inference becomes non-interactive for models as large as 3B parameters at 2048-token inputs, a scale roughly three orders of magnitude larger than previous non-interactive systems.
  • The bootstrapping fraction drops from roughly 62% of runtime to about 1%, removing the dominant cost that previously made deep LLMs infeasible under homomorphic encryption.
  • The column-wise encoding eliminates ciphertext interleaving and other conversion overheads, achieving near-complete SIMD slot utilization and making the approach transferable across different HE libraries.
  • Because the acceleration comes from the ternary weight structure rather than from deeper crypto tricks, the same speedup automatically applies to any future low-bit quantized model.
  • The reported speedups (about 8x for matrix multiplication and 2.2-2.6x for softmax over the state of the art) suggest that practical, privacy-preserving LLM inference is within reach on commodity CPUs and GPUs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A plaintext-only ablation would settle whether the accuracy gap on PIQA (71.65% to 65.89%) is caused by the sigmoid attention swap or by encryption noise; the paper does not report a plaintext sigmoid baseline, so the source of the gap is unresolved.
  • The same 'refresh-at-the-reduced-ciphertext' recipe used for RMSNorm could generalize to other normalization layers (LayerNorm, GroupNorm) or any block that compresses a vector to a scalar, potentially shrinking bootstrapping overhead in non-LLM HE pipelines too.
  • The co-design principle here is a template: if a model family has a small discrete weight alphabet and a structured attention pattern, the cryptographic cost of secure inference can be moved out of the expensive homomorphic-multiplication layer entirely.
  • The retraining-free sigmoid claim, if it survives plaintext validation, suggests that future LLMs could be pre-trained with sigmoid attention from the start to make them homomorphically friendly, trading a small accuracy difference for a large speedup in secure deployment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. ENSI proposes a non-interactive, CKKS-based secure inference framework co-designed with the BitNet LLM family. The main components are: a column-wise encoding strategy; a plaintext-ciphertext matrix multiplication (PCMM) algorithm that exploits BitNet's ternary weights to avoid homomorphic multiplications; a ciphertext-ciphertext matrix multiplication (CCMM) protocol that uses a baby-step giant-step (BSGS) extraction mechanism to reduce rotations; a retraining-free replacement of softmax by sigmoid attention; and a bootstrapping procedure embedded inside RMSNorm. The paper reports roughly 5.8–8× PCMM speedups over NEXUS, 2.2–2.6× softmax/sigmoid speedups, an end-to-end 2048-token LLaMA-scale benchmark in which bootstrapping is about 1% of runtime, and zero-shot accuracy on PIQA, COPA, and SST that is claimed to be nearly comparable to plaintext inference.

Significance. If the claims hold, ENSI would be a meaningful step for non-interactive HE-based LLM inference: it is, to my knowledge, the first system in this line to demonstrate a 2048-token end-to-end benchmark, and the PCMM design cleanly exploits BitNet's ternary weights. The open-source implementation and the concrete per-operation runtime breakdown are valuable assets. However, the central 'retraining-free' accuracy claim rests on an unvalidated architectural assumption, and the CCMM complexity claim is not backed by a detailed algorithm or proof. These issues are load-bearing because CCMM dominates the end-to-end runtime and because the accuracy comparison determines whether the efficiency gains are practically meaningful.

major comments (3)
  1. [Section VI.A, Eq. (6) and Table IV] The claim that sigmoid attention is a 'seamless, retraining-free alternative' to softmax is not supported by the evidence. Equation (6) simply asserts the replacement. Table IV reports accuracy for plaintext BitNet and for ENSI, but there is no plaintext-sigmoid baseline. The PIQA drop from 71.65% to 65.89% could be caused by the sigmoid swap, by the HE approximation error, or by both. Without a plaintext-sigmoid experiment, the reader cannot attribute the loss, and the 'retraining-free' claim is not established. This is not a presentation issue: the entire softmax/sigmoid efficiency advantage is only meaningful if the replacement preserves accuracy without retraining.
  2. [Section V.B and Figure 5] The BSGS-based CCMM claim that the number of rotations is reduced 'from linear to logarithmic, specifically down to log(dm)' is given without pseudocode, a formal algorithm, or a complexity proof. This is not a minor omission: in Table III, CCMM accounts for roughly 831 of the 958 seconds of per-input runtime (192.99s + 638.12s). The performance claims for the framework therefore hinge on an unverified algorithmic assertion. The manuscript needs a precise description of the BSGS extraction procedure, including the mask-vector construction, the number and direction of rotations for the baby and giant steps, and the exact operation count (rotations, multiplications, additions) as a function of s, d, and m. The current 'Figure 5(b)' sketch is insufficient.
  3. [Section VIII.C, Table I] The microbenchmark in Table I is labeled 'Softmax function,' but Section VI.A replaces softmax with sigmoid attention. The 2.2–2.6× speedup is therefore comparing a sigmoid evaluation against NEXUS's softmax evaluation, not an apples-to-apples comparison of the same function. The table heading and the abstract's phrase 'softmax inference' should be changed to reflect that the evaluated function is sigmoid, or a genuine softmax evaluation should be reported. This matters because the speedup is presented as an advantage of the overall secure inference pipeline, but it is partly an advantage of changing the model architecture rather than of the homomorphic implementation.
minor comments (6)
  1. [Section V.A, Algorithm 1] The toy example and Algorithm 1 assume that each column x_j is packed into a separate ciphertext. This should be stated explicitly as a slot-utilization condition, especially since Section III.B says the column-wise encoding uses a vector of length s. It would help to specify what happens when s is not a power of two or exceeds the slot capacity.
  2. [Section V.C, Algorithm 2] The vectors 'neg' and 'pos' have length d, but the rotation is applied to q_i which has length s. If s ≠ d, the mask length does not match the ciphertext slot count. This needs clarification, or the mask should be defined over s slots.
  3. [Section VI.A] The sigmoid approximation interval [a,b] and polynomial degree n are not reported. Without these, the approximation error and the multiplicative-depth cost of the sigmoid cannot be reproduced. These are not free parameters; they affect both accuracy and runtime and should be stated.
  4. [Section VII and Table III] The statement that bootstrapping complexity is reduced from O(d) to O(1) is not fully justified in the text. The RMSNorm output has d ciphertext columns, but Algorithm 3 appears to bootstrap only the single compressed variance ciphertext. The manuscript should explain how the refreshed ciphertext is propagated back to the d output columns without additional per-column bootstrapping or heavy rotations.
  5. [Section VIII.D, Table III] The table reports runtimes for a 'LLaMA-3-700M' model, but Table IV uses 'Bitnet b1.58-3B'. The relationship between the benchmarked model and the accuracy-evaluated model should be clarified, including the number of heads and the per-head dimension, since the CCMM rows use R^{2048×96}.
  6. [General] Some references are incomplete: the BitNet b1.58 entry in the references is missing venue/page information, and the PIQA and COPA entries lack year/venue details. The manuscript also uses 'NEXUS [12]' and 'EFLA' without explaining the EFLA acronym.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the efficiency claims are algorithmic constructions; the sigmoid-attention swap is an unvalidated empirical premise, not a circular reduction.

full rationale

The paper's core contributions are self-contained algorithmic constructions, not results obtained by fitting a model to its own outputs. The multiplication-free plaintext-ciphertext matrix multiplication (Section V.A, Algorithm 1) is derived from BitNet's ternary weights: because weights are in {-1,0,1}, each output column is just a sum/difference of input ciphertext columns, eliminating homomorphic multiplications by construction. The CCMM optimization (Section V.B) is a BSGS-style extraction that reduces rotations from linear to logarithmic; this is a concrete algorithmic improvement with no fitted parameters. The bootstrapping-in-RMSNorm design (Section VII, Algorithm 3) exploits the fact that after summing d squared columns, the RMS statistic is held in a single ciphertext, reducing bootstrapping from O(d) to O(1); again this is a structural observation, not a circular step. The polynomial approximations for sigmoid, sqrt, and inverse are standard Chebyshev approximations to the mathematical functions themselves; although the approximation interval [a,b] for sigmoid is not disclosed, this is a reproducibility gap, not a case of fitting to the paper's accuracy or runtime results. The one load-bearing empirical premise is that sigmoid attention can replace softmax in a pretrained BitNet without retraining (Section VI.A, Eq. 6). This is asserted as 'seamless, retraining-free,' but Table IV compares ENC (encrypted sigmoid) against plaintext softmax and reports a 5.76-point PIQA drop (71.65% to 65.89%) with no plaintext-sigmoid baseline. That omission makes the accuracy impact of the sigmoid swap unattributed and weakens the retraining-free claim. However, this is a validation/attribution gap, not circularity: the paper does not define sigmoid in terms of softmax, does not fit any parameter to the reported accuracies, and does not rename a fitted value as a prediction. All references to prior work, including NEXUS [12], EFLA [10], BitNet [15,16], and sigmoid attention [17], are external; there is no load-bearing self-citation chain or imported uniqueness theorem. The central speedups therefore stand as independent algorithmic contributions, and the paper is not circular in the sense required by the analysis.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard cryptographic assumptions plus two paper-specific premises: BitNet's ternary weights enabling addition-only matrix multiplication, and the untested assumption that sigmoid attention can replace softmax post-hoc. The undisclosed sigmoid approximation interval and degree are the main free parameters that could affect both accuracy and runtime.

free parameters (5)
  • Sigmoid approximation interval [a,b] = not specified
    Chebyshev approximation of sigmoid requires an input interval; if chosen from plaintext attention score statistics, it is a data-dependent fit.
  • Sigmoid polynomial degree n = not specified
    The paper gives no degree for the sigmoid/softmax polynomial; it directly trades accuracy vs runtime.
  • RMSNorm sqrt/inverse polynomial degree = 50 or 60
    Table II uses degrees 50 and 60 chosen by hand; different degrees give different error and runtime.
  • CKKS polynomial degree (log2 N') = 14 or 16
    Default N'=14 (degree 2^14) chosen for speed; N'=16 used for larger vectors. These are hand-chosen security/performance tradeoffs.
  • Multiplicative depth L and bootstrapping depth K = L=48, K=20
    Chosen to fit the circuit and to set the effective depth L-K=28; affects noise and bootstrapping frequency.
assumptions (5)
  • standard math RNS-CKKS is IND-CPA secure and supports approximate arithmetic with the claimed noise growth.
    Standard cryptographic assumption from [13, 14] used throughout.
  • domain assumption BitNet b1.58 has ternary weights in {-1,0,1} that remain fixed during inference.
    Foundation of the multiplication-free PCMM; from [15, 16].
  • ad hoc to paper Sigmoid attention (Eq. 6) is a valid drop-in replacement for softmax in a pre-trained transformer without retraining.
    This is the key unvalidated assumption; Table IV shows accuracy drops up to 6 points, and no plaintext-sigmoid baseline is provided.
  • domain assumption The honest-but-curious (semi-honest) adversary model is the security target.
    Standard for secure inference; stated in Section IV.B.
  • domain assumption Chebyshev polynomial approximation and Paterson-Stockmeyer evaluation provide sufficient accuracy for sigmoid, sqrt, and inverse over the input ranges.
    Needed for nonlinear layers; error only measured for RMSNorm in Table II, not for sigmoid.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ENSI: Efficient Non-Interactive Secure Inference for Large Language Models." pith.science (2026). https://pith.science/paper/3EFAYXZL

@misc{pith2026250909424,
  author       = {Pith},
  title        = {Pith review of: ENSI: Efficient Non-Interactive Secure Inference for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3EFAYXZL}},
  note         = {Machine review of arXiv:2509.09424}
}
read the original abstract

Secure inference enables privacy-preserving machine learning by leveraging cryptographic protocols that support computations on sensitive user data without exposing it. However, integrating cryptographic protocols with large language models (LLMs) presents significant challenges, as the inherent complexity of these protocols, together with LLMs' massive parameter scale and sophisticated architectures, severely limits practical usability. In this work, we propose ENSI, a novel non-interactive secure inference framework for LLMs, based on the principle of co-designing the cryptographic protocols and LLM architecture. ENSI employs an optimized encoding strategy that seamlessly integrates CKKS scheme with a lightweight LLM variant, BitNet, significantly reducing the computational complexity of encrypted matrix multiplications. In response to the prohibitive computational demands of softmax under homomorphic encryption (HE), we pioneer the integration of the sigmoid attention mechanism with HE as a seamless, retraining-free alternative. Furthermore, by embedding the Bootstrapping operation within the RMSNorm process, we efficiently refresh ciphertexts while markedly decreasing the frequency of costly bootstrapping invocations. Experimental evaluations demonstrate that ENSI achieves approximately an 8x acceleration in matrix multiplications and a 2.6x speedup in softmax inference on CPU compared to state-of-the-art method, with the proportion of bootstrapping is reduced to just 1%.

Figures

Figures reproduced from arXiv: 2509.09424 by the authors.

Figure 1
Figure 1. Overview of encoding methods for attention and multi-head attention. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The multi-head attention structure of BitNet [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. ENSI’s high-level architecture. V. CO-DESIGN WITH BITNET: EFFICIENT SECURE LINEAR COMPUTATIONS Linear computations, particularly matrix multiplications, are the primary computational workload in large language models. Under our system setting, there are two main types of matrix multiplications in secure LLM inference (cf [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The overview of matrix multiplication based on outer product [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: (a) A naive element extraction strategy (left); (b) an innovative [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Implementation of bootstrapping in a Bitnet-based architecture, [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Evaluation of runtime for R2048×768 ⊠R768×64 ciphertext-plaintext matrix multiplication [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Evaluation of runtime for different ciphertext-plaintext matrix multi [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 8 linked inside Pith

  1. [1]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azharet al., “Llama: Open and efficient foundation language models,”arXiv preprint arXiv:2302.13971, 2023

    arXiv 2023

  2. [2]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosaleet al., “Llama 2: Open foundation and fine-tuned chat models,”arXiv preprint arXiv:2307.09288, 2023

    arXiv 2023

  3. [3]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskeveret al., “Language models are unsupervised multitask learners,”OpenAI blog, vol. 1, no. 8, p. 9, 2019

    2019

  4. [4]

    Can llms keep a secret?testing privacy implications of language models via contextual integrity theory,

    N. Mireshghallah, H. Kim, X. Zhou, Y . Tsvetkov, M. Sap, R. Shokri, and Y . Choi, “Can llms keep a secret?testing privacy implications of language models via contextual integrity theory,”arXiv preprint arXiv:2310.17884, 2023

    arXiv 2023

  5. [5]

    Protocols for secure computations,

    A. C. Yao, “Protocols for secure computations,” in23rd annual sympo- sium on foundations of computer science (sfcs 1982). IEEE, 1982, pp. 160–164

    1982

  6. [6]

    Fully homomorphic encryption using ideal lattices,

    C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proceedings of the forty-first annual ACM symposium on Theory of computing, 2009, pp. 169–178

    2009

  7. [7]

    Gazelle: A low latency framework for secure neural network inference,

    C. Juvekar, V . Vaikuntanathan, and A. Chandrakasan, “Gazelle: A low latency framework for secure neural network inference,” in27th USENIX security symposium (USENIX security 18), 2018, pp. 1651–1669

    2018

  8. [8]

    Towards the AlexNet Moment for Homomorphic Encryption: HCNN, the First Homomorphic CNN on Encrypted Data With GPUs,

    A. Al Badawi, C. Jin, J. Lin, C. F. Mun, S. J. Jie, B. H. M. Tan, X. Nan, K. M. M. Aung, and V . R. Chandrasekhar, “Towards the AlexNet Moment for Homomorphic Encryption: HCNN, the First Homomorphic CNN on Encrypted Data With GPUs,”IEEE Transactions on Emerging Topics in Computing, vol. 9, no. 3, pp. 1330–1343, 2020

    2020

Show all 41 references
  1. [9]

    Cheetah: Lean and fast secure Two-Party deep neural network inference,

    Z. Huang, W.-j. Lu, C. Hong, and J. Ding, “Cheetah: Lean and fast secure Two-Party deep neural network inference,” in31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 809–826

    2022

  2. [10]

    Encryption-friendly llm architecture,

    D. Rho, T. Kim, M. Park, J. W. Kim, H. Chae, E. K. Ryu, and J. H. Cheon, “Encryption-friendly llm architecture,”arXiv preprint arXiv:2410.02486, 2024

    2024 arXiv

  3. [11]

    Nimbus: Secure and efficient two- party inference for transformers,

    Z. Li, K. Yang, J. Tan, W.-j. Lu, H. Wu, X. Wang, Y . Yu, D. Zhao, Y . Zheng, M. Guo, and J. Leng, “Nimbus: Secure and efficient two- party inference for transformers,” inAdvances in Neural Information Processing Systems, vol. 37, 2024, pp. 21 572–21 600

    2024

  4. [12]

    Secure transformer inference made non- interactive,

    J. Zhang, X. Yang, L. He, K. Chen, W.-j. Lu, Y . Wang, X. Hou, J. Liu, K. Ren, and X. Yang, “Secure transformer inference made non- interactive,”Proceedings of the Network and Distributed System Security (NDSS), 2025

    2025

  5. [13]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inAdvances in cryptology– ASIACRYPT 2017: 23rd international conference on the theory and applications of cryptology and information security, Hong kong, China, December ...

    2017

  6. [14]

    A full rns variant of approximate homomorphic encryption,

    J. H. Cheon, K. Han, A. Kim, M. Kim, and Y . Song, “A full rns variant of approximate homomorphic encryption,” inSelected Areas in Cryptography–SAC 2018: 25th International Conference. Springer, 2019, pp. 347–368

    2018

  7. [15]

    Bitnet: Scaling 1-bit transformers for large language models,

    H. Wang, S. Ma, L. Dong, S. Huang, H. Wang, L. Ma, F. Yang, R. Wang, Y . Wu, and F. Wei, “Bitnet: Scaling 1-bit transformers for large language models,”arXiv preprint arXiv:2310.11453, 2023

    2023 arXiv

  8. [16]

    The era of 1-bit llms: All large language models are in 1.58 bits,

    S. Ma, H. Wang, L. Ma, L. Wang, W. Wang, S. Huang, L. Dong, R. Wang, J. Xue, and F. Wei, “The era of 1-bit llms: All large language models are in 1.58 bits,”arXiv preprint arXiv:2402.17764, vol. 1, 2024

    2024 arXiv

  9. [17]

    Theory, analysis, and best practices for sigmoid self-attention,

    J. Ramapuram, F. Danieli, E. G. Dhekane, F. Weers, D. Busbridge, P. Ablin, T. Likhomanenko, J. Digani, Z. Gu, A. Shidani, and R. Webb, “Theory, analysis, and best practices for sigmoid self-attention,” inThe Thirteenth International Conference on Learning Representations, 2025

    2025

  10. [18]

    Mpc- former: fast, performant and private transformer inference with mpc,

    D. Li, R. Shao, H. Wang, H. Guo, E. P. Xing, and H. Zhang, “Mpc- former: fast, performant and private transformer inference with mpc,” arXiv preprint arXiv:2211.01452, 2022

    2022 arXiv

  11. [19]

    Puma: Secure inference of llama-7b in five minutes,

    Y . Dong, W.-j. Lu, Y . Zheng, H. Wu, D. Zhao, J. Tan, Z. Huang, C. Hong, T. Wei, and W. Chen, “Puma: Secure inference of llama-7b in five minutes,”arXiv preprint arXiv:2307.12533, 2023

    2023

  12. [20]

    Privformer: Privacy-preserving transformer with mpc,

    Y . Akimoto, K. Fukuchi, Y . Akimoto, and J. Sakuma, “Privformer: Privacy-preserving transformer with mpc,” in2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 2023, pp. 392– 410

    2023

  13. [21]

    THE-X: Privacy-preserving transformer inference with homomorphic encryption,

    T. Chen, H. Bao, S. Huang, L. Dong, B. Jiao, D. Jiang, H. Zhou, J. Li, and F. Wei, “THE-X: Privacy-preserving transformer inference with homomorphic encryption,” inFindings of the Association for Computational Linguistics: ACL 2022, 2022, pp. 3510–3520

    2022

  14. [22]

    Iron: Private inference on transformers,

    M. Hao, H. Li, H. Chen, P. Xing, G. Xu, and T. Zhang, “Iron: Private inference on transformers,”Advances in neural information processing systems, vol. 35, pp. 15 718–15 731, 2022

    2022

  15. [23]

    Bolt: Privacy-preserving, accurate and efficient inference for transformers,

    Q. Pang, J. Zhu, H. M ¨ollering, W. Zheng, and T. Schneider, “Bolt: Privacy-preserving, accurate and efficient inference for transformers,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 4753–4771

    2024

  16. [24]

    Bumblebee: Secure two-party inference framework for large transformers,

    W.-j. Lu, Z. Huang, Z. Gu, J. Li, J. Liu, C. Hong, K. Ren, T. Wei, and W. Chen, “Bumblebee: Secure two-party inference framework for large transformers,”Cryptology ePrint Archive, 2023

    2023

  17. [25]

    Powerformer: Efficient privacy- preserving transformer with batch rectifier-power max function and optimized homomorphic attention,

    D. Park, E. Lee, and J.-W. Lee, “Powerformer: Efficient privacy- preserving transformer with batch rectifier-power max function and optimized homomorphic attention,”Cryptology ePrint Archive, 2024

    2024

  18. [26]

    A fast, performant, secure distributed training framework for llm,

    W. Huang, Y . Wang, A. Cheng, A. Zhou, C. Yu, and L. Wang, “A fast, performant, secure distributed training framework for llm,” inICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024, pp. 4800–4804

    2024

  19. [27]

    Teeslice: Protecting sensitive neural network models in trusted execution envi- ronments when attackers have pre-trained models,

    D. Li, Z. Zhang, M. Yao, Y . Cai, Y . Guo, and X. Chen, “Teeslice: Protecting sensitive neural network models in trusted execution envi- ronments when attackers have pre-trained models,”ACM Transactions on Software Engineering and Methodology, 2024

    2024

  20. [28]

    Securing ai inference in the cloud: Is cpu-gpu confidential computing ready?

    A. Mohan, M. Ye, H. Franke, M. Srivatsa, Z. Liu, and N. M. Gonzalez, “Securing ai inference in the cloud: Is cpu-gpu confidential computing ready?” in2024 IEEE 17th International Conference on Cloud Comput- ing (CLOUD). IEEE, 2024, pp. 164–175

    2024

  21. [29]

    Graviton: Trusted execution environments on{GPUs},

    S. V olos, K. Vaswani, and R. Bruno, “Graviton: Trusted execution environments on{GPUs},” in13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), 2018, pp. 681–696

    2018

  22. [30]

    Optimized homomorphic encryption solution for secure genome-wide association studies,

    M. Blatt, A. Gusev, Y . Polyakov, K. Rohloff, and V . Vaikuntanathan, “Optimized homomorphic encryption solution for secure genome-wide association studies,”BMC Medical Genomics, vol. 13, pp. 1–13, 2020

    2020

  23. [31]

    Glu variants improve transformer,

    N. Shazeer, “Glu variants improve transformer,”arXiv preprint arXiv:2002.05202, 2020

    2002 arXiv

  24. [32]

    Roformer: En- hanced transformer with rotary position embedding,

    J. Su, M. Ahmed, Y . Lu, S. Pan, W. Bo, and Y . Liu, “Roformer: En- hanced transformer with rotary position embedding,”Neurocomputing, vol. 568, p. 127063, 2024

    2024

  25. [33]

    A baby step– giant step roadmap algorithm for general algebraic sets,

    S. Basu, M.-F. Roy, M. S. El Din, and ´E. Schost, “A baby step– giant step roadmap algorithm for general algebraic sets,”Foundations of Computational Mathematics, vol. 14, pp. 1117–1172, 2014

    2014

  26. [34]

    Openfhe: Open-source fully homomorphic encryption library,

    A. Al Badawi, J. Bates, F. Bergamaschi, D. B. Cousins, S. Erabelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y . Leeet al., “Openfhe: Open-source fully homomorphic encryption library,” inproceedings of the 10th workshop on encrypted computing & applied homomorphic cryptography, ...

    2022

  27. [35]

    Phantom: A cuda-accelerated word-wise homomorphic encryption library,

    H. Yang, S. Shen, W. Dai, L. Zhou, Z. Liu, and Y . Zhao, “Phantom: A cuda-accelerated word-wise homomorphic encryption library,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4895–4906, 2024

    2024

  28. [36]

    Microsoft SEAL (release 4.1),

    “Microsoft SEAL (release 4.1),” https://github.com/Microsoft/SEAL, Jan. 2023, microsoft Research, Redmond, W A

    2023

  29. [37]

    Homomorphic en- cryption standard,

    M. Albrecht, M. Chase, H. Chen, J. Ding, S. Goldwasser, S. Gorbunov, S. Halevi, J. Hoffstein, K. Laine, K. Lauteret al., “Homomorphic en- cryption standard,”Protecting privacy through homomorphic encryption, pp. 31–62, 2021

    2021

  30. [38]

    Secure outsourced matrix computation and application to neural networks,

    X. Jiang, M. Kim, K. Lauter, and Y . Song, “Secure outsourced matrix computation and application to neural networks,” inProceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 1209–1222

    2018

  31. [39]

    Piqa: Reasoning about physical commonsense in natural language,

    Y . Bisk, R. Zellers, R. L. Bras, J. Gao, and Y . Choi, “Piqa: Reasoning about physical commonsense in natural language,” 2019

    2019

  32. [40]

    Visual choice of plausible alternatives: An evaluation of image- based commonsense causal reasoning,

    J. Yeo, G. Lee, G. Wang, S. Choi, H. Cho, R. K. Amplayo, and S.-w. Hwang, “Visual choice of plausible alternatives: An evaluation of image- based commonsense causal reasoning,” inProceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 20...

    2018

  33. [41]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” inProceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, Oct. 2013, pp. 1631–1642

    2013

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.