Pith. sign in

REVIEW 3 major objections 2 minor 35 references

FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing

T0 review · 3 major / 2 minor · reviewed 2026-06-27 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FuseFSS compiles per-operator specs of interval partitions and low-degree pieces into two batched FSS evaluations for nonlinear layers.

desk verdict FuseFSS's compiler for turning operator specs into batched FSS evaluations is the actual new piece, but the abstract supplies no correctness argument or error bounds for the emitted circuits. read the letter →

arxiv 2606.09551 v1 pith:7DPZKQB3 submitted 2026-06-08 cs.CR cs.AI

Yuhan Ma , Yong Li , Stefan Schmid This is my paper · ORCID
classification cs.CRcs.AI
keywords secureinferencefunctionsecretsharinglargelanguagemodelscompilerfixed-pointarithmeticnonlinearoperatorstwo-serverprotocolsGPUacceleration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces FuseFSS as a compiler that unifies the handling of fixed-point nonlinear operators in two-server secure LLM inference based on function secret sharing. Instead of designing a separate protocol for each operator with its own comparisons and corrections, the system accepts a compact description of the operator's interval partition, arithmetic pieces, and predicate bits. From this description the compiler produces two batched FSS evaluations on the masked input value, one that packs all necessary comparisons and one that performs a vector lookup of the active coefficients. Experiments on BERT and GPT-style models show that the resulting protocols preserve accuracy while reducing end-to-end latency and online communication relative to prior per-operator FSS implementations. A reader would care because secure inference protects both client prompts and server model weights, and the dominant remaining cost has been the nonlinear layers.

What carries the argument

The FuseFSS compiler that converts a per-operator specification of interval partition, low-degree pieces, and predicate bits into a packed comparison FSS and a vector interval-lookup FSS.

What would settle it

An accuracy drop or a successful privacy attack on a BERT or GPT model when its nonlinear layers are replaced by the compiled FuseFSS protocols would show the claim is false.

Watch

Extended reading notes

Core claim

FuseFSS replaces per-operator protocol design with a single compilation pipeline. For each scalar fixed-point operator, a compact specification lists its interval partition, low-degree arithmetic pieces, and required predicate bits. The compiler emits two batched FSS evaluations on the public masked value: one packed comparison that returns all predicate bits, and one vector interval lookup that returns the active coefficients and constants.

Load-bearing premise

A compact per-operator specification of interval partition, low-degree arithmetic pieces, and predicate bits can be compiled into batched FSS evaluations that correctly realize the original nonlinear function.

Editorial extensions

If this is right

  • Accuracy is preserved on BERT and GPT-style models.
  • End-to-end latency improves by 1.24× to 1.50× over prior FSS-based GPU secure inference.
  • Online communication volume drops by 9% to 16%.
  • Preprocessing time for key generation falls by 14% to 23% and key sizes shrink by 20% to 24%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same specification format could be reused for nonlinear functions outside current LLM layers once the arithmetic pieces are identified.
  • Lower design effort per operator may shorten the time needed to support new activation or normalization functions that appear in future models.
  • Smaller preprocessing material could make secure inference practical on hardware with tighter memory budgets for the two servers.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The paper introduces FuseFSS, a compiler for two-server secure LLM inference based on function secret sharing (FSS). For each fixed-point nonlinear operator, a compact specification of interval partitions, low-degree arithmetic pieces, and predicate bits is compiled into two batched FSS evaluations (one packed comparison returning predicate bits, one vector lookup returning coefficients). The system is evaluated on BERT and GPT-style models and claims to preserve accuracy while delivering 1.24×–1.50× end-to-end speedup, 9%–16% lower online communication, and lighter preprocessing relative to prior FSS-based GPU secure inference.

Significance. If the per-operator FSS circuits are shown to be correct, the unified compilation pipeline would reduce the engineering burden of bespoke protocols for nonlinearities and helper operations, potentially improving the practicality of FSS-based secure inference for large models. The reported speedups and communication savings on standard architectures are concrete and would be of interest to the secure-computation community if the underlying correctness assumptions hold.

major comments (3)
  1. [Abstract] Abstract: the accuracy-preservation claim rests on the assumption that each operator's interval partition + low-degree pieces + predicate bits, when compiled into one packed comparison FSS and one vector lookup FSS, produce exactly the same fixed-point result as the original operator. No derivation, invariant, or error bound is supplied showing that the emitted circuits preserve the function on every interval or quantifying the approximation error under fixed-point rounding.
  2. [Compiler pipeline] Compiler pipeline description: the manuscript supplies no formal argument or verification procedure establishing that the chosen low-degree pieces and predicate bits, once turned into batched FSS evaluations, implement the original nonlinear function without accuracy loss or security degradation for arbitrary operators; the empirical numbers on BERT/GPT therefore only demonstrate that the tested specifications happened to be adequate for those models.
  3. [Experiments] Experimental section: the central performance claims (1.24×–1.50× speedup, 9%–16% communication reduction) are presented without reported controls for the choice of interval partitions or degree of the arithmetic pieces, nor any sensitivity analysis showing how accuracy would degrade if a different operator or deeper network were substituted.
minor comments (2)
  1. Notation for the packed comparison and vector lookup FSS primitives could be introduced earlier and used consistently to improve readability of the compilation pipeline.
  2. The abstract and introduction would benefit from a brief statement of the threat model and the precise security notion (e.g., semi-honest two-server) under which the FSS evaluations are claimed to be secure.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive comments. We address each major point below and indicate planned revisions.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the accuracy-preservation claim rests on the assumption that each operator's interval partition + low-degree pieces + predicate bits, when compiled into one packed comparison FSS and one vector lookup FSS, produce exactly the same fixed-point result as the original operator. No derivation, invariant, or error bound is supplied showing that the emitted circuits preserve the function on every interval or quantifying the approximation error under fixed-point rounding.

    Authors: The emitted circuits preserve the function exactly by construction: the supplied specifications define interval partitions and low-degree pieces that match the original fixed-point operator on each interval (with predicate bits selecting the active piece), and the FSS evaluations compute these without additional error. We will add a short derivation of this invariant to the revised abstract and compiler section. revision: yes

  2. Referee: [Compiler pipeline] Compiler pipeline description: the manuscript supplies no formal argument or verification procedure establishing that the chosen low-degree pieces and predicate bits, once turned into batched FSS evaluations, implement the original nonlinear function without accuracy loss or security degradation for arbitrary operators; the empirical numbers on BERT/GPT therefore only demonstrate that the tested specifications happened to be adequate for those models.

    Authors: For any operator whose specification is accurate, the batched FSS evaluations implement the piecewise function exactly, with security inherited unchanged from the underlying FSS primitives. The BERT/GPT results validate the framework on standard models. We will expand the compiler pipeline section with an explicit argument establishing this property for arbitrary operators. revision: yes

  3. Referee: [Experiments] Experimental section: the central performance claims (1.24×–1.50× speedup, 9%–16% communication reduction) are presented without reported controls for the choice of interval partitions or degree of the arithmetic pieces, nor any sensitivity analysis showing how accuracy would degrade if a different operator or deeper network were substituted.

    Authors: The reported speedups use interval partitions and polynomial degrees chosen to preserve exact accuracy on the evaluated BERT/GPT operators. We did not include sensitivity analysis because the contribution centers on the compiler rather than exhaustive operator tuning. We will add a brief discussion of how alternative specifications affect the accuracy-performance trade-off. revision: partial

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: empirical performance claims rest on benchmarks, not self-referential derivations

full rationale

The manuscript describes a compiler pipeline that emits batched FSS evaluations from per-operator interval partitions and low-degree pieces. All load-bearing claims (1.24×–1.50× speedup, accuracy preservation, communication reduction) are presented as outcomes of concrete GPU measurements on BERT/GPT models against prior FSS systems. No equations, uniqueness theorems, or fitted parameters are introduced whose outputs are then re-labeled as predictions; the correctness assumption is stated explicitly as an engineering precondition rather than derived from prior self-citations. The derivation chain is therefore self-contained against external benchmarks.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

Abstract-only review yields minimal ledger entries; the approach relies on standard cryptographic primitives rather than new fitted values or invented entities.

assumptions (1)
  • domain assumption Security of function secret sharing under standard cryptographic assumptions
    The entire construction depends on the security properties of FSS, which are treated as established in the field.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing." pith.science (2026). https://pith.science/paper/7DPZKQB3

@misc{pith2026260609551,
  author       = {Pith},
  title        = {Pith review of: FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7DPZKQB3}},
  note         = {Machine review of arXiv:2606.09551}
}
abstract

Two-server secure inference allows a client to query a hosted large language model (LLM) without revealing prompts or embeddings. Recent GPU systems based on function secret sharing (FSS) make linear layers efficient, but fixed-point nonlinearities and helper operations remain a bottleneck because each operator is typically implemented as a bespoke protocol with its own comparisons, wrap-around corrections, and preprocessing material. We present FuseFSS, a compiler that replaces per-operator protocol design with a single compilation pipeline. For each scalar fixed-point operator, a compact specification lists its interval partition, low-degree arithmetic pieces, and required predicate bits. The compiler emits two batched FSS evaluations on the public masked value: one packed comparison that returns all predicate bits, and one vector interval lookup that returns the active coefficients and constants. Compared to the current state-of-the-art FSS-based GPU secure inference, FuseFSS preserves accuracy while achieving a $1.24\times$--$1.50\times$ end-to-end speedup and reducing online communication by $9\%$--$16\%$ on BERT and GPT-style models; preprocessing is also lighter, with $14\%$--$23\%$ lower key-generation time and $20\%$--$24\%$ smaller keys.

Figures

Figures reproduced from arXiv: 2606.09551 by the authors.

Figure 1
Figure 1. shows that FuseFSS achieves consistent communication savings (≈24%) and substantial per-gate speedups (1.64– 2.46×). FuseFSS also shrinks per-gate key material by 4.96–6.25×. These gate-level gains are larger than the end-to-end improvements in [PITH_FULL_IMAGE:figures/full_fig_p014_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 2 canonical work pages

  1. [1]

    Advances in Neural Information Processing Systems (NeurIPS) , volume=

    Language Models are Few-Shot Learners , author=. Advances in Neural Information Processing Systems (NeurIPS) , volume=

  2. [2]

    2017 , organization=

    Mohassel, Payman and Zhang, Yupeng , booktitle=. 2017 , organization=

    2017

  3. [3]

    Rathee, Deevashwer and Rathee, Mayank and Kumar, Nishant and Chandran, Nishanth and Gupta, Divya and Rastogi, Aseem and Sharma, Rahul , booktitle=

  4. [4]

    Gupta, Kanav and Jawalkar, Neha and Mukherjee, Ananta and Chandran, Nishanth and Gupta, Divya and Panwar, Ashish and Sharma, Rahul , journal=

  5. [5]

    Andes Y. L. Kei and Sherman S. M. Chow , booktitle=

  6. [6]

    Annual international conference on the theory and applications of cryptographic techniques (EUROCRYPT) , pages=

    Function Secret Sharing , author=. Annual international conference on the theory and applications of cryptographic techniques (EUROCRYPT) , pages=. 2015 , publisher=

    2015

  7. [7]

    Jawalkar, Neha and Gupta, Kanav and Basu, Arkaprava and Chandran, Nishanth and Gupta, Divya and Sharma, Rahul , booktitle=. Orca:. 2024 , organization=

    2024

  8. [8]

    Keller, Marcel , booktitle=

Show all 35 references
  1. [9]

    Proceedings on Privacy Enhancing Technologies (PoPETs) , volume=

    Pika: Secure computation using function secret sharing over rings , author=. Proceedings on Privacy Enhancing Technologies (PoPETs) , volume=

  2. [10]

    Annual international cryptology conference (CRYPTO) , pages=

    Efficient multiparty protocols using circuit randomization , author=. Annual international cryptology conference (CRYPTO) , pages=. 1991 , organization=

    1991

  3. [11]

    Advances in Neural Information Processing Systems (NeurIPS) , volume=

    Iron: Private inference on transformers , author=. Advances in Neural Information Processing Systems (NeurIPS) , volume=

  4. [12]

    2024 IEEE Symposium on Security and Privacy (SP) , pages=

    Pang, Qi and Zhu, Jinhao and M. 2024 IEEE Symposium on Security and Privacy (SP) , pages=. 2024 , organization=

    2024

  5. [13]

    Network and Distributed System Security Symposium (NDSS) , year=

    Lu, Wen-jie and Huang, Zhicong and Gu, Zhen and Li, Jingyu and Liu, Jian and Hong, Cheng and Ren, Kui and Wei, Tao and Chen, WenGuang , title=. Network and Distributed System Security Symposium (NDSS) , year=

  6. [14]

    Proceedings of the 2016 ACM SIGSAC conference on computer and communications security (CCS) , pages=

    Function secret sharing: Improvements and extensions , author=. Proceedings of the 2016 ACM SIGSAC conference on computer and communications security (CCS) , pages=

    2016

  7. [15]

    Theory of Cryptography Conference (TCC) , pages=

    Secure computation with preprocessing via function secret sharing , author=. Theory of Cryptography Conference (TCC) , pages=. 2019 , organization=

    2019

  8. [16]

    Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT) , pages=

    Function secret sharing for mixed-mode and fixed-point secure computation , author=. Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT) , pages=. 2021 , organization=

    2021

  9. [17]

    Communications of the ACM , volume=

    How to Share a Secret , author=. Communications of the ACM , volume=. 1979 , publisher=

    1979

  10. [18]

    Annual cryptology conference (CRYPTO) , pages=

    Multiparty computation from somewhat homomorphic encryption , author=. Annual cryptology conference (CRYPTO) , pages=. 2012 , organization=

    2012

  11. [19]

    Mohassel, Payman and Rindal, Peter , booktitle=

  12. [20]

    Patra, Arpita and Schneider, Thomas and Suresh, Ajith and Yalame, Hossein , booktitle=

  13. [21]

    Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT) , pages=

    Distributed point functions and their applications , author=. Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT) , pages=. 2014 , organization=

    2014

  14. [22]

    International Conference on Financial Cryptography and Data Security (FC) , pages=

    Secure computation with fixed-point numbers , author=. International Conference on Financial Cryptography and Data Security (FC) , pages=. 2010 , organization=

    2010

  15. [23]

    Demmler, Daniel and Schneider, Thomas and Zohner, Michael , booktitle=

  16. [24]

    Proceedings of the 18th International Conference on Security and Cryptography (SECRYPT) , title =

    Demmler, Daniel and Katzenbeisser, Stefan and Schneider, Thomas and Schuster, Tom and Weinert, Christian , year =. Proceedings of the 18th International Conference on Security and Cryptography (SECRYPT) , title =

  17. [25]

    Juvekar, Chiraag and Vaikuntanathan, Vinod and Chandrakasan, Anantha , booktitle=

  18. [26]

    2025 , organization=

    Gupta, Kanav and Chandran, Nishanth and Gupta, Divya and Katz, Jonathan and Sharma, Rahul , booktitle=. 2025 , organization=

    2025

  19. [27]

    2016 , organization=

    Gilad-Bachrach, Ran and Dowlin, Nathan and Laine, Kim and Lauter, Kristin and Naehrig, Michael and Wernsing, John , booktitle=. 2016 , organization=

    2016

  20. [28]

    Ditto: Quantization-aware Secure Inference of Transformers upon

    Wu, Haoqi and Fang, Wenjing and Zheng, Yancheng and Ma, Junming and Tan, Jin and Wang, Lei , booktitle =. Ditto: Quantization-aware Secure Inference of Transformers upon. 2024 , volume =

    2024

  21. [29]

    Proceedings of the 41st International Conference on Machine Learning (ICML) , pages =

    Converting Transformers to Polynomial Form for Secure Inference Over Homomorphic Encryption , author =. Proceedings of the 41st International Conference on Machine Learning (ICML) , pages =. 2024 , volume =

    2024

  22. [30]

    2019 , organization=

    Chandran, Nishanth and Gupta, Divya and Rastogi, Aseem and Sharma, Rahul and Tripathi, Shardul , booktitle=. 2019 , organization=

    2019

  23. [31]

    Devlin, Jacob and Chang, Ming-Wei and Lee, Kenton and Toutanova, Kristina , booktitle=

  24. [32]

    OpenAI , year=

    Language models are unsupervised multitask learners , author=. OpenAI , year=

  25. [33]

    Advances in Neural Information Processing Systems (NeurIPS) , title =

    Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser,. Advances in Neural Information Processing Systems (NeurIPS) , title =

  26. [34]

    arXiv preprint arXiv:1607.06450 , year=

    Layer normalization , author=. arXiv preprint arXiv:1607.06450 , year=

    arXiv

  27. [35]

    arXiv preprint arXiv:1710.05941 , year=

    Searching for activation functions , author=. arXiv preprint arXiv:1710.05941 , year=

    arXiv

Pith tools

Reviewed June 27, 2026 · model on record in the stance chip above.