Pith. sign in

REVIEW 5 major objections 4 minor 43 references

EVA-S2PMLP: Secure and Scalable Two-Party MLP via Spatial Transformation

T0 review · 5 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a two-party MLP can be trained and run securely over real numbers by remapping each scalar into a vector or matrix first, so every operation reduces to masked matrix products whose outputs are additive shares.

desk verdict The base S2PM/S2PRIP protocol is algebraically wrong—the output shares include a residual Ahat×R_B—and the verification is a tautology, so the whole EVA-S2PMLP stack is unsupported. read the letter →

arxiv 2506.15102 v1 pith:GWBRH7WK submitted 2025-06-18 cs.CR cs.ITmath.IT

Shizhao Peng , Shoumo Li , Tianle Tao This is my paper · ORCID
classification cs.CRcs.ITmath.IT
keywords securetwo-partycomputationmulti-layerperceptronprivacy-preservingmachinelearningspatialtransformationadditivesecretsharingreal-numberverifiableexactReLUandsoftmax
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that two organisations holding vertically split data can train and run a multi-layer perceptron without revealing their private inputs, working directly over real numbers rather than fixed-point rings. The route is a spatial transformation (spatial-scale optimization) that rewrites each scalar as a split vector or matrix, turning every needed operation into a masked matrix product whose outputs are additive shares. If the construction holds, exact ReLU and softmax become available in secure two-party MLP, communication rounds stay small and fixed, and model accuracy tracks the plaintext version. The paper also claims verifiability of results and reports up to a $12.3\times$ reduction in communication over baselines.

What carries the argument

The carrying object is the spatial transformation: each private scalar is split into $r$ random pieces and arranged, with replicated or permuted structure, into a matrix $\mathbf{P}_A$ for Alice and $\mathbf{P}_B$ for Bob so that the target function value appears on the diagonal of the product $\mathbf{P}_A \mathbf{P}_B$ (or as the row-wise inner product $A \circledast B$). The base protocols S2PM and S2PRIP compute this product as additive shares $Y_A + Y_B = \mathbf{P}_A \mathbf{P}_B$ using commodity-server masks $\mathbf{M}_A, \mathbf{M}_B$ with $\mathbf{M}_A \mathbf{M}_B = \mathbf{C}$; every higher protocol composes these shares, so correctness is carried by the linear share-sum invariant rather than by a new cryptographic primitive.

What would settle it

Run the preprocessing phase exactly as specified on 1000 random inputs and record the ranks of the masks $\mathbf{M}_A$ and $\mathbf{M}_B$: uniformly random real matrices are full rank with probability 1, so the rank-deficient matrices Lemma 1 requires never appear, and the proof's step that invokes Lemma 1 has no valid instance to execute.

Watch

Extended reading notes

Core claim

The central claim is that a complete two-party MLP training and inference stack can be built on a single secure row-wise inner product (S2PRIP) whose outputs satisfy $Y_A + Y_B = A \circledast B$ over the real numbers. Around this primitive the paper constructs exact ReLU derivatives, ReLU, softmax, reciprocals, gradients, and then full training (S2PMLP-TR) and prediction (S2PMLP-PR) protocols, each correct by the same algebraic share-sum invariant. The security theorems assert semi-honest privacy in a real-number-field security model, and the experiments claim near-plaintext accuracy (for example $0.9582$ on MNIST versus $0.9638$ plaintext) with up to $12.3\times$ lower communication than the compared baselines.

Load-bearing premise

The whole security argument rests on the paper's real-number security model, which equates privacy with the existence of infinitely many alternative inputs consistent with one party's view, together with the assumption that the random masks can be produced with the special structure needed for those infinitely many alternatives to exist.

Editorial extensions

If this is right

  • Two parties with vertically split data can train and run an MLP while each keeps its own inputs private, ending with model parameters held as additive shares.
  • Exact ReLU and softmax mean the secure model's accuracy can track the plaintext model instead of an approximation of it, which the reported Iris and Wine results illustrate.
  • The fixed low round counts (for example 117 rounds for inference on the tested networks) keep WAN runtime competitive even when the total byte volume is high.
  • The verification layer lets a client reject corrupted results, with claimed failure probability below $(1/4^L)^k$ at $L=20$, so detected anomalies are negligible.
  • Reported communication savings of up to $12.3\times$ come from replacing many small messages with fewer larger matrix transfers under the spatial transformation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same splitting trick is likely portable to convolutions and attention, since those are batched matrix products, but the paper does not analyze either extension.
  • The security proofs invoke rank-deficient masks at the step where Lemma 1 is used, while the preprocessing pseudocode says only 'generate random matrix'; an implementation must decide how to sample such masks, because uniform real matrices are full rank with probability one.
  • If round count is indeed the dominant cost in WAN settings, the framework's advantage should persist in real cross-institution deployments, a setting the paper lists as future work.
  • A clean test of the claimed accuracy advantage would run the same models in plaintext with exact activations against fixed-point approximations, isolating whether the gain comes from the secure layer or from the activation function itself.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes EVA-S2PMLP, a two-party protocol suite for privacy-preserving training and inference of multi-layer perceptrons over vertically partitioned data. The framework uses a commodity server that pre-distributes random masks and a stack of primitives: secure two-party matrix multiplication (S2PM), row inner product (S2PRIP), Hadamard product (S2PHP), ReLU derivative (S2PDRL), ReLU (S2PRL), reciprocal (S2PSCR), softmax (S2PSM), gradient computation (S2PG-MLP), and end-to-end training/inference protocols S2PMLP-TR and S2PMLP-PR. The claimed contributions are exact real-number arithmetic, verifiable correctness with negligible failure probability, and communication efficiency, with experiments reporting up to 12.3x improvement over baselines.

Significance. Had the protocols been correct, the framework would be significant: it promises exact ReLU and softmax in a two-party setting, low round counts, and empirical accuracy close to plaintext MLP. The paper also provides extensive comparisons against CrypTen, FATE, SecretFlow, and other frameworks, together with detailed complexity tables. However, the central correctness claim fails already at the base S2PM/S2PRIP primitives, and the security definition and proofs are not sound. The significance of the proposed approach therefore cannot be realized in the current form.

major comments (5)
  1. [Section 4.1 and Appendix A.1 (Algorithms 2, 18)] The claimed share-sum relation is algebraically false. With Ahat = A + R_A, Bhat = B + R_B, and F_A + F_B = R_A * R_B, the online phase of S2PM yields Y_A + Y_B = R_A * R_B + A * Bhat = A * B + Ahat * R_B, not A * B. The analogous identity with the row inner product holds for S2PRIP. The residual term Ahat * R_B is generically nonzero, and no constraint in Algorithms 17 or 1 prevents it. Consequently, the correctness proofs of every higher protocol that invokes S2PM or S2PRIP (S2PHP, S2PDRL, S2PRL, S2PSCR, S2PSM, S2PG-MLP, S2PMLP-TR, S2PMLP-PR) are invalid.
  2. [Appendix A.1 and Section 4.1 (Algorithms 19 and 3)] The verification stages check a relation that holds identically even when the online phase is wrong. From the same definitions, Y'_A + Y'_B = (Y_A + R_A * Bhat) + (Y_B - Ahat * Bhat) = Y_A + Y_B + R_A * Bhat - Ahat * Bhat. Substituting Y_A + Y_B = A * B + Ahat * R_B gives Y'_A + Y'_B = R_A * R_B = C0. Therefore Y'_A + Y'_B - C0 = 0 regardless of the correctness failure, so Algorithm 19 and the analogous S2PRIP verification always accept. The claimed failure probability of (1/4)^L is not established and is contradicted by the tautological nature of the check.
  3. [Section 4.4.1 (Algorithm 7)] The correctness derivation for S2PHP is also internally wrong. For u_i* formed by c repetitions of u_i and v_i* formed by row-major concatenation of c randomly selected permutations of v_i, the diagonal entry of P_A * P_B equals a_i * b_i only if the selected permutations place each beta_k exactly once in each column of the c x c matrix W_i. The protocol selects c permutations uniformly at random from c! possibilities and does not enforce this Latin-square condition; for c > 2 it generically fails. Thus even if S2PM were repaired, S2PHP would not compute the Hadamard product as claimed.
  4. [Section 3.2, Definition 5, and Theorems 4-10] Definition 5 is not a secure-computation definition. The property that infinitely many alternative real inputs are consistent with a transcript holds for essentially any continuous input distribution and does not imply computational indistinguishability, nor does it bound the posterior information available to an adversary. The simulation proofs invoke Lemma 1 with rank-deficient R_A and R_B, but random real matrices are full rank with probability one, and the paper provides no mechanism by which the commodity server can generate rank-deficient masks in a privacy-preserving way. The security claims of Theorem 4 and the subsequent theorems are therefore unsupported.
  5. [Sections 5.1 and 5.2] The correctness theorems for S2PMLP-TR and S2PMLP-PR reduce directly to the correctness of S2PHM, S2PRL, S2PDRL, and S2PSM. Since all of those primitives depend on the broken S2PM/S2PRIP base layer, the end-to-end training and inference claims are unsupported. The reported near-plaintext accuracy is not evidence of correctness, because the described protocols do not compute the stated functions.
minor comments (4)
  1. [General presentation] The text contains numerous typos and OCR artifacts, including 'EV A-S2PMLP', 'so/f_tmax', 'BoB', and the repeated 'D/e.sc/f.sc/i.sc/n.sc/i.sc/t.sc/i.sc/o.sc/n.sc' sequences in Section 3.2; these should be cleaned up.
  2. [Tables 2 and 3] The communication round counts in Table 3 differ from the theoretical values in Table 2 (e.g., S2PHP is listed as 6 rounds in Table 2 and 6 in Table 3, but S2PRL is 8 vs 10 and S2PSM is 37 vs 47). The paper states this is due to precision optimization but does not describe the optimized algorithms, making the experimental setup not fully reproducible.
  3. [Section 4.2] The security analysis of S2PDRL says the result is public and only reveals r * s * (A + B), but the protocol actually gives both parties the values needed to compute r * s * (A + B). The proof should account for this masked-sum leakage explicitly rather than treating the result as simply relu'(A + B).
  4. [Failure probability analyses] The repeated claim that the overall failure probability is the product of sub-protocol failure probabilities assumes independence of the verification checks; no justification for this independence is given, and the verification checks are deterministic functions of the same transcript.

Circularity Check

3 steps flagged · score 8.0 of 10

Base-primitive correctness is assumed rather than derived: the S2PRIP proof drops the residual Ahat×R_B, the verification check vanishes identically by construction, and S2PM/S2PHM are inherited from the authors' own EVA-S3PC.

  1. self definitional [Appendix A.1, Algorithms 17-19 (and the analogous S2PRIP verification in Section 4.1)]
    "Y'_F = Y_F − hatA × hatB; T = F_F − Y'_F; Y_E = T + F_E − (R_E × hatB); Y'_E = Y_E + R_E × hatB; C0 = R_E × R_F; C = (Y'_E + Y'_F − C0) × v̂"

    Substituting the Algorithm 18 assignments into the Algorithm 19 check gives Y'_E + Y'_F − C0 = (T + F_E − R_E×hatB + R_E×hatB) + (Y_F − hatA×hatB) − C0 = T + F_E + Y_F − hatA×hatB − C0 = (F_F − Y'_F) + F_E + Y_F − hatA×hatB − C0 = F_E + F_F − C0 = 0. The checked quantity is therefore an identity under the protocol's own definitions, independent of whether Y_E + Y_F = A×B. Algorithm 19 always accepts, so the claimed failure probability 1/4^L is vacuous and the verification cannot support the protocol's correctness claim.

  2. other [Section 4.1, correctness derivation after Algorithm 2 (S2PRIP)]
    "Y_E + Y_F = [( Â⊛ B̂+( F_E − Y_F)) + F_E − ( R_E⊛ B̂)] + Y_F = [A⊛B − Y_F + ( F_E + F_F − R_E⊛R_F)] + Y_F = A⊛B."

    In Algorithm 2, Y_E is defined as T + F_E − (R_E⊛B̂), with T = F_F − Y'_F and Y'_F = Y_F − Â⊛B̂, giving Y_E = F_F − Y_F + Â⊛B̂ + F_E − R_E⊛B̂. The displayed proof instead substitutes a different expression for Y_E and then jumps from Â⊛B̂ to A⊛B while treating F_E + F_F − R_E⊛R_F as zero. But Â⊛B̂ = (A + R_E)⊛(B + R_F) = A⊛B + A⊛R_F + R_E⊛B̂, so the residual A⊛R_F + R_E⊛R_F is silently dropped. No protocol step forces that residual to vanish; for random real masks it is nonzero with probability one. Thus the proof assumes the very equality it purports to derive.

1 more flagged steps
  1. self citation load bearing [Section 2.1 and Appendix A]
    "S2PM and S3PM are the foundational linear computation protocols within our framework, from which all other sub-protocols can be derived. ... A ALGORITHMS OF EVA-S3PC This section introduces the S2PM and S2PHM protocols in EVA-S3PC[43]."

    Every higher-level protocol in the paper — S2PHP, S2PDRL, S2PRL, S2PHHP, S2PSCR, S2PSM, S2PG-MLP, S2PMLP-TR, and S2PMLP-PR — invokes S2PM, S2PRIP, or S2PHM as a black-box primitive. The paper gives no independent correctness proof for S2PM in this manuscript; it imports the primitive and its guarantees from reference [43], a prior paper by overlapping authors. Since the algebraic correctness of S2PM is exactly the load-bearing assumption on which all subsequent protocol claims rest, and the only self-contained correctness derivation in Section 4.1 is the circular/erroneous one above, the MLP stack is not independently justified.

full rationale

The experimental sections are not circular: accuracy and runtime are benchmarked against external frameworks (CrypTen, FATE, SecretFlow, LibOTe, and others) with fixed datasets, so the empirical claims have independent content. The circularity is concentrated in the theoretical derivation chain. Section 4.1's correctness derivation of S2PRIP silently replaces Â⊛B̂ by A⊛B, dropping the generically nonzero term A⊛R_F + R_E⊛R_F, so the proof assumes the equality it must establish. The verification algorithm checks a quantity that is identically zero from the protocol's own definitions, so it always accepts and cannot detect any anomaly. Finally, the foundational S2PM/S2PHM primitives are imported from the authors' prior EVA-S3PC paper without an independent proof, and every higher-level protocol invokes them; the single self-contained correctness argument is the circular one above. This makes the central claim that EVA-S2PMLP computes accurate and verifiable two-party MLP depend on a self-citation chain plus by-construction identities, so the circularity score is high. The non-standard real-number security model (Definition 5) and the rank-deficiency assumption in the simulation proofs are additional correctness risks but are not themselves circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The protocol introduces masks, split vectors, permutation matrices, and verification constants, but these are standard protocol objects rather than new physical or mathematical entities. No new particles, forces, or conserved quantities are postulated. The non-standard security model and rank-deficient mask construction are the main uncharged assumptions.

free parameters (2)
  • splitting parameter c = 2
    Protocol parameter controlling how finely each scalar is split into shares. The paper sets c=2 to balance communication and precision, and the complexity expressions depend on c. It is chosen by hand, not fitted to data.
  • verification rounds L = 20
    Number of verification rounds used to claim negligible failure probability (1/4)^L. The paper selects L=20 in Section 4 and also considers L=10 in Section 7.3. It is a hand-chosen security parameter.
assumptions (4)
  • domain assumption Semi-honest commodity server CS generates masks offline and never colludes with Alice or Bob.
    Preprocessing in Algorithms 1 and 17 assumes CS is trusted to generate randomness and that parties cannot see the other party's masks. The paper does not analyze collusion or malicious CS behavior.
  • ad hoc to paper A protocol over the real-number field is secure if infinitely many alternative inputs are consistent with the transcript.
    Definition 5 in Section 3.2 introduces this criterion and all security theorems, including Theorem 4, rely on it. It is not a standard cryptographic security definition and is not shown to imply computational indistinguishability.
  • ad hoc to paper Masks can be generated with prescribed rank deficiency, e.g., rank(M_A) = min(B,p) - 1.
    Algorithm 17 in Appendix A.1 imposes this rank condition so that Lemma 1 gives infinitely many solutions. Over continuous real distributions, random matrices are full rank with probability one, so this is a special construction the paper does not justify.
  • standard math Lemma 1: a consistent linear system with rank of augmented matrix less than the number of unknowns has infinitely many solutions.
    This standard linear algebra fact is used in Theorem 4 to argue that simulated masks are indistinguishable. The lemma itself is correct.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EVA-S2PMLP: Secure and Scalable Two-Party MLP via Spatial Transformation." pith.science (2026). https://pith.science/paper/GWBRH7WK

@misc{pith2026250615102,
  author       = {Pith},
  title        = {Pith review of: EVA-S2PMLP: Secure and Scalable Two-Party MLP via Spatial Transformation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GWBRH7WK}},
  note         = {Machine review of arXiv:2506.15102}
}
abstract

Privacy-preserving neural network training in vertically partitioned scenarios is vital for secure collaborative modeling across institutions. This paper presents \textbf{EVA-S2PMLP}, an Efficient, Verifiable, and Accurate Secure Two-Party Multi-Layer Perceptron framework that introduces spatial-scale optimization for enhanced privacy and performance. To enable reliable computation under real-number domain, EVA-S2PMLP proposes a secure transformation pipeline that maps scalar inputs to vector and matrix spaces while preserving correctness. The framework includes a suite of atomic protocols for linear and non-linear secure computations, with modular support for secure activation, matrix-vector operations, and loss evaluation. Theoretical analysis confirms the reliability, security, and asymptotic complexity of each protocol. Extensive experiments show that EVA-S2PMLP achieves high inference accuracy and significantly reduced communication overhead, with up to $12.3\times$ improvement over baselines. Evaluation on benchmark datasets demonstrates that the framework maintains model utility while ensuring strict data confidentiality, making it a practical solution for privacy-preserving neural network training in finance, healthcare, and cross-organizational AI applications.

Figures

Figures reproduced from arXiv: 2506.15102 by the authors.

Figure 1
Figure 1. System architecture of the EVA-S2PMLP frame [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Communication overhead comparison between [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗
Figure 3
Figure 3. Total execution time comparison (LAN) between [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: Verification time ratio of basic protocols in EVA [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: Performance of S2PHP and S2PSCR with large in [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: Precision comparison of EVA-S2PMLP basic proto [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Time Breakdown of S2PMLP-TR and S2PMLP-PR [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 40 canonical work pages

  1. [1]

    Secureml: A system for scalable privacy- preserving machine learning

    Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy- preserving machine learning. In 2017 IEEE symposium on security and privacy (SP), pages 19–38. IEEE, 2017

    work page 2017

  2. [2]

    Aby3: A mixed protocol framework for ma- chine learning

    Payman Mohassel and Peter Rindal. Aby3: A mixed protocol framework for ma- chine learning. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security , pages 35–52, 2018

    work page 2018

  3. [3]

    Secure nn: 3-party secure computation for neural network training

    Sameer Wagh, Divya Gupta, and Nishanth Chandran. Secure nn: 3-party secure computation for neural network training. Proceedings on Privacy Enhancing Technologies, 2019

    work page 2019

  4. [4]

    Falcon: Honest-majority maliciously se cure framework for private deep learning

    Sameer Wagh, Shruti Tople, Fabrice Benhamouda, Eyal Kus hilevitz, Prateek Mit- tal, and Tal Rabin. Falcon: Honest-majority maliciously se cure framework for private deep learning. arXiv preprint arXiv:2004.02229 , 2020

    arXiv 2004

  5. [5]

    Blaze: Blazing fast priva cy-preserving machine learning

    Arpita Patra and Ajith Suresh. Blaze: Blazing fast priva cy-preserving machine learning. In Proceedings 2020 Network and Distributed System Security Sy mpo- sium, San Diego, CA, 2020. Internet Society

    work page 2020

  6. [6]

    Private mac hine learning in tensorflow using secure computation

    Morten Dahl, Jason Mancuso, Yann Dupis, Ben Decoste, Mor gan Giraud, Ian Livingstone, Justin Patriquin, and Gavin Uhma. Private mac hine learning in tensorflow using secure computation. arXiv preprint arXiv:1810.08130 , 2018

    arXiv 2018

  7. [7]

    Ezpc: Programmable and efficient secure two-party computation for machine learning

    Nishanth Chandran, Divya Gupta, Aseem Rastogi, Rahul Sh arma, and Shardul Tripathi. Ezpc: Programmable and efficient secure two-party computation for machine learning. In 2019 IEEE european symposium on security and privacy (EuroS&P), page 496–511. IEEE, 2019. Citation Key: chandran2019ezpc

    work page 2019

  8. [8]

    Crypten: Secure multi- party computa- tion meets machine learning

    Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho S engupta, Mark Ibrahim, and Laurens van der Maaten. Crypten: Secure multi- party computa- tion meets machine learning. Advances in Neural Information Processing Systems, 34:4961–4973, 2021

    work page 2021

Show all 43 references
  1. [9]

    In 2023 USENIX Annual Technical Conference (USENIX ATC 23), pages 17–33, 2023

    Junming Ma, Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi W u, Wenjing Fang, Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang.{SecretFlow-SPU}: A perfor- mant and{User-Friendly} framework for{Privacy-Preserving} machine learn- ing. In 2023 USENIX Annual Technical Conference (USENI...

    2023

  2. [10]

    Flash: Fast and robust framework for privacy-preserving machine learning

    Megha Byali, Harsh Chaudhari, Arpita Patra, and Ajith S uresh. Flash: Fast and robust framework for privacy-preserving machine learning . Proceedings on Pri- vacy Enhancing Technologies, 2020. Citation Key: byali2020flash

    2020

  3. [11]

    T rident: Efficient 4pc framework for privacy preserving machine learning

    Sai Rahul Rachuri, Ajith Suresh, and Harsh Chaudhari. T rident: Efficient 4pc framework for privacy preserving machine learning. In Network and distributed system security symposium , page 1–18. Internet Society, 2020. Citation Key: rachuri2020trident

    2020

  4. [12]

    SWIFT: Super-fast and robust Privacy-Preserving machine learning

    Nishat Koti, Mahak Pancholi, Arpita Patra, and Ajith Su resh. SWIFT: Super-fast and robust Privacy-Preserving machine learning. In 30th USENIX security sym- posium (USENIX security 21), page 2651–2668, 2021. Citation Key: koti2021swift

    2021

  5. [13]

    Mp-spdz: A versatile framework for mult i-party computation

    Marcel Keller. Mp-spdz: A versatile framework for mult i-party computation. In Proceedings of the 2020 ACM SIGSAC conference on computer andcommunications security, pages 1575–1590, 2020

    2020

  6. [14]

    Fate: An indus- trial grade platform for collaborative learning with data p rotection

    Yang Liu, Tao Fan, Tianjian Chen, Qian Xu, and Qiang Yang . Fate: An indus- trial grade platform for collaborative learning with data p rotection. Journal of Machine Learning Research , 22(226):1–6, 2021

    2021

  7. [15]

    PySyft: A Library for Easy Federated Learning , page 111–139

    Alexander Ziller, Andrew Trask, Antonio Lopardo, Benj amin Szymkow, Bobby Wagner, Emma Bluemke, Jean-Mickael Nounahon, Jonathan Passerat-Palmbach, Kritika Prakash, Nick Rose, Théo Ryffel, Zarreen Naowal Reza , and Georgios Kaissis. PySyft: A Library for Easy Federated Learning ...

    2021

  8. [16]

    Tenseal: A library for encrypted tensor operations using ho momorphic encryp- tion

    Ayoub Benaissa, Bilal Retiat, Bogdan Cebere, and Alaa E ddine Belfedhal. Tenseal: A library for encrypted tensor operations using ho momorphic encryp- tion. arXiv preprint arXiv:2104.03152 , 2021

    2021 arXiv

  9. [17]

    Pen cil: Private and extensible collaborative learning without the non-collud ing assumption

    Xuanqi Liu, Zhuotao Liu, Qi Li, Ke Xu, and Mingwei Xu. Pen cil: Private and extensible collaborative learning without the non-collud ing assumption. arXiv preprint arXiv:2403.11166, 2024

    2024 arXiv

  10. [18]

    Privacy-preserving cooperative statisti- cal analysis

    Wenliang Du and Mikhail J Atallah. Privacy-preserving cooperative statisti- cal analysis. In Seventeenth Annual Computer Security Applications Confer ence, pages 102–110. IEEE, 2001

    2001

  11. [19]

    Sharemind: A framework for fast privacy-preserving computations

    Dan Bogdanov, Sven Laur, and Jan Willemson. Sharemind: A framework for fast privacy-preserving computations. In Computer Security-ESORICS 2008: 13th European Symposium on Research in Computer Security, Málag a, Spain, October 6-8, 2008. Proceedings 13 , pages 192–206. Springer, 2008

    2008

  12. [20]

    Motion–a framework for mixed-protocol multi-party computation

    Lennart Braun, Daniel Demmler, Thomas Schneider, and O leksandr Tkachenko. Motion–a framework for mixed-protocol multi-party computation. ACM Trans- actions on Privacy and Security , 25(2):1–35, 2022

    2022

  13. [21]

    Cryptg pu: Fast privacy- preserving machine learning on the gpu

    Sijun Tan, Brian Knott, Yuan Tian, and David J Wu. Cryptg pu: Fast privacy- preserving machine learning on the gpu. In 2021 IEEE Symposium on Security and Privacy (SP), pages 1021–1038. IEEE, 2021

    2021

  14. [22]

    Simple, secure, internet delivery of moose-based applications

    Jason Mathew Miller, Logan H Harbour, Robert W Carlsen, Andrew E Slaughter, Brandon Samuel Biggs Jr, and Cody J Permann. Simple, secure, internet delivery of moose-based applications. Technical report, Idaho Nati onal Lab.(INL), Idaho Falls, ID (United States), 2021

    2021

  15. [23]

    High-throughput secure three-party computation for malicious adversaries and an honest major- ity

    Jun Furukawa, Yehuda Lindell, Ariel Nof, and Or Weinste in. High-throughput secure three-party computation for malicious adversaries and an honest major- ity. In Annual international conference on the theory and applicat ions of crypto- graphic techniques, pages 225–255. Sprin...

    2017

  16. [24]

    Efficient an d secure multi- party computation from fixed-key block ciphers

    Chun Guo, Jonathan Katz, Xiao Wang, and Yu Yu. Efficient an d secure multi- party computation from fixed-key block ciphers. In 2020 IEEE Symposium on Security and Privacy (SP) , pages 825–841. IEEE, 2020

    2020

  17. [25]

    Sadegh Riazi, and Farinaz Kous hanfar

    Bita Darvish Rouhani, M. Sadegh Riazi, and Farinaz Kous hanfar. Deepsecure: scalable provably-secure deep learning. In Proceedings of the 55th Annual Design Automation Conference, DAC ’18, pages 1–6, New York, NY, USA, 2018. Associ- ation for Computing Machinery

    2018

  18. [26]

    Improved ga rbled circuit: Free xor gates and applications

    Vladimir Kolesnikov and Thomas Schneider. Improved ga rbled circuit: Free xor gates and applications. In Automata, Languages and Programming: 35th Interna- tional Colloquium, ICALP 2008, Reykjavik, Iceland, July 7- 11, 2008, Proceedings, Part II 35, pages 486–498. Springer, 2008

    2008

  19. [27]

    libOTe: an efficient, portable, a nd easy to use Oblivious Transfer Library

    Lance Roy Peter Rindal. libOTe: an efficient, portable, a nd easy to use Oblivious Transfer Library. https://github.com/osu-crypto/libOT e, 2016

    2016

  20. [28]

    Over drive: Making spdz great again

    Marcel Keller, Valerio Pastro, and Dragos Rotaru. Over drive: Making spdz great again. In Annual International Conference on the Theory and Applications of Cryp- tographic Techniques, pages 158–189. Springer, 2018

    2018

  21. [29]

    Using to pgear in overdrive: a more efficient zkpok for spdz

    Carsten Baum, Daniele Cozzo, and Nigel P Smart. Using to pgear in overdrive: a more efficient zkpok for spdz. In International Conference on Selected Areas in Cryptography, pages 274–302. Springer, 2019

    2019

  22. [30]

    Delphi: A cryptographic inference system for neural networks

    Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasa n, Wenting Zheng, and Raluca Ada Popa. Delphi: A cryptographic inference system for neural networks. In Proceedings of the 2020 Workshop on Privacy-Preserving Machin e Learning in Practice, pages 27–30, 2020

    2020

  23. [31]

    Privacy-preserving ridge regression on hund reds of millions of records

    Valeria Nikolaenko, Udi Weinsberg, Stratis Ioannidis , Marc Joye, Dan Boneh, and Nina Taft. Privacy-preserving ridge regression on hund reds of millions of records. In 2013 IEEE symposium on security and privacy , pages 334–348. IEEE, 2013

    2013

  24. [32]

    Privacy-preserving di stributed linear regression on high-dimensional data

    Adrià Gascón, Phillipp Schoppmann, Borja Balle, Maria na Raykova, Jack Do- erner, Samee Zahur, and David Evans. Privacy-preserving di stributed linear regression on high-dimensional data. Cryptology ePrint Archive, 2016

    2016

  25. [33]

    Privacy-preserving ridge regression with only linearly-h omomorphic encryp- tion

    Irene Giacomelli, Somesh Jha, Marc Joye, C David Page, a nd Kyonghwan Yoon. Privacy-preserving ridge regression with only linearly-h omomorphic encryp- tion. In Applied Cryptography and Network Security: 16th Internati onal Confer- ence, ACNS 2018, Leuven, Belgium, July 2-4, 2...

    2018

  26. [34]

    Secure data exchange: A marketplace in the cloud

    Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Peter R indal, and Mike Rosulek. Secure data exchange: A marketplace in the cloud. In Proceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop, pages 117–128, 2019

    2019

  27. [35]

    Cryptflow2: Prac tical 2-party secure inference

    Deevashwer Rathee, Mayank Rathee, Nishant Kumar, Nish anth Chandran, Di- vya Gupta, Aseem Rastogi, and Rahul Sharma. Cryptflow2: Prac tical 2-party secure inference. In Proceedings of the 2020 ACM SIGSAC Conference on Com- puter and Communications Security , pages 325–342, 2020

    2020

  28. [36]

    A pragmatic introduc- tion to secure multi-party computation

    David Evans, Vladimir Kolesnikov, Mike Rosulek, et al. A pragmatic introduc- tion to secure multi-party computation. Foundations and Trends® in Privacy and Security, 2(2-3):70–246, 2018

    2018

  29. [37]

    Foundations of Cryptography, Volume 2

    Oded Goldreich. Foundations of Cryptography, Volume 2. Cambridge university press Cambridge, 2004

    2004

  30. [38]

    How to simulate it–a tutorial on the sim ulation proof technique

    Yehuda Lindell. How to simulate it–a tutorial on the sim ulation proof technique. Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich, pages 277–346, 2017

    2017

  31. [39]

    Privac y-preserving mul- tivariate statistical analysis: Linear regression and cla ssification

    Wenliang Du, Yunghsiang S Han, and Shigang Chen. Privac y-preserving mul- tivariate statistical analysis: Linear regression and cla ssification. In Proceedings of the 2004 SIAM international conference on data mining , pages 222–233. SIAM, 2004

    2004

  32. [40]

    Thomas S. Shores. Applied Linear Algebra and Matrix Analysis . Undergraduate Texts in Mathematics. Springer International Publishing, Cham, 2018

    2018

  33. [41]

    R. Canetti. Universally composable security: A new par adigm for cryptographic protocols. In Proceedings of the 42nd IEEE Symposium on Foundations of Com- puter Science, FOCS ’01, page 136, USA, 2001. IEEE Computer Society

    2001

  34. [42]

    An introduction to numerical analysis for electri- cal and computer engineers

    Christopher J Zarowski. An introduction to numerical analysis for electri- cal and computer engineers . John Wiley & Sons, 2004. Citation Key: zarowski2004introduction

    2004

  35. [43]

    Eva-s3pc: Efficient, verifiable, accurate secure matrix multiplication proto- col assembly and its application in regression, 2024

    Shizhao Peng, Tianrui Liu, Tianle Tao, Derun Zhao, Hao S heng, and Haogang Zhu. Eva-s3pc: Efficient, verifiable, accurate secure matrix multiplication proto- col assembly and its application in regression, 2024. A ALGORITHMS OF EV A-S3PC This section introduces the S2PM and S2PHM...

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.