Pith. sign in

REVIEW 3 major objections 4 minor 3 cited by

CENTAUR: Bridging the Impossible Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CENTAUR claims that a hybrid of random permutation and secure multi-party computation bridges the "impossible trinity" of privacy, efficiency, and performance in Transformer inference.

desk verdict Real efficiency gains and exact accuracy, but the privacy guarantee is broken by the public-checkpoint attack, so the 'trinity' claim does not hold. read the letter →

arxiv 2412.10652 v2 pith:X2KSVZYD submitted 2024-12-14 cs.LG cs.CR

Jinglong Luo , Guanzhong Chen , Yehong Zhang , Shiyu Liu , Hui Wang , Yue Yu , Xun Zhou , Yuan Qi
show 1 more author
Zenglin Xu
This is my paper · ORCID
classification cs.LGcs.CR
keywords privacy-preservinginferenceTransformerrandompermutationsecretsharingsecuremulti-partycomputationdatareconstructionattackhybridprivacymechanism
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the "impossible trinity" of privacy, efficiency, and performance in privacy-preserving Transformer inference can be bridged by a hybrid scheme: keep model parameters randomly permuted so the cloud never sees the true weights, keep user data in secret shares, and only convert to permuted plaintext for nonlinear operations. The central claim is that intermediate activations in this permuted state resist state-of-the-art data reconstruction attacks about as well as random noise, while inference runs 5.0–30.4 times faster than existing secure-MPC frameworks and matches plaintext accuracy without retraining. If correct, this gives cloud model-as-a-service deployments a practical middle path that hides both proprietary weights and user inputs without sacrificing accuracy or speed.

What carries the argument

The central object is the hybrid state machine: model parameters live as permuted plaintext matrices, while inference data and intermediate values live as secret shares, with a small set of protocols ($\Pi$ScalMul for plaintext–share multiplication, $\Pi$MatMul for shared matrix multiplication, $\Pi$PPP for moving between states, and $\Pi$PPSM, $\Pi$PPGeLU, $\Pi$PPLN for nonlinearities) controlling the transitions. Two mathematical facts carry the argument: multiplying a matrix by a permutation $\pi$ permutes its rows or columns and is orthogonal, so linear layers can absorb the permutation at zero communication cost; and any elementwise nonlinearity $f$ satisfies $f(X\pi)=f(X)\pi$, so nonlinear layers can be computed on reconstructed permuted values. The distance-correlation inequality Eq. (5) is invoked to bound leakage from permuted intermediate results by the leakage of a one-dimensional projection.

What would settle it

Run SIP, embedding-inversion, and BRE attacks on the permuted intermediate results of the first transformer block of BERT-large or GPT-2-large and compare with the paper's random-input control: if any attack recovers more than about 10% ROUGE-L F1 on the permuted state, the central privacy claim fails.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the conflict between SMPC's strong privacy and high cost and permutation-based methods' low cost and weak privacy is not inherent: a carefully choreographed alternation between secret-shared and randomly-permuted states lets each operation run in its cheapest secure form. Linear layers become communication-free multiplications between permuted plaintext weights and shared data; nonlinearities like softmax, GeLU, and LayerNorm run directly on permuted plaintext because permutation commutes with elementwise functions; and a privacy-preserving permutation protocol restores correctness where the permutation would otherwise cancel out. The paper claims this yields plaintext-identical accuracy on BERT and GPT-2, 5–30x faster inference than SMPC baselines, and empirical resistance to SIP, embedding-inversion, and BRE attacks on all four permuted intermediate targets.

Load-bearing premise

The load-bearing premise is that an intermediate result in a randomly permuted state, which the cloud sees in plaintext, provides meaningful privacy for the user's inference data; the paper's own limitations section concedes this is not theoretical security, and the theoretical argument rests on a distance-correlation bound originally derived for random matrices being applied to fixed Transformer weights.

Editorial extensions

If this is right

  • Cloud deployment of BERT- and GPT-2-class models can serve inference with plaintext accuracy and no retraining or distillation, closing the performance gap that forced prior schemes to approximate softmax or GeLU.
  • In wide-area networks the speed advantage grows to 6.3–30.4x for BERT-large and 5.8–28.4x for GPT-2-large, because the scheme cuts communication volume by roughly 2.4–37.6x.
  • The approach transfers to newer architectures without redesign: RMSNorm and SwiGLU are also permutation-equivariant, and the paper reports LLaMA-7B inference under 3 seconds per generated token at 0.39 GB communication in its LAN setup.
  • The privacy guarantee is empirical, not provable: it holds against the specific SIP, embedding-inversion, and BRE attack families tested, and the paper explicitly disavows theoretical security in its limitations section.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test beyond the paper is a known-plaintext attack on the first embedding layer: if an adversary controls one query whose true embedding is known, the effective permutation key space may shrink enough to make partial recovery of the permutation feasible.
  • The same permutation/secret-sharing alternation should generalize to other mostly-linear architectures with permutation-equivariant nonlinearities, such as state-space models or certain diffusion backbones, though the paper only demonstrates Transformer variants.
  • The efficiency numbers assume the cloud is semi-honest and does not collude with the model developer; under collusion the scheme degrades to permutation-only security, so the no-collusion threat model is load-bearing for the deployment story.
  • Because Eq. (5) is applied to deterministic Transformer weights, a re-derivation for fixed matrices would either substantiate or undermine the theoretical privacy bound; the empirical attack results alone cannot arbitrate.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes CENTAUR, a three-party framework for privacy-preserving Transformer inference that combines random permutation of model parameters with secret sharing of inference data. The central claim is that it resolves the "impossible trinity": it allegedly protects both model parameters and user data, achieves plaintext-equivalent accuracy, and is 5.0–30.4 times faster than SMPC-based PPTI baselines on BERT and GPT-2. The efficiency claim is supported by detailed runtime and communication breakdowns across LAN/WAN settings, and the performance claim is supported by exact parity with plaintext inference on GLUE and Wikitext benchmarks. The privacy claim rests on the assertion that randomly permuted intermediate results and permuted model parameters do not leak user inference data, supported by a distance-correlation argument in Appendix B and by data-reconstruction attack experiments in Section 5.2 and Appendix C. The paper's own Limitations section disclaims theoretical security and states that privacy is supported only by empirical attack evaluations.

Significance. If the privacy claim were sound, the efficiency and performance results would be a significant practical contribution: the runtime reductions are large, the performance parity is exact, and the extension to LLaMA-7B shows generality. The efficiency and performance experiments are the paper's genuine strengths, and the DRA evaluation is thoughtfully designed as a benchmark suite. However, the privacy leg of the central claim is not established, and in the paper's own experimental setting it is demonstrably false: the cloud party P1 receives all permuted model parameters in the clear, and for the public BERT/GPT-2 checkpoints used in the experiments, those parameters permit recovery of the permutation. Since privacy is one of the three pillars of the claimed contribution, the paper's central result fails in the setting it evaluates. The significance of the remaining efficiency/performance results does not compensate for the unsupported core claim.

major comments (3)
  1. [Section 4.2 and Appendix C] The cloud platform P1 receives, in the clear, all permuted model parameters WQπ, WKπ, WVπ, WOπ, W1π2, W2π2, and LayerNorm vectors γπ, βπ. The experiments use publicly downloadable BERT and GPT-2 checkpoints. A semi-honest P1 can therefore recover the secret permutation matrices π and π2 by simple column matching: each column of WQπ is, up to fixed-point quantization, a column of the public WQ, so correlating columns identifies the permutation. Once π is known, every permuted intermediate result sent to P1 in the clear—Xπ before GeLU/LayerNorm, O4π, O5π2, O6π—can be un-permuted, reducing the attack to the "W/O" rows of Table 1, which recover 60–100% ROUGE-L on plaintext intermediates. Appendix C's cracking analysis considers only attacks on intermediate activations and never considers key recovery from Θ′ itself. This is a load-bearing omission: the privacy claim in Section 5.2 is invalid in the exact setting the paper evaluates.
  2. [Appendix B, Eq. (5)] The distance-correlation argument applies an inequality from Zheng et al. (2022) that involves an expectation over random weight matrices WA. CENTAUR uses fixed, deterministic pre-trained Transformer weights, so the expectation does not transfer. Even if the inequality did transfer, a bound on distance correlation against a one-dimensional projection is not a demonstrated proxy for resistance to optimization-based and learning-based data reconstruction attacks. The paper's own Limitations section concedes that CENTAUR "cannot directly achieve theoretical security," so the privacy guarantee reduces entirely to the empirical attack experiments; those experiments are undermined by the key-recovery attack described above. This step, not a mere presentation issue, is load-bearing for the stated privacy contribution.
  3. [Section 5.2 and Table 1] The empirical security evaluation compares attacks on permuted intermediates against attacks on random matrices and concludes that CENTAUR's intermediates are "comparable to random inputs." This conclusion presupposes that the attacker does not know the permutation. In the deployment model of Section 4.2, however, P1's own input includes Θ′, and for the public checkpoints used in the experiments the permutation is recoverable from Θ′. The "Rand" control is therefore not the appropriate baseline for the stated threat model. The paper's answer to Q1 is consequently not established for a semi-honest cloud platform, which is precisely the adversary CENTAUR is designed to protect against.
minor comments (4)
  1. [Appendix A] Algorithms 4 and 5 are captioned "Privacy-preserving Embedding (ΠEmbedding)" and "Privacy-preserving Adaptation (ΠAdaptation)", but the text in Section 4.3.2 calls them ΠPPEmbedding and ΠPPAdaptation. Please unify the notation.
  2. [Tables 1 and 3] Table 1 reports "ROUGE-L F1 Score (%)" while Table 3's caption says "RougeL-F%"; Section 5.2 also states that ROUGE-L ranges from 0 to 1 but reports values such as 100.00. Please standardize the metric notation and units across captions, tables, and text.
  3. [Section 4.3.1, Eq. (3)] The bias terms are written inconsistently: Eq. (3) displays +BOπ, +B1π2, and +B2π, while the footnote says biases can be secretly shared and added with ΠAdd. Clarify whether biases are permuted, shared, or both, because this affects the correctness of the permuted-state computations.
  4. [General] The paper does not state whether source code will be released. Given that the privacy claim is contested, releasing the implementation and attack-evaluation code would materially improve reproducibility and would allow independent verification of the efficiency and attack results.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the paper's central claims are supported by external lemmas, measured benchmarks, and attack experiments rather than by self-referential definitions or fitted inputs.

full rationale

The derivation chain is not circular. CENTAUR's efficiency and performance claims are direct benchmark measurements (Figs. 5, 8, 9; Tables 2 and 6), not quantities derived from fitted parameters. The accuracy claim follows from exact arithmetic on the original model but is reported as a measured outcome, not as a prediction manufactured from the framework's own outputs. The privacy claim rests on two independent supports: a simulation-based argument for secret-shared intermediates using standard universal composition from Canetti (2001), and an external distance-correlation bound quoted from Zheng et al. (2022), Eq. (5), applied to permuted intermediates. Neither support is defined in terms of CENTAUR's results, and neither is a self-citation: the cited authors are not the present paper's authors. The data-reconstruction experiments compare CENTAUR's permuted intermediates against plaintext intermediates and random controls; the low ROUGE-L scores are measured outcomes, not guarantees embedded in the attack definitions. The paper contains minor self-citations (SecFormer as a baseline, and SIP/BRE attack implementations from Chen et al. 2024, whose author list overlaps), but these are not load-bearing: the baselines are evaluated independently, and the attack methods are used as external test tools rather than as evidence for the framework's correctness. The Limitations section candidly concedes that the permutation mechanism does not achieve theoretical security, which further indicates that the paper does not treat its central claim as an axiom. The main caveat identified by reviewers—whether the Zheng et al. inequality transfers from random matrices to the fixed deterministic weights used in CENTAUR—is a validity concern about the strength of the privacy argument, not a circularity in the derivation chain.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central contribution rests on standard SMPC primitives, a permutation-based privacy mechanism whose security is asserted empirically, and a cited distance-correlation lemma. No new physical or cryptographic entity is introduced.

free parameters (1)
  • Fixed-point encoding precision and scaling factors = not reported
    The claim of bit-identical performance to plaintext depends on the fixed-point representation used in CrypTen; the paper does not report precision settings, and exact equality with plaintext float metrics is otherwise surprising.
assumptions (5)
  • domain assumption Non-collusion of model developer P0 and cloud platform P1 (semi-honest model)
    Section 4.2: security depends on P0 and P1 not colluding to combine secret shares or link permuted weights with input shares.
  • domain assumption Random permutation of intermediate results prevents data reconstruction
    Section 4.4 and Appendix B: the paper equates low distance correlation and failed DRA attacks with privacy; this is an empirical assumption, not a proof.
  • ad hoc to paper Distance-correlation inequality (Eq. 5) from Zheng et al. 2022 applies to deterministic Transformer weights
    Appendix B uses an expectation over random weight matrices WA to bound leakage, but CENTAUR's weights are fixed; the step from the inequality to a privacy guarantee is not justified.
  • domain assumption Representativeness of the three evaluated data reconstruction attacks
    Section 5.2: the security conclusion is drawn from resistance to SIP, EIA, and BRE; no argument covers all practical attackers.
  • domain assumption Fixed-point secure computation preserves plaintext model outputs exactly
    Section 5.4 and Table 2: exact equality with plaintext metrics requires approximation errors below metric resolution; not demonstrated for all layers.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CENTAUR: Bridging the Impossible Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference." pith.science (2026). https://pith.science/paper/X2KSVZYD

@misc{pith2026241210652,
  author       = {Pith},
  title        = {Pith review of: CENTAUR: Bridging the Impossible Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X2KSVZYD}},
  note         = {Machine review of arXiv:2412.10652}
}
read the original abstract

With the growing deployment of pre-trained models like Transformers on cloud platforms, privacy concerns about model parameters and inference data are intensifying. Existing Privacy-Preserving Transformer Inference (PPTI) frameworks face the "impossible trinity" of balancing privacy, efficiency, and performance: Secure Multi-Party Computation (SMPC)-based approaches ensure strong privacy but suffer from high computational overhead and performance losses; Conversely, permutation-based methods achieve near-plaintext efficiency and accuracy but compromise privacy by exposing sensitive model parameters and intermediate results. Bridging this gap with a single approach presents substantial challenges, motivating the introduction of CENTAUR, a groundbreaking PPTI framework that seamlessly integrates random permutations and SMPC to address the "impossible trinity". By designing efficient PPTI algorithms tailored to the structural properties of Transformer models, CENTAUR achieves an unprecedented balance among privacy, efficiency, and performance. Our experiments demonstrate CENTAUR's ability to resist diverse data reconstruction attacks, achieve plaintext-level inference accuracy, and boost inference speed by 5.0-30.4 times, unlocking new possibilities for secure and efficient AI deployment.

Figures

Figures reproduced from arXiv: 2412.10652 by the authors.

Figure 1
Figure 1. Overview of CENTAUR and Other PPTI Frameworks. petitive edge—along with potentially sensitive in￾ference data, which could include personal infor￾mation (e.g., identity, investment plans, or health records). These risks not only threaten the compet￾itiveness of companies but also compromise indi￾viduals’ privacy, raising concerns about whether cloud-based AI models can truly be trusted with sensitive information. Re… view at source ↗
Figure 2
Figure 2. Two examples of recovering private inference [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. High-level Workflow of CENTAUR. Preserving Inference, detailed as follows. Initialization. The model developer P0 generates a set of random permutation matrices, Π = {π ∈ R d×d , π1 ∈ R n×n , π2 ∈ R k×k}, where n denotes the input length, d represents the feature dimension, and k corresponds to the intermediate dimension in the feed-forward neural network. These matri￾ces are designed to permute the model parameters… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Implementation of CENTAUR-based PPTI. Red lines and boxes indicate that there is a communi￾cation overhead for the computation of this step. Black lines indicate completion of the calculation for that step without communication overhead. plaintexts and random shares (d…
Figure 5
Figure 5. Figure 5: Time breakdown for each operations (left) and the entire PPTI process (right) of the tested frameworks. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: An example of recovering private inference input data through [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: The correlation between the proportion of [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Communication volume for each operations (left) and the entire PPTI process (right) of the tested [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Time breakdown for BERTBASE and GPT-2BASE. The results are the average of ten runs. by 10.2 and 11.2 times on the BERT series models. However, for the GPT-2 series models, the reduc￾tions are significantly higher, at 448.3 and 698.7 times. This is due to the different …

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMs

    cs.CR 2025-05 conditional novelty 8.0 of 10

    A sequential vocabulary-search attack decodes original prompts from unpermuted and permuted LLM hidden states, compromising PermLLM, STIP, and Centaur.

  2. Cascade: Token-Sharded Private LLM Inference

    cs.LG 2025-07 conditional novelty 6.0 of 10

    Cascade performs LLM inference by sharding the token sequence across non-colluding nodes, claiming resistance to vocabulary-matching and learning-based reconstruction attacks while being orders of magnitude faster than SMPC.

  3. Mechanistic Interpretability in the Presence of Architectural Obfuscation

    cs.CR 2025-06 reject novelty 4.0 of 10

    Token-permutation obfuscation preserves GPT-2-small's performance on an indirect-object task but makes head-level logit attribution and prompt reconstruction noisier, according to a from-scratch experiment with an unc...

Reference graph

Works this paper leans on

40 extracted references · 27 canonical work pages · cited by 3 Pith papers

  1. [1]

    URL: " 'urlintro :=

    ENTRY address author booktitle chapter edition editor howpublished institution journal key month note number organization pages publisher school series title type volume year eprint doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRINGS urlintro eprinturl eprintpr...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Bassin and Maxim Buzdalov

    Anton O. Bassin and Maxim Buzdalov. 2020. The (1 + ( \( \) , \( \) )) genetic algorithm for permutations. In GECCO '20: Genetic and Evolutionary Computation Conference, Companion Volume , pages 1669--1677. ACM

    work page 2020

  4. [4]

    Donald Beaver. 1992. Efficient multiparty protocols using circuit randomization. In Advances in Cryptology—CRYPTO’91: Proceedings 11, pages 420--432. Springer

    work page 1992

  5. [5]

    Ran Canetti. 2001. Universally composable security: A new paradigm for cryptographic protocols. In Proceedings of the 42nd IEEE Symposium on Foundations of Computer Science, pages 136--145. IEEE

    work page 2001

  6. [6]

    Guanzhong Chen, Zhenghan Qin, Mingxin Yang, Yajie Zhou, Tao Fan, Tianyu Du, and Zenglin Xu. 2024. Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS '24, page 2904–2918

    work page 2024

  7. [7]

    Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. 2022. THE-X : Privacy-preserving transformer inference with homomorphic encryption. In Findings of the Association for Computational Linguistics, pages 3510--3520

    work page 2022

  8. [8]

    Jacob Devlin, Ming - Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT : Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics, pages 4171--4186

    work page 2019

Show all 40 references
  1. [9]

    Yuanchao Ding, Hua Guo, Yewei Guan, Weixin Liu, Jiarong Huo, Zhenyu Guan, and Xiyong Zhang. 2023. East: Efficient and accurate secure transformer framework for inference. arXiv preprint arXiv:2308.09923

    2023 arXiv

  2. [10]

    Ye Dong, Wen-jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Cheng. 2023. PUMA : Secure inference of LLaMA-7B in five minutes. arXiv preprint arXiv:2307.12533

    2023

  3. [11]

    Oded Goldreich, Silvio Micali, and Avi Wigderson. 1987. How to play any mental game or A completeness theorem for protocols with honest majority. In Proceedings of the 19th Annual ACM Symposium on Theory of Computing , pages 218--229. ACM

    1987

  4. [12]

    Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nishanth Chandran, Divya Gupta, Ashish Panwar, and Rahul Sharma. 2023. SIGMA : Secure GPT inference with function secret sharing. Cryptology ePrint Archive, Paper 2023/1269

    2023

  5. [13]

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. 2022. Iron: Private inference on transformers. Advances in Neural Information Processing Systems, 35:15718--15731

    2022

  6. [14]

    Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen jie Lu, Cheng Hong, and Kui Ren. 2023. CipherGPT : Secure two-party GPT inference. Cryptology ePrint Archive, Paper 2023/1147

    2023

  7. [15]

    Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten. 2021. CrypTen : Secure multi-party computation meets machine learning. Advances in Neural Information Processing Systems, 34:4961--4973

    2021

  8. [16]

    Dacheng Li, Rulin Shao, Hongyi Wang, Han Guo, Eric P Xing, and Hao Zhang. 2023. MPCFormer : Fast, performant and private transformer inference with MPC . In Proceedings of the Eleventh International Conference on Learning Representations, ICLR

    2023

  9. [17]

    Zhengyi Li, Kang Yang, Jin Tan, Wen-jie Lu, Haoqi Wu, Xiao Wang, Yu Yu, Derun Zhao, Yancheng Zheng, Minyi Guo, et al. 2024. Nimbus: Secure and efficient two-party inference for transformers. arXiv preprint arXiv:2411.15707

    2024 arXiv

  10. [18]

    Zi Liang, Pinghui Wang, Ruofei Zhang, Nuo Xu, and Shuo Zhang. 2023. MERGE : Fast private text generation. arXiv preprint arXiv:2305.15769

    2023 arXiv

  11. [19]

    Yehuda Lindell. 2017. How to simulate it -- A tutorial on the simulation proof technique. Tutorials on the Foundations of Cryptography, pages 277--346

    2017

  12. [20]

    Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Cheng Hong, Kui Ren, Tao Wei, and WenGuang Chen. 2023. Bumblebee: Secure two-party inference framework for large transformers. Cryptology ePrint Archive

    2023

  13. [21]

    Jinglong Luo, Yehong Zhang, Jiaqi Zhang, Xin Mu, Hui Wang, Yue Yu, and Zenglin Xu. 2024. Secformer: Towards fast and accurate privacy-preserving inference for large language models. arXiv preprint arXiv:2401.00793

    2024 arXiv

  14. [22]

    Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. 2017. Pointer sentinel mixture models. In Proceddings of the 5th International Conference on Learning Representations, ICLR

    2017

  15. [23]

    Stanley RM Oliveira and Osmar R Zaiane. 2004. Privacy-preserving clustering by object similarity-based representation and dimensionality reduction transformation. In Proceedings of the ICDM Workshop on Privacy and Security Aspects of Data Mining, pages 40--46

    2004

  16. [24]

    Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. 2023. BOLT : Privacy-preserving, accurate and efficient inference for transformers. Cryptology ePrint Archive, Paper 2023/1893

    2023

  17. [25]

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9

    2019

  18. [26]

    Lin CY Rouge. 2004. A package for automatic evaluation of summaries. In Proceedings of Workshop on Text Summarization of ACL, Spain, volume 5

    2004

  19. [27]

    Th \'e o Ryffel, Pierre Tholoniat, David Pointcheval, and Francis Bach. 2020. AriaNN : L ow-interaction privacy-preserving deep learning via function secret sharing. Proc. on Privacy Enhancing Technologies, 2022(1):291--316

    2020

  20. [28]

    Liu, and Christopher D

    Abigail See, Peter J. Liu, and Christopher D. Manning. 2017. Get to the point: Summarization with pointer-generator networks. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1073--1083

    2017

  21. [29]

    Adi Shamir. 1979. How to share a secret. Communications of the ACM, 22(11):612--613

    1979

  22. [30]

    Congzheng Song and Ananth Raghunathan. 2020. Information leakage in embedding models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pages 377--390

    2020

  23. [31]

    G \'a bor J Sz \'e kely, Maria L Rizzo, and Nail K Bakirov. 2007. Measuring and testing dependence by correlation of distances

    2007

  24. [32]

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems

    2017

  25. [33]

    Sameer Wagh, Divya Gupta, and Nishanth Chandran. 2019. SecureNN : 3- P arty secure computation for neural network training. Proceedings on Privacy Enhancing Technologies, pages 26--49

    2019

  26. [34]

    Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R. Bowman. 2019. GLUE: A multi-task benchmark and analysis platform for natural language understanding. In 7th International Conference on Learning Representations, ICLR

    2019

  27. [35]

    Yining Wang, Yu-Xiang Wang, and Aarti Singh. 2018. A theoretical analysis of noisy sparse subspace clustering on dimensionality-reduced data. IEEE Transactions on Information Theory, 65(2):685--706

    2018

  28. [36]

    Mu Yuan, Lan Zhang, and Xiang-Yang Li. 2023. Secure transformer inference. arXiv preprint arXiv:2312.00025

    2023 arXiv

  29. [37]

    Wenxuan Zeng, Meng Li, Wenjie Xiong, Wenjie Lu, Jin Tan, Runsheng Wang, and Ru Huang. 2022. MPCViT : Searching for MPC -friendly vision transformer with heterogeneous attention. arXiv preprint arXiv:2211.13955

    2022 arXiv

  30. [38]

    Yuke Zhang, Dake Chen, Souvik Kundu, Chenghao Li, and Peter A Beerel. 2023. SAL-ViT : Towards latency efficient private inference on ViT using selective attention search with a learnable softmax approximation. In Proceedings of the IEEE/CVF International Conference on Computer...

    2023

  31. [39]

    Fei Zheng, Chaochao Chen, Xiaolin Zheng, and Mingjie Zhu. 2022. Towards secure and practical machine learning via secret sharing and random permutation. Knowledge-Based Systems, 245:108609

    2022

  32. [40]

    Mengxin Zheng, Qian Lou, and Lei Jiang. 2023. Primer: Fast private transformer inference on encrypted data. arXiv preprint arXiv:2303.13679

    2023 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.