Pith. sign in

REVIEW 5 major objections 5 minor 4 cited by

Nimbus: Secure and Efficient Two-Party Inference for Transformers

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Pith's one-line read Nimbus claims secure Transformer inference can be 2.7x-4.7x faster with 0.08% accuracy loss.

desk verdict Nimbus is a real step forward in practical 2PC Transformer inference, but the abstract oversells the headline numbers and the crypto parameters need to be spelled out. read the letter →

arxiv 2411.15707 v1 pith:Z6NYOJ2O submitted 2024-11-24 cs.CR cs.AI

classification cs.CRcs.AI
keywords securetwo-partyinferencehomomorphicencryptionTransformerGELUapproximationSoftmaxmatrixmultiplicationprivacy-preservingmachinelearningBERT
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that secure two-party inference for Transformer models can be made practical by attacking both bottlenecks at once: replacing inner-product-style homomorphic matrix multiplication with a client-side outer-product protocol, and replacing high-degree polynomial approximations of GELU and Softmax with low-degree approximations tuned to the model's measured activation distribution. If the claims hold, a client holding private data can query a proprietary Transformer with nearly the plaintext model's accuracy at a fraction of the previous latency. The concrete reported payoff is that BERTbase inference speeds up by 2.7x to 4.7x over the previous state of the art across network settings, with about 60% less communication and an average accuracy loss of 0.08% after light fine-tuning. The trade-off is that the client becomes the computational heavy lifter and is assumed to be a server-grade machine.

What carries the argument

The central object is the client-side outer product (COP) protocol with row-wise encoding, together with distribution-aware polynomial fitting for non-linear functions. In COP, each row of the weight matrix is encoded into a polynomial and encrypted once at setup; the client multiplies each plaintext activation share as a scalar against the ciphertext polynomials and accumulates the partial products, so an entire output row is assembled from outer-product contributions, and a right-shift operation packs several output ciphertexts into one dense polynomial. For non-linear layers, the load-bearing mechanism is a fitting procedure that minimizes $\int_l^h p(x)[f(x)-f'(x)]^2\,dx$ under the empirical density $p(x)$ of the activations, which lets GELU be approximated by a quadratic on a narrow interval and exponential by a cubic on one interval plus a linear tail, enabling the smaller ring $\mathbb{Z}_{2^{32}}$ and a free fused truncation-upcast back to $\mathbb{Z}_{2^{64}}$.

What would settle it

A concrete falsification: instantiate the COP protocol with a stated $(N,q)$ parameter set and compute the accumulated noise after $m=3072$ scalar-polynomial multiplications on a single ciphertext row; if decryption fails, or the modulus $q$ needed to avoid failure forces ciphertexts larger than the paper's reported communication numbers, the central efficiency claim collapses at that security level.

Watch

Extended reading notes

Core claim

The paper's central claim is that the two bottlenecks in secure two-party Transformer inference—homomorphic matrix multiplication in linear layers and secure evaluation of GELU and Softmax—are both removable by rebalancing work and using input statistics. Nimbus has the server encrypt its static weights once in a setup phase; the client then computes each output row through an outer product: scalar multiplications of its plaintext activation shares against the encrypted weight polynomials, accumulated and packed by right shifts into dense ciphertexts. For non-linear layers, Nimbus fits GELU and the exponential in Softmax with low-degree piecewise polynomials whose breakpoints are per-layer tuned by minimizing expected squared error under the empirically measured activation density, and a fused truncation-and-upcast protocol converts between $\mathbb{Z}_{2^{32}}$ and $\mathbb{Z}_{2^{64}}$ rings at no extra communication. The paper reports that on BERTbase this yields 2.7x to 4.7x faster end-to-end secure inference than the state-of-the-art protocol, roughly 60% lower communication, and average accuracy within 0.08% of plaintext inference after light fine-tuning.

Load-bearing premise

The results lean on two load-bearing premises: the lattice-based additive homomorphic encryption built on the ring learning-with-errors (RLWE) problem provides circuit privacy and enough noise budget to sustain up to thousands of scalar-polynomial multiplications per output row without decryption failure or parameter blow-up, and the activation distribution estimated from 512 training tokens is stable enough across layers and test data to make the fixed low-degree polynomial approximations accurate.

Editorial extensions

If this is right

  • If the central claims are correct, secure two-party BERTbase inference becomes 2.7x to 4.7x faster than the previous state-of-the-art protocol across LAN and WAN settings while staying within 0.08% of plaintext accuracy after light fine-tuning.
  • The one-time cost of sending encrypted weights is amortized: the method overtakes the state-of-the-art baseline after roughly three queries and reaches its maximal speedup around forty queries.
  • Linear layers improve by 2.9x to 12.5x and non-linear layers by 2.9x to 4.0x over the state-of-the-art protocol, with linear-layer gains largest in LAN settings where computation dominates latency.
  • Communication per Transformer block falls to about 60% of the state of the art, with linear-layer rounds halved and Softmax and GELU rounds reduced.
  • For sequence lengths 32 and 128, end-to-end speedups of 1.9x to 7.6x are reported across hidden sizes, though the gain drops to 1.2x to 2.1x for sequence length 1 (the generation phase).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A consequence the paper leaves implicit is that the client-side design moves most of the homomorphic work onto the client, so the reported speedups assume a server-class client; a thin client would see smaller gains, and the paper itself notes the client should have comparable CPU and RAM to the server.
  • A testable extension is evaluating the distribution-aware approximations under domain shift, since the polynomials are fitted to 512 training tokens and their accuracy on out-of-distribution or adversarial activations is not measured.
  • The outer-product-with-static-weights idea should carry over to other static-weight architectures such as GPT-style decoders and vision transformers, and to the prefill phase of generative inference; the paper evaluates only BERTbase.
  • A full parameter set with a noise-budget accounting is needed to reproduce the communication/computation trade-off at a stated security level; without it the speedups are relative to a particular implementation rather than a certified property.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Nimbus, a secure two-party inference framework for Transformers. For linear layers, Nimbus introduces a client-side outer-product (COP) protocol with row-wise encoding that moves encrypted weights to the client during a one-time setup, eliminating input communication online and producing compact output ciphertexts. For non-linear layers, the paper fits low-degree piecewise polynomials to GELU and exp using the observed activation distribution, and uses a smaller ring (Z_{2^32}) with a fused truncation/upcast conversion. The paper reports end-to-end speedups of 2.7x-4.7x over BumbleBee for BERTbase at sequence length 128, and an average accuracy loss of 0.08% on the GLUE benchmark (with fine-tuning). It also reports a 60% reduction in communication compared with BumbleBee.

Significance. If the efficiency numbers hold with concrete, secure parameters, the work is a substantial advance for private Transformer inference: the COP protocol questions the standard server-side inner-product paradigm, the distribution-aware approximation is a pragmatic way to reduce non-linear layer costs, and the open-source implementation is a valuable asset for the community. The paper includes detailed complexity analysis and an amortized setup-cost discussion in the appendix. However, the significance is conditional on resolving the missing ciphertext-parameter/noise analysis and on correcting the overstatements in the abstract and introduction regarding accuracy loss and speedup.

major comments (5)
  1. [Section 5 / Appendix C.1 / Algorithm 1] The central efficiency claim rests on the reused RLWE-based HE scheme being instantiated with N=8192, plaintext ring Z_{2^64} for the linear layers, and a ciphertext modulus q that simultaneously meets the target security level and keeps decryption correct after up to m=3072 scalar-polynomial multiplications and additions per output ciphertext (m up to 3072 for Linear_h2). The paper provides no concrete modulus q, no noise-budget analysis, no digit decomposition, and no parameter selection. Without this, the reported latencies and communication totals are not verifiable, and the protocol's correctness (decryption without failure) is not established. This is a load-bearing gap that must be addressed before the efficiency claims can be accepted.
  2. [Appendix C.1, Security Proof of the Matrix Multiplication Protocol] The security proof is only a brief sketch and appears to conflate the client's and server's views. For the corrupted-client case, the relevant property is that the encrypted weights hide W under the HE scheme (standard IND-CPA security), not the circuit-privacy property of the HE scheme, which concerns hiding the function from the decryptor. For the corrupted-server case, the server receives a ciphertext encrypting W*X_c - R; the uniform mask R makes the plaintext uniform, but the simulation must also account for the ciphertext noise distribution, which the sketch does not do. A full simulation-based proof with explicit hybrids is needed.
  3. [Abstract / Section 5.1 / Table 2] The abstract states that 'the average accuracy loss of our approach is 0.08% compared to the non-2PC inference without privacy.' This number is only for Nimbus†, which is fine-tuned to the approximation; without fine-tuning, the average loss is 0.6% (Section 5.1). The abstract and introduction omit this qualification. Moreover, because the fine-tuning adapts the model to the approximate activation functions, the 0.08% figure is not an independent measure of approximation fidelity but rather a measure of the model's ability to compensate for the approximation.
  4. [Abstract / Section 5.2 / Appendix F.1 / F.3] The claimed '2.7x-4.7x end-to-end speedup' excludes the one-time setup cost of transmitting the encrypted weights (180 MB to 720 MB per linear layer per block) and is reported for sequence length 128. Appendix F.1 reports that for sequence length 1 the speedup is only 1.2x-2.1x, and Appendix F.3 shows that the setup cost is amortized only after about 3 queries. The abstract and introduction should qualify the speedup claim by stating the sequence-length regime and by clarifying that the reported online latency excludes the one-time setup.
  5. [Section 4.2 / Table 2 and Appendix C.2] The distribution-aware polynomials are fitted to the activation distribution of the same BERTbase model on the same GLUE benchmark used for evaluation, and the best accuracy is obtained after fine-tuning the model to the approximate activations. This creates a mild circularity: the reported 0.08% loss is not a pure measure of how well the approximation generalizes to unseen data or to other models. The paper should report results on a genuinely held-out distribution or explicitly discuss this limitation and its potential impact on the accuracy claims.
minor comments (5)
  1. [Section 2.2] The notation for rings, e.g., Z2ℓ and AN,2ℓ, is inconsistent with the standard Z_{2^ell} and A_{N,2^ell}; the typesetting makes the exponent and subscript difficult to distinguish. Please use consistent and unambiguous notation throughout.
  2. [Section 4.2, Equation (4)] The exponential approximation is written as exp(x) ≈ 0 for x < T_exp, which is intentionally an approximation in a low-probability region. Please state explicitly that this is an approximation for that region rather than presenting an exact equality, to avoid confusion.
  3. [Appendix E, Equation (8)] The correctness derivation for the truncation-upcast fusion contains a misplaced '=' in the second line and a parenthetical reference ('The third line holds since...') that does not match the displayed equation. The relationship between the generic parameter k in the proof and the concrete B2A width ell' - ell + s should also be clarified.
  4. [Section 5.2, Figure 6] The text reports '4.8×~5.9× faster than Iron and 2.7×~4.7× faster than BumbleBee' but the WAN total latencies (40.96/8.52=4.81 and 23.00/8.52=2.70) give a range of 2.7x-4.8x over BumbleBee; the 4.7x upper bound is slightly inconsistent with the plotted numbers.
  5. [Section 5.3, Table 3] The text says the non-linear communication is '3× less' than BumbleBee, but the ratio for Softmax is 354.26/115.35 ≈ 3.07 and for GELU is 185.13/53.22 ≈ 3.48. Please use the exact ratios or state them as approximately 3x.

Circularity Check

0 steps flagged · score 0.0 of 10

No material circularity: the COP linear-layer protocol is self-contained, and the non-linear approximations are fitted on training data and evaluated on held-out GLUE test data.

full rationale

The paper's main efficiency claims are empirical end-to-end measurements against external baselines (Iron, BumbleBee, BOLT) under specified network settings, so the reported speedups and communication reductions do not reduce to the paper's own assumptions by construction. The COP protocol's complexity analysis in Appendix D is a direct count of communicated ciphertexts and NTT/scalar-polynomial operations, not a re-labeling of the SIP protocol's outputs. The distribution-aware polynomial approximation minimizes an expected-loss objective in Equation (3) using p(x) sampled from GLUE training data, and the accuracy comparison in Table 2 is on held-out GLUE test tasks; the 0.08% accuracy loss is a measured post-fine-tuning result, not a fitted parameter renamed as a prediction. Reuse of the RLWE-based additive HE scheme from BumbleBee and piecewise-polynomial evaluation subprotocols from PUMA/BumbleBee is standard building-block composition; these citations are not invoked as uniqueness theorems, nor do they smuggle in the paper's conclusions. The main substantive gap, the absence of concrete ciphertext moduli and noise-budget analysis for the reused HE scheme, is a security/completeness risk rather than a circularity in the derivation chain.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central efficiency and accuracy claims rest on several fitted quantities: per-depth breakpoints and polynomial coefficients for GELU and Softmax, the empirical activation distribution, and hand-chosen fixed-point scales and rings. None of the fitted values are disclosed in the paper. The security argument assumes the underlying HE scheme has circuit privacy and a sufficient noise budget, and the accuracy claim assumes the activation distribution is stable beyond the fitting sample.

free parameters (5)
  • GELU breakpoints T1, T2 (per layer depth) = not disclosed
    Chosen by search around initial values using BERTbase activation distribution (Section 4.2, Algorithm 4).
  • Exponential breakpoint Texp (per layer depth) = not disclosed
    Searched similarly around -4; affects accuracy and efficiency of Softmax.
  • Piecewise polynomial coefficients b0..b3 = not disclosed
    Fit to minimize expected squared error under p(x) in Eq. (3).
  • Activation distribution p(x) = estimated from 512 training tokens
    Sampled from BERTbase training data; determines the approximation budget (Section 5).
  • Fixed-point scale s and ring size = s=12 and Z32 for non-linear, s=18 and Z64 elsewhere
    Chosen by hand to trade accuracy, overflow, and efficiency (Section 4.3).
assumptions (5)
  • standard math RLWE hardness and correctness of the additive HE scheme from [26]
    Assumed in Section B.1; provides semantic security but is not re-proven.
  • domain assumption The HE scheme provides circuit privacy for the ciphertexts used in the COP protocol
    Invoked in the security proof in Appendix C.1; no concrete parameters or noise analysis are given.
  • domain assumption Semi-honest adversary model
    Section 2.1 assumes passive corruption; protocols are not secure against malicious adversaries.
  • domain assumption Activation distributions are stable across train/test and across model depths
    Section 4.2 and Figure 4; load-bearing for the accuracy of fixed low-degree approximations.
  • domain assumption The input distribution pattern generalizes beyond BERTbase and GLUE
    Not tested on other models or tasks; the paper only reports BERTbase on GLUE.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Nimbus: Secure and Efficient Two-Party Inference for Transformers." pith.science (2026). https://pith.science/paper/Z6NYOJ2O

@misc{pith2026241115707,
  author       = {Pith},
  title        = {Pith review of: Nimbus: Secure and Efficient Two-Party Inference for Transformers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z6NYOJ2O}},
  note         = {Machine review of arXiv:2411.15707}
}
abstract

Transformer models have gained significant attention due to their power in machine learning tasks. Their extensive deployment has raised concerns about the potential leakage of sensitive information during inference. However, when being applied to Transformers, existing approaches based on secure two-party computation (2PC) bring about efficiency limitations in two folds: (1) resource-intensive matrix multiplications in linear layers, and (2) complex non-linear activation functions like $\mathsf{GELU}$ and $\mathsf{Softmax}$. This work presents a new two-party inference framework $\mathsf{Nimbus}$ for Transformer models. For the linear layer, we propose a new 2PC paradigm along with an encoding approach to securely compute matrix multiplications based on an outer-product insight, which achieves $2.9\times \sim 12.5\times$ performance improvements compared to the state-of-the-art (SOTA) protocol. For the non-linear layer, through a new observation of utilizing the input distribution, we propose an approach of low-degree polynomial approximation for $\mathsf{GELU}$ and $\mathsf{Softmax}$, which improves the performance of the SOTA polynomial approximation by $2.9\times \sim 4.0\times$, where the average accuracy loss of our approach is 0.08\% compared to the non-2PC inference without privacy. Compared with the SOTA two-party inference, $\mathsf{Nimbus}$ improves the end-to-end performance of \bert{} inference by $2.7\times \sim 4.7\times$ across different network settings.

Figures

Figures reproduced from arXiv: 2411.15707 by the authors.

Figure 1
Figure 1. An example of the window encoding of the matrix multiplication using N = 16 and ℓ = 5. Some of coefficients of polynomial zˆ = ˆx · wˆ ∈ AN,2 ℓ gives the result of matrix multiplication Z = X · W ∈ Z k×n 2 ℓ , as illustrated in [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 3
Figure 3. Illustration of our matrix multiplication. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. The input distribution of non-linear functions. The y-axis indicates the occurrence counts. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (8 more)
Figure 5
Figure 5. Figure 5: The L2-Norm of output error between oracle non-linear functions and approximations. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: The end-to-end latency of a Transformer block of BERT [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: The illustration of the Transformer-based model and the latency breakdown of its private [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Under sequence length 1, the end-to-end speedup and breakdown of varying hidden [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]
Figure 9
Figure 9. Figure 9: Under sequence length 32, the end-to-end speedup and breakdown of varying hidden [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Under sequence length 128, the end-to-end speedup and breakdown of varying hidden [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]
Figure 11
Figure 11. Figure 11: Under different sequence lengths and hidden sizes, we present comprehensive experiments [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]
Figure 12
Figure 12. Figure 12: The execution+setup speedup over BumbleBee under different queries. F.3 Amortized Overhead of the encrypted weights. Our linear protocol replaces the input communication with a one-time setup communication of sending encrypted weights. Although our method focuses on t…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMs

    cs.CR 2025-05 conditional novelty 8.0 of 10

    A sequential vocabulary-search attack decodes original prompts from unpermuted and permuted LLM hidden states, compromising PermLLM, STIP, and Centaur.

  2. Cascade: Token-Sharded Private LLM Inference

    cs.LG 2025-07 conditional novelty 6.0 of 10

    Cascade performs LLM inference by sharding the token sequence across non-colluding nodes, claiming resistance to vocabulary-matching and learning-based reconstruction attacks while being orders of magnitude faster than SMPC.

  3. An Efficient Private GPT Never Autoregressively Decodes

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Applying speculative decoding to secure two-party GPT inference, with a latency-insensitive multi-token forward and optimized private sampling, gives 2.1x to 6.0x speedups without changing the output distribution.

  4. CENTAUR: Bridging the Impossible Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference

    cs.LG 2024-12 conditional novelty 6.0 of 10

    CENTAUR speeds up privacy-preserving Transformer inference by permuting model weights and secret-sharing the input, at the cost of replacing provable privacy with empirical attack resistance.

Reference graph

Works this paper leans on

58 extracted references · 40 canonical work pages · cited by 4 Pith papers

  1. [1]

    Privformer: Privacy- preserving transformer with mpc

    Yoshimasa Akimoto, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Privformer: Privacy- preserving transformer with mpc. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 392–410. IEEE, 2023

  2. [2]

    Low latency privacy preserving inference

    Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. Low latency privacy preserving inference. In International Conference on Machine Learning, pages 812–821. PMLR, 2019

  3. [3]

    The-x: Privacy-preserving transformer inference with homomorphic encryption

    Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. The-x: Privacy-preserving transformer inference with homomorphic encryption. arXiv preprint arXiv:2206.00216, 2022

  4. [4]

    Opengpt-2: Open language models and implications of generated text

    Vanya Cohen and Aaron Gokaslan. Opengpt-2: Open language models and implications of generated text. XRDS: Crossroads, The ACM Magazine for Students, 27(1):26–30, 2020

  5. [5]

    Puma: Secure inference of llama-7b in five minutes

    Ye Dong, Wen-jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Cheng. Puma: Secure inference of llama-7b in five minutes. arXiv preprint arXiv:2307.12533, 2023

  6. [6]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020

  7. [7]

    Fully homomorphic encryption using ideal lattices

    Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the 41th Annual ACM Symposium on Theory of Computing - STOC’09, page 169–178. ACM, 2009

  8. [8]

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International conference on machine learning, pages 201–210. PMLR, 2016

Show all 58 references
  1. [9]

    Transkimmer: Transformer learns to layer-wise skim

    Yue Guan, Zhengyi Li, Jingwen Leng, Zhouhan Lin, and Minyi Guo. Transkimmer: Transformer learns to layer-wise skim. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors, Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Vo...

  2. [10]

    Block-skim: Efficient question answering for transformer

    Yue Guan, Zhengyi Li, Zhouhan Lin, Yuhao Zhu, Jingwen Leng, and Minyi Guo. Block-skim: Efficient question answering for transformer. InProceedings of the AAAI conference on artificial intelligence, volume 36, pages 10710–10719, 2022

  3. [11]

    Olive: Accelerating large language models via hardware-friendly outlier-victim pair quantization

    Cong Guo, Jiaming Tang, Weiming Hu, Jingwen Leng, Chen Zhang, Fan Yang, Yunxin Liu, Minyi Guo, and Yuhao Zhu. Olive: Accelerating large language models via hardware-friendly outlier-victim pair quantization. In Proceedings of the 50th Annual International Symposium on Computer...

  4. [12]

    Ant: Exploiting adaptive numerical data type for low-bit deep neural network quantization

    Cong Guo, Chen Zhang, Jingwen Leng, Zihan Liu, Fan Yang, Yunxin Liu, Minyi Guo, and Yuhao Zhu. Ant: Exploiting adaptive numerical data type for low-bit deep neural network quantization. In 2022 55th IEEE/ACM International Symposium on Microarchitecture (MICRO), pages 1414–1433...

  5. [13]

    Sigma: secure gpt inference with function secret sharing.Cryptology ePrint Archive, 2023

    Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nishanth Chandran, Divya Gupta, Ashish Panwar, and Rahul Sharma. Sigma: secure gpt inference with function secret sharing.Cryptology ePrint Archive, 2023

  6. [14]

    Iron: Private inference on transformers

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. Advances in Neural Information Processing Systems, 35:15718–15731, 2022. 11

  7. [15]

    Gaussian error linear units (gelus)

    Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415, 2016

  8. [16]

    Ciphergpt: Secure two-party gpt inference

    Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen-jie Lu, Cheng Hong, and Kui Ren. Ciphergpt: Secure two-party gpt inference. Cryptology ePrint Archive, 2023

  9. [17]

    Cheetah: Lean and fast secure {two-party} deep neural network inference

    Zhicong Huang, Wen-jie Lu, Cheng Hong, and Jiansheng Ding. Cheetah: Lean and fast secure {two-party} deep neural network inference. In 31st USENIX Security Symposium (USENIX Security 22), pages 809–826, 2022

  10. [18]

    {GAZELLE}: A low latency framework for secure neural network inference

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. {GAZELLE}: A low latency framework for secure neural network inference. In 27th USENIX Security Symposium (USENIX Security 18), pages 1651–1669, 2018

  11. [19]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of naacL-HLT, volume 1, page 2, 2019

  12. [20]

    Crypten: Secure multi-party computation meets machine learning

    Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten. Crypten: Secure multi-party computation meets machine learning. Advances in Neural Information Processing Systems, 34:4961–4973, 2021

  13. [21]

    Chatgpt: A meta-analysis after 2.5 months

    Christoph Leiter, Ran Zhang, Yanran Chen, Jonas Belouadi, Daniil Larionov, Vivian Fresen, and Steffen Eger. Chatgpt: A meta-analysis after 2.5 months. arXiv preprint arXiv:2302.13795, 2023

  14. [22]

    Mpcformer: fast, performant and private transformer inference with mpc

    Dacheng Li, Rulin Shao, Hongyi Wang, Han Guo, Eric P Xing, and Hao Zhang. Mpcformer: fast, performant and private transformer inference with mpc. arXiv preprint arXiv:2211.01452, 2022

  15. [23]

    Oblivious neural network predictions via minionn transformations

    Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. Oblivious neural network predictions via minionn transformations. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 619–631, 2017

  16. [24]

    Deja vu: Contextual sparsity for efficient llms at inference time

    Zichang Liu, Jue Wang, Tri Dao, Tianyi Zhou, Binhang Yuan, Zhao Song, Anshumali Shrivas- tava, Ce Zhang, Yuandong Tian, Christopher Re, et al. Deja vu: Contextual sparsity for efficient llms at inference time. In International Conference on Machine Learning, pages 22137–22176....

  17. [25]

    Faster secure multiparty computation of adaptive gradient descent

    Wen-jie Lu, Yixuan Fang, Zhicong Huang, Cheng Hong, Chaochao Chen, Hunter Qu, Yajin Zhou, and Kui Ren. Faster secure multiparty computation of adaptive gradient descent. In Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice, pages 47–49, 2020

  18. [26]

    Bumblebee: Secure two-party inference framework for large transformers

    Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Kui Ren, Cheng Hong, Tao Wei, and WenGuang Chen. Bumblebee: Secure two-party inference framework for large transformers. Cryptology ePrint Archive, 2023

  19. [27]

    On ideal lattices and learning with errors over rings

    Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On ideal lattices and learning with errors over rings. In Advances in Cryptology–EUROCRYPT 2010: 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30–June 3, 2...

  20. [28]

    {SecretFlow-SPU}: A performant and {User- Friendly} framework for {Privacy-Preserving} machine learning

    Junming Ma, Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi Wu, Wenjing Fang, Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang. {SecretFlow-SPU}: A performant and {User- Friendly} framework for {Privacy-Preserving} machine learning. In 2023 USENIX Annual Technical Conference (USENIX...

  21. [29]

    Bolt: Privacy- preserving, accurate and efficient inference for transformers

    Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. Bolt: Privacy- preserving, accurate and efficient inference for transformers. In 2024 IEEE Symposium on Security and Privacy (SP), pages 130–130. IEEE Computer Society, 2024

  22. [30]

    The fast fourier transform in a finite field

    John M Pollard. The fast fourier transform in a finite field. Mathematics of computation , 25(114):365–374, 1971

  23. [31]

    Sirnn: A math library for secure rnn inference

    Deevashwer Rathee, Mayank Rathee, Rahul Kranti Kiran Goli, Divya Gupta, Rahul Sharma, Nishanth Chandran, and Aseem Rastogi. Sirnn: A math library for secure rnn inference. In 2021 IEEE Symposium on Security and Privacy (SP), pages 1003–1020. IEEE, 2021. 12

  24. [32]

    Cryptflow2: Practical 2-party secure inference

    Deevashwer Rathee, Mayank Rathee, Nishant Kumar, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. Cryptflow2: Practical 2-party secure inference. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 325–342, 2020

  25. [33]

    Deevashwer Rathee, Thomas Schneider, and K. K. Shukla. Improved multiplication triple generation over rings via RLWE-based AHE. In Cryptology and Network Security, volume 11829 of LNCS, pages 347–359. Springer International Publishing, 2019

  26. [34]

    Delphi: A cryptographic inference service for neural networks

    Wenting Zheng Srinivasan, PMRL Akshayaram, and Popa Raluca Ada. Delphi: A cryptographic inference service for neural networks. In Proc. 29th USENIX Secur. Symp, pages 2505–2522, 2019

  27. [35]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

  28. [36]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017

  29. [37]

    GLUE: A multi-task benchmark and analysis platform for natural language understanding

    Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bowman. GLUE: A multi-task benchmark and analysis platform for natural language understanding. arXiv preprint arXiv:1804.07461, 2018

  30. [38]

    Huggingface’s transform- ers: State-of-the-art natural language processing

    Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. Huggingface’s transform- ers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771, 2019

  31. [39]

    Ditto: Quantization-aware secure inference of transformers upon mpc, 2024

    Haoqi Wu, Wenjing Fang, Yancheng Zheng, Junming Ma, Jin Tan, Yinggui Wang, and Lei Wang. Ditto: Quantization-aware secure inference of transformers upon mpc, 2024

  32. [40]

    Smoothquant: Accurate and efficient post-training quantization for large language models

    Guangxuan Xiao, Ji Lin, Mickael Seznec, Hao Wu, Julien Demouth, and Song Han. Smoothquant: Accurate and efficient post-training quantization for large language models. In International Conference on Machine Learning, pages 38087–38099. PMLR, 2023

  33. [41]

    Ferret: Fast extension for correlated ot with small communication

    Kang Yang, Chenkai Weng, Xiao Lan, Jiang Zhang, and Xiao Wang. Ferret: Fast extension for correlated ot with small communication. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 1607–1626, 2020

  34. [42]

    Mpcvit: Searching for accurate and efficient mpc-friendly vision transformer with heterogeneous attention

    Wenxuan Zeng, Meng Li, Wenjie Xiong, Tong Tong, Wen-jie Lu, Jin Tan, Runsheng Wang, and Ru Huang. Mpcvit: Searching for accurate and efficient mpc-friendly vision transformer with heterogeneous attention. In Proceedings of the IEEE/CVF International Conference on Computer Visi...

  35. [43]

    Cerebro: a platform for {Multi-Party} cryptographic collaborative learning

    Wenting Zheng, Ryan Deng, Weikeng Chen, Raluca Ada Popa, Aurojit Panda, and Ion Stoica. Cerebro: a platform for {Multi-Party} cryptographic collaborative learning. In 30th USENIX Security Symposium (USENIX Security 21), pages 2723–2740, 2021. 13 GELU Linear𝑞𝑘𝑣 Linearℎ1 LayerNo...

  36. [44]

    • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations

    Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: The abstraction and introduction reflect necessary contributions and experi- ments Guidelines: • The answer NA means t...

  37. [45]

    Limitations

    Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: The potential trade-off is discussed within the paper in a separate Section 3.3. Guidelines: • The answer NA means that the paper has no limitation w...

  38. [46]

    Guidelines: • The answer NA means that the paper does not include theoretical results

    Theory Assumptions and Proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [Yes] 24 Justification: The necessary assumption and proof are include in the Appendix. Guidelines: • The answer ...

  39. [47]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experimental Result Reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and da...

  40. [48]

    Guidelines: • The answer NA means that paper does not include experiments requiring code

    Open access to data and code Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material? 25 Answer: [Yes] Justification: The code to reproduce th...

  41. [49]

    But still, we follow the standard method of prior work as we have mentioned in the Section 5

    Experimental Setting/Details Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: This is not the core contribu...

  42. [50]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experiment Statistical Significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: The experiments are conducted many times and repor...

  43. [51]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experiments Compute Resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: The specific configurat...

  44. [52]

    Guidelines: • The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics

    Code Of Ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? Answer: [Yes] Justification: We follow the NeurIPS Code of Ethics. Guidelines: • The answer NA means that th...

  45. [53]

    Guidelines: • The answer NA means that there is no societal impact of the work performed

    Broader Impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: We discuss the potential positive societal impacts of using privacy-preserving inference in the Introduct...

  46. [54]

    Guidelines: • The answer NA means that the paper poses no such risks

    Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: The answer NA m...

  47. [55]

    Guidelines: • The answer NA means that the paper does not use existing assets

    Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: We cite the orig...

  48. [56]

    Guidelines: • The answer NA means that the paper does not release new assets

    New Assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [NA] Justification: This paper does not release new assets. Guidelines: • The answer NA means that the paper does not release new assets....

  49. [57]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Crowdsourcing and Research with Human Subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? A...

  50. [58]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.