REVIEW 5 major objections 5 minor 4 cited by
Nimbus: Secure and Efficient Two-Party Inference for Transformers
T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash
Pith's one-line read Nimbus claims secure Transformer inference can be 2.7x-4.7x faster with 0.08% accuracy loss.
desk verdict Nimbus is a real step forward in practical 2PC Transformer inference, but the abstract oversells the headline numbers and the crypto parameters need to be spelled out. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the client-side outer product (COP) protocol with row-wise encoding, together with distribution-aware polynomial fitting for non-linear functions. In COP, each row of the weight matrix is encoded into a polynomial and encrypted once at setup; the client multiplies each plaintext activation share as a scalar against the ciphertext polynomials and accumulates the partial products, so an entire output row is assembled from outer-product contributions, and a right-shift operation packs several output ciphertexts into one dense polynomial. For non-linear layers, the load-bearing mechanism is a fitting procedure that minimizes $\int_l^h p(x)[f(x)-f'(x)]^2\,dx$ under the empirical density $p(x)$ of the activations, which lets GELU be approximated by a quadratic on a narrow interval and exponential by a cubic on one interval plus a linear tail, enabling the smaller ring $\mathbb{Z}_{2^{32}}$ and a free fused truncation-upcast back to $\mathbb{Z}_{2^{64}}$.
What would settle it
A concrete falsification: instantiate the COP protocol with a stated $(N,q)$ parameter set and compute the accumulated noise after $m=3072$ scalar-polynomial multiplications on a single ciphertext row; if decryption fails, or the modulus $q$ needed to avoid failure forces ciphertexts larger than the paper's reported communication numbers, the central efficiency claim collapses at that security level.
Extended reading notes
Core claim
The paper's central claim is that the two bottlenecks in secure two-party Transformer inference—homomorphic matrix multiplication in linear layers and secure evaluation of GELU and Softmax—are both removable by rebalancing work and using input statistics. Nimbus has the server encrypt its static weights once in a setup phase; the client then computes each output row through an outer product: scalar multiplications of its plaintext activation shares against the encrypted weight polynomials, accumulated and packed by right shifts into dense ciphertexts. For non-linear layers, Nimbus fits GELU and the exponential in Softmax with low-degree piecewise polynomials whose breakpoints are per-layer tuned by minimizing expected squared error under the empirically measured activation density, and a fused truncation-and-upcast protocol converts between $\mathbb{Z}_{2^{32}}$ and $\mathbb{Z}_{2^{64}}$ rings at no extra communication. The paper reports that on BERTbase this yields 2.7x to 4.7x faster end-to-end secure inference than the state-of-the-art protocol, roughly 60% lower communication, and average accuracy within 0.08% of plaintext inference after light fine-tuning.
Load-bearing premise
The results lean on two load-bearing premises: the lattice-based additive homomorphic encryption built on the ring learning-with-errors (RLWE) problem provides circuit privacy and enough noise budget to sustain up to thousands of scalar-polynomial multiplications per output row without decryption failure or parameter blow-up, and the activation distribution estimated from 512 training tokens is stable enough across layers and test data to make the fixed low-degree polynomial approximations accurate.
Editorial extensions
If this is right
- If the central claims are correct, secure two-party BERTbase inference becomes 2.7x to 4.7x faster than the previous state-of-the-art protocol across LAN and WAN settings while staying within 0.08% of plaintext accuracy after light fine-tuning.
- The one-time cost of sending encrypted weights is amortized: the method overtakes the state-of-the-art baseline after roughly three queries and reaches its maximal speedup around forty queries.
- Linear layers improve by 2.9x to 12.5x and non-linear layers by 2.9x to 4.0x over the state-of-the-art protocol, with linear-layer gains largest in LAN settings where computation dominates latency.
- Communication per Transformer block falls to about 60% of the state of the art, with linear-layer rounds halved and Softmax and GELU rounds reduced.
- For sequence lengths 32 and 128, end-to-end speedups of 1.9x to 7.6x are reported across hidden sizes, though the gain drops to 1.2x to 2.1x for sequence length 1 (the generation phase).
Reading between the lines
- A consequence the paper leaves implicit is that the client-side design moves most of the homomorphic work onto the client, so the reported speedups assume a server-class client; a thin client would see smaller gains, and the paper itself notes the client should have comparable CPU and RAM to the server.
- A testable extension is evaluating the distribution-aware approximations under domain shift, since the polynomials are fitted to 512 training tokens and their accuracy on out-of-distribution or adversarial activations is not measured.
- The outer-product-with-static-weights idea should carry over to other static-weight architectures such as GPT-style decoders and vision transformers, and to the prefill phase of generative inference; the paper evaluates only BERTbase.
- A full parameter set with a noise-budget accounting is needed to reproduce the communication/computation trade-off at a stated security level; without it the speedups are relative to a particular implementation rather than a certified property.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Nimbus, a secure two-party inference framework for Transformers. For linear layers, Nimbus introduces a client-side outer-product (COP) protocol with row-wise encoding that moves encrypted weights to the client during a one-time setup, eliminating input communication online and producing compact output ciphertexts. For non-linear layers, the paper fits low-degree piecewise polynomials to GELU and exp using the observed activation distribution, and uses a smaller ring (Z_{2^32}) with a fused truncation/upcast conversion. The paper reports end-to-end speedups of 2.7x-4.7x over BumbleBee for BERTbase at sequence length 128, and an average accuracy loss of 0.08% on the GLUE benchmark (with fine-tuning). It also reports a 60% reduction in communication compared with BumbleBee.
Significance. If the efficiency numbers hold with concrete, secure parameters, the work is a substantial advance for private Transformer inference: the COP protocol questions the standard server-side inner-product paradigm, the distribution-aware approximation is a pragmatic way to reduce non-linear layer costs, and the open-source implementation is a valuable asset for the community. The paper includes detailed complexity analysis and an amortized setup-cost discussion in the appendix. However, the significance is conditional on resolving the missing ciphertext-parameter/noise analysis and on correcting the overstatements in the abstract and introduction regarding accuracy loss and speedup.
major comments (5)
- [Section 5 / Appendix C.1 / Algorithm 1] The central efficiency claim rests on the reused RLWE-based HE scheme being instantiated with N=8192, plaintext ring Z_{2^64} for the linear layers, and a ciphertext modulus q that simultaneously meets the target security level and keeps decryption correct after up to m=3072 scalar-polynomial multiplications and additions per output ciphertext (m up to 3072 for Linear_h2). The paper provides no concrete modulus q, no noise-budget analysis, no digit decomposition, and no parameter selection. Without this, the reported latencies and communication totals are not verifiable, and the protocol's correctness (decryption without failure) is not established. This is a load-bearing gap that must be addressed before the efficiency claims can be accepted.
- [Appendix C.1, Security Proof of the Matrix Multiplication Protocol] The security proof is only a brief sketch and appears to conflate the client's and server's views. For the corrupted-client case, the relevant property is that the encrypted weights hide W under the HE scheme (standard IND-CPA security), not the circuit-privacy property of the HE scheme, which concerns hiding the function from the decryptor. For the corrupted-server case, the server receives a ciphertext encrypting W*X_c - R; the uniform mask R makes the plaintext uniform, but the simulation must also account for the ciphertext noise distribution, which the sketch does not do. A full simulation-based proof with explicit hybrids is needed.
- [Abstract / Section 5.1 / Table 2] The abstract states that 'the average accuracy loss of our approach is 0.08% compared to the non-2PC inference without privacy.' This number is only for Nimbus†, which is fine-tuned to the approximation; without fine-tuning, the average loss is 0.6% (Section 5.1). The abstract and introduction omit this qualification. Moreover, because the fine-tuning adapts the model to the approximate activation functions, the 0.08% figure is not an independent measure of approximation fidelity but rather a measure of the model's ability to compensate for the approximation.
- [Abstract / Section 5.2 / Appendix F.1 / F.3] The claimed '2.7x-4.7x end-to-end speedup' excludes the one-time setup cost of transmitting the encrypted weights (180 MB to 720 MB per linear layer per block) and is reported for sequence length 128. Appendix F.1 reports that for sequence length 1 the speedup is only 1.2x-2.1x, and Appendix F.3 shows that the setup cost is amortized only after about 3 queries. The abstract and introduction should qualify the speedup claim by stating the sequence-length regime and by clarifying that the reported online latency excludes the one-time setup.
- [Section 4.2 / Table 2 and Appendix C.2] The distribution-aware polynomials are fitted to the activation distribution of the same BERTbase model on the same GLUE benchmark used for evaluation, and the best accuracy is obtained after fine-tuning the model to the approximate activations. This creates a mild circularity: the reported 0.08% loss is not a pure measure of how well the approximation generalizes to unseen data or to other models. The paper should report results on a genuinely held-out distribution or explicitly discuss this limitation and its potential impact on the accuracy claims.
minor comments (5)
- [Section 2.2] The notation for rings, e.g., Z2ℓ and AN,2ℓ, is inconsistent with the standard Z_{2^ell} and A_{N,2^ell}; the typesetting makes the exponent and subscript difficult to distinguish. Please use consistent and unambiguous notation throughout.
- [Section 4.2, Equation (4)] The exponential approximation is written as exp(x) ≈ 0 for x < T_exp, which is intentionally an approximation in a low-probability region. Please state explicitly that this is an approximation for that region rather than presenting an exact equality, to avoid confusion.
- [Appendix E, Equation (8)] The correctness derivation for the truncation-upcast fusion contains a misplaced '=' in the second line and a parenthetical reference ('The third line holds since...') that does not match the displayed equation. The relationship between the generic parameter k in the proof and the concrete B2A width ell' - ell + s should also be clarified.
- [Section 5.2, Figure 6] The text reports '4.8×~5.9× faster than Iron and 2.7×~4.7× faster than BumbleBee' but the WAN total latencies (40.96/8.52=4.81 and 23.00/8.52=2.70) give a range of 2.7x-4.8x over BumbleBee; the 4.7x upper bound is slightly inconsistent with the plotted numbers.
- [Section 5.3, Table 3] The text says the non-linear communication is '3× less' than BumbleBee, but the ratio for Softmax is 354.26/115.35 ≈ 3.07 and for GELU is 185.13/53.22 ≈ 3.48. Please use the exact ratios or state them as approximately 3x.
Circularity Check
No material circularity: the COP linear-layer protocol is self-contained, and the non-linear approximations are fitted on training data and evaluated on held-out GLUE test data.
full rationale
The paper's main efficiency claims are empirical end-to-end measurements against external baselines (Iron, BumbleBee, BOLT) under specified network settings, so the reported speedups and communication reductions do not reduce to the paper's own assumptions by construction. The COP protocol's complexity analysis in Appendix D is a direct count of communicated ciphertexts and NTT/scalar-polynomial operations, not a re-labeling of the SIP protocol's outputs. The distribution-aware polynomial approximation minimizes an expected-loss objective in Equation (3) using p(x) sampled from GLUE training data, and the accuracy comparison in Table 2 is on held-out GLUE test tasks; the 0.08% accuracy loss is a measured post-fine-tuning result, not a fitted parameter renamed as a prediction. Reuse of the RLWE-based additive HE scheme from BumbleBee and piecewise-polynomial evaluation subprotocols from PUMA/BumbleBee is standard building-block composition; these citations are not invoked as uniqueness theorems, nor do they smuggle in the paper's conclusions. The main substantive gap, the absence of concrete ciphertext moduli and noise-budget analysis for the reused HE scheme, is a security/completeness risk rather than a circularity in the derivation chain.
Assumptions & free parameters
free parameters (5)
- GELU breakpoints T1, T2 (per layer depth) =
not disclosed
- Exponential breakpoint Texp (per layer depth) =
not disclosed
- Piecewise polynomial coefficients b0..b3 =
not disclosed
- Activation distribution p(x) =
estimated from 512 training tokens
- Fixed-point scale s and ring size =
s=12 and Z32 for non-linear, s=18 and Z64 elsewhere
assumptions (5)
- standard math RLWE hardness and correctness of the additive HE scheme from [26]
- domain assumption The HE scheme provides circuit privacy for the ciphertexts used in the COP protocol
- domain assumption Semi-honest adversary model
- domain assumption Activation distributions are stable across train/test and across model depths
- domain assumption The input distribution pattern generalizes beyond BERTbase and GLUE
Cite this review
Pith. "Pith review of Nimbus: Secure and Efficient Two-Party Inference for Transformers." pith.science (2026). https://pith.science/paper/Z6NYOJ2O
@misc{pith2026241115707,
author = {Pith},
title = {Pith review of: Nimbus: Secure and Efficient Two-Party Inference for Transformers},
year = {2026},
howpublished = {\url{https://pith.science/paper/Z6NYOJ2O}},
note = {Machine review of arXiv:2411.15707}
}
abstract
Transformer models have gained significant attention due to their power in machine learning tasks. Their extensive deployment has raised concerns about the potential leakage of sensitive information during inference. However, when being applied to Transformers, existing approaches based on secure two-party computation (2PC) bring about efficiency limitations in two folds: (1) resource-intensive matrix multiplications in linear layers, and (2) complex non-linear activation functions like $\mathsf{GELU}$ and $\mathsf{Softmax}$. This work presents a new two-party inference framework $\mathsf{Nimbus}$ for Transformer models. For the linear layer, we propose a new 2PC paradigm along with an encoding approach to securely compute matrix multiplications based on an outer-product insight, which achieves $2.9\times \sim 12.5\times$ performance improvements compared to the state-of-the-art (SOTA) protocol. For the non-linear layer, through a new observation of utilizing the input distribution, we propose an approach of low-degree polynomial approximation for $\mathsf{GELU}$ and $\mathsf{Softmax}$, which improves the performance of the SOTA polynomial approximation by $2.9\times \sim 4.0\times$, where the average accuracy loss of our approach is 0.08\% compared to the non-2PC inference without privacy. Compared with the SOTA two-party inference, $\mathsf{Nimbus}$ improves the end-to-end performance of \bert{} inference by $2.7\times \sim 4.7\times$ across different network settings.
Figures
Figures from the paper (8 more)
Forward citations
Cited by 4 Pith papers
-
An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMs
A sequential vocabulary-search attack decodes original prompts from unpermuted and permuted LLM hidden states, compromising PermLLM, STIP, and Centaur.
-
Cascade: Token-Sharded Private LLM Inference
Cascade performs LLM inference by sharding the token sequence across non-colluding nodes, claiming resistance to vocabulary-matching and learning-based reconstruction attacks while being orders of magnitude faster than SMPC.
-
An Efficient Private GPT Never Autoregressively Decodes
Applying speculative decoding to secure two-party GPT inference, with a latency-insensitive multi-token forward and optimized private sampling, gives 2.1x to 6.0x speedups without changing the output distribution.
-
CENTAUR: Bridging the Impossible Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference
CENTAUR speeds up privacy-preserving Transformer inference by permuting model weights and secret-sharing the input, at the cost of replacing provable privacy with empirical attack resistance.
Reference graph
Works this paper leans on
-
[1]
Privformer: Privacy- preserving transformer with mpc
Yoshimasa Akimoto, Kazuto Fukuchi, Youhei Akimoto, and Jun Sakuma. Privformer: Privacy- preserving transformer with mpc. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 392–410. IEEE, 2023
work page 2023
-
[2]
Low latency privacy preserving inference
Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. Low latency privacy preserving inference. In International Conference on Machine Learning, pages 812–821. PMLR, 2019
work page 2019
-
[3]
The-x: Privacy-preserving transformer inference with homomorphic encryption
Tianyu Chen, Hangbo Bao, Shaohan Huang, Li Dong, Binxing Jiao, Daxin Jiang, Haoyi Zhou, Jianxin Li, and Furu Wei. The-x: Privacy-preserving transformer inference with homomorphic encryption. arXiv preprint arXiv:2206.00216, 2022
arXiv 2022
-
[4]
Opengpt-2: Open language models and implications of generated text
Vanya Cohen and Aaron Gokaslan. Opengpt-2: Open language models and implications of generated text. XRDS: Crossroads, The ACM Magazine for Students, 27(1):26–30, 2020
work page 2020
-
[5]
Puma: Secure inference of llama-7b in five minutes
Ye Dong, Wen-jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Cheng. Puma: Secure inference of llama-7b in five minutes. arXiv preprint arXiv:2307.12533, 2023
arXiv 2023
-
[6]
An image is worth 16x16 words: Transformers for image recognition at scale
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020
arXiv 2010
-
[7]
Fully homomorphic encryption using ideal lattices
Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the 41th Annual ACM Symposium on Theory of Computing - STOC’09, page 169–178. ACM, 2009
work page 2009
-
[8]
Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy
Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International conference on machine learning, pages 201–210. PMLR, 2016
Show all 58 references
-
[9]
Transkimmer: Transformer learns to layer-wise skim
Yue Guan, Zhengyi Li, Jingwen Leng, Zhouhan Lin, and Minyi Guo. Transkimmer: Transformer learns to layer-wise skim. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors, Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Vo...
2022
-
[10]
Block-skim: Efficient question answering for transformer
Yue Guan, Zhengyi Li, Zhouhan Lin, Yuhao Zhu, Jingwen Leng, and Minyi Guo. Block-skim: Efficient question answering for transformer. InProceedings of the AAAI conference on artificial intelligence, volume 36, pages 10710–10719, 2022
2022
-
[11]
Olive: Accelerating large language models via hardware-friendly outlier-victim pair quantization
Cong Guo, Jiaming Tang, Weiming Hu, Jingwen Leng, Chen Zhang, Fan Yang, Yunxin Liu, Minyi Guo, and Yuhao Zhu. Olive: Accelerating large language models via hardware-friendly outlier-victim pair quantization. In Proceedings of the 50th Annual International Symposium on Computer...
2023
-
[12]
Ant: Exploiting adaptive numerical data type for low-bit deep neural network quantization
Cong Guo, Chen Zhang, Jingwen Leng, Zihan Liu, Fan Yang, Yunxin Liu, Minyi Guo, and Yuhao Zhu. Ant: Exploiting adaptive numerical data type for low-bit deep neural network quantization. In 2022 55th IEEE/ACM International Symposium on Microarchitecture (MICRO), pages 1414–1433...
2022
-
[13]
Sigma: secure gpt inference with function secret sharing.Cryptology ePrint Archive, 2023
Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nishanth Chandran, Divya Gupta, Ashish Panwar, and Rahul Sharma. Sigma: secure gpt inference with function secret sharing.Cryptology ePrint Archive, 2023
2023
-
[14]
Iron: Private inference on transformers
Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. Advances in Neural Information Processing Systems, 35:15718–15731, 2022. 11
2022
-
[15]
Gaussian error linear units (gelus)
Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415, 2016
2016 arXiv
-
[16]
Ciphergpt: Secure two-party gpt inference
Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen-jie Lu, Cheng Hong, and Kui Ren. Ciphergpt: Secure two-party gpt inference. Cryptology ePrint Archive, 2023
2023
-
[17]
Cheetah: Lean and fast secure {two-party} deep neural network inference
Zhicong Huang, Wen-jie Lu, Cheng Hong, and Jiansheng Ding. Cheetah: Lean and fast secure {two-party} deep neural network inference. In 31st USENIX Security Symposium (USENIX Security 22), pages 809–826, 2022
2022
-
[18]
{GAZELLE}: A low latency framework for secure neural network inference
Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. {GAZELLE}: A low latency framework for secure neural network inference. In 27th USENIX Security Symposium (USENIX Security 18), pages 1651–1669, 2018
2018
-
[19]
Bert: Pre-training of deep bidirectional transformers for language understanding
Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of naacL-HLT, volume 1, page 2, 2019
2019
-
[20]
Crypten: Secure multi-party computation meets machine learning
Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten. Crypten: Secure multi-party computation meets machine learning. Advances in Neural Information Processing Systems, 34:4961–4973, 2021
2021
-
[21]
Chatgpt: A meta-analysis after 2.5 months
Christoph Leiter, Ran Zhang, Yanran Chen, Jonas Belouadi, Daniil Larionov, Vivian Fresen, and Steffen Eger. Chatgpt: A meta-analysis after 2.5 months. arXiv preprint arXiv:2302.13795, 2023
2023 arXiv
-
[22]
Mpcformer: fast, performant and private transformer inference with mpc
Dacheng Li, Rulin Shao, Hongyi Wang, Han Guo, Eric P Xing, and Hao Zhang. Mpcformer: fast, performant and private transformer inference with mpc. arXiv preprint arXiv:2211.01452, 2022
2022 arXiv
-
[23]
Oblivious neural network predictions via minionn transformations
Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. Oblivious neural network predictions via minionn transformations. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 619–631, 2017
2017
-
[24]
Deja vu: Contextual sparsity for efficient llms at inference time
Zichang Liu, Jue Wang, Tri Dao, Tianyi Zhou, Binhang Yuan, Zhao Song, Anshumali Shrivas- tava, Ce Zhang, Yuandong Tian, Christopher Re, et al. Deja vu: Contextual sparsity for efficient llms at inference time. In International Conference on Machine Learning, pages 22137–22176....
2023
-
[25]
Faster secure multiparty computation of adaptive gradient descent
Wen-jie Lu, Yixuan Fang, Zhicong Huang, Cheng Hong, Chaochao Chen, Hunter Qu, Yajin Zhou, and Kui Ren. Faster secure multiparty computation of adaptive gradient descent. In Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice, pages 47–49, 2020
2020
-
[26]
Bumblebee: Secure two-party inference framework for large transformers
Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Kui Ren, Cheng Hong, Tao Wei, and WenGuang Chen. Bumblebee: Secure two-party inference framework for large transformers. Cryptology ePrint Archive, 2023
2023
-
[27]
On ideal lattices and learning with errors over rings
Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On ideal lattices and learning with errors over rings. In Advances in Cryptology–EUROCRYPT 2010: 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30–June 3, 2...
2010
-
[28]
{SecretFlow-SPU}: A performant and {User- Friendly} framework for {Privacy-Preserving} machine learning
Junming Ma, Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi Wu, Wenjing Fang, Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang. {SecretFlow-SPU}: A performant and {User- Friendly} framework for {Privacy-Preserving} machine learning. In 2023 USENIX Annual Technical Conference (USENIX...
2023
-
[29]
Bolt: Privacy- preserving, accurate and efficient inference for transformers
Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. Bolt: Privacy- preserving, accurate and efficient inference for transformers. In 2024 IEEE Symposium on Security and Privacy (SP), pages 130–130. IEEE Computer Society, 2024
2024
-
[30]
The fast fourier transform in a finite field
John M Pollard. The fast fourier transform in a finite field. Mathematics of computation , 25(114):365–374, 1971
1971
-
[31]
Sirnn: A math library for secure rnn inference
Deevashwer Rathee, Mayank Rathee, Rahul Kranti Kiran Goli, Divya Gupta, Rahul Sharma, Nishanth Chandran, and Aseem Rastogi. Sirnn: A math library for secure rnn inference. In 2021 IEEE Symposium on Security and Privacy (SP), pages 1003–1020. IEEE, 2021. 12
2021
-
[32]
Cryptflow2: Practical 2-party secure inference
Deevashwer Rathee, Mayank Rathee, Nishant Kumar, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. Cryptflow2: Practical 2-party secure inference. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 325–342, 2020
2020
-
[33]
Deevashwer Rathee, Thomas Schneider, and K. K. Shukla. Improved multiplication triple generation over rings via RLWE-based AHE. In Cryptology and Network Security, volume 11829 of LNCS, pages 347–359. Springer International Publishing, 2019
2019
-
[34]
Delphi: A cryptographic inference service for neural networks
Wenting Zheng Srinivasan, PMRL Akshayaram, and Popa Raluca Ada. Delphi: A cryptographic inference service for neural networks. In Proc. 29th USENIX Secur. Symp, pages 2505–2522, 2019
2019
-
[35]
Llama: Open and efficient foundation language models
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023
2023 arXiv
-
[36]
Attention is all you need
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017
2017
-
[37]
GLUE: A multi-task benchmark and analysis platform for natural language understanding
Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bowman. GLUE: A multi-task benchmark and analysis platform for natural language understanding. arXiv preprint arXiv:1804.07461, 2018
2018 arXiv
-
[38]
Huggingface’s transform- ers: State-of-the-art natural language processing
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. Huggingface’s transform- ers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771, 2019
1910 arXiv
-
[39]
Ditto: Quantization-aware secure inference of transformers upon mpc, 2024
Haoqi Wu, Wenjing Fang, Yancheng Zheng, Junming Ma, Jin Tan, Yinggui Wang, and Lei Wang. Ditto: Quantization-aware secure inference of transformers upon mpc, 2024
2024
-
[40]
Smoothquant: Accurate and efficient post-training quantization for large language models
Guangxuan Xiao, Ji Lin, Mickael Seznec, Hao Wu, Julien Demouth, and Song Han. Smoothquant: Accurate and efficient post-training quantization for large language models. In International Conference on Machine Learning, pages 38087–38099. PMLR, 2023
2023
-
[41]
Ferret: Fast extension for correlated ot with small communication
Kang Yang, Chenkai Weng, Xiao Lan, Jiang Zhang, and Xiao Wang. Ferret: Fast extension for correlated ot with small communication. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 1607–1626, 2020
2020
-
[42]
Mpcvit: Searching for accurate and efficient mpc-friendly vision transformer with heterogeneous attention
Wenxuan Zeng, Meng Li, Wenjie Xiong, Tong Tong, Wen-jie Lu, Jin Tan, Runsheng Wang, and Ru Huang. Mpcvit: Searching for accurate and efficient mpc-friendly vision transformer with heterogeneous attention. In Proceedings of the IEEE/CVF International Conference on Computer Visi...
2023
-
[43]
Cerebro: a platform for {Multi-Party} cryptographic collaborative learning
Wenting Zheng, Ryan Deng, Weikeng Chen, Raluca Ada Popa, Aurojit Panda, and Ion Stoica. Cerebro: a platform for {Multi-Party} cryptographic collaborative learning. In 30th USENIX Security Symposium (USENIX Security 21), pages 2723–2740, 2021. 13 GELU Linear𝑞𝑘𝑣 Linearℎ1 LayerNo...
2021
-
[44]
• The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations
Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: The abstraction and introduction reflect necessary contributions and experi- ments Guidelines: • The answer NA means t...
-
[45]
Limitations
Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: The potential trade-off is discussed within the paper in a separate Section 3.3. Guidelines: • The answer NA means that the paper has no limitation w...
-
[46]
Guidelines: • The answer NA means that the paper does not include theoretical results
Theory Assumptions and Proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [Yes] 24 Justification: The necessary assumption and proof are include in the Appendix. Guidelines: • The answer ...
-
[47]
Guidelines: • The answer NA means that the paper does not include experiments
Experimental Result Reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and da...
-
[48]
Guidelines: • The answer NA means that paper does not include experiments requiring code
Open access to data and code Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material? 25 Answer: [Yes] Justification: The code to reproduce th...
-
[49]
But still, we follow the standard method of prior work as we have mentioned in the Section 5
Experimental Setting/Details Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: This is not the core contribu...
-
[50]
Guidelines: • The answer NA means that the paper does not include experiments
Experiment Statistical Significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: The experiments are conducted many times and repor...
-
[51]
Guidelines: • The answer NA means that the paper does not include experiments
Experiments Compute Resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: The specific configurat...
-
[52]
Guidelines: • The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics
Code Of Ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? Answer: [Yes] Justification: We follow the NeurIPS Code of Ethics. Guidelines: • The answer NA means that th...
-
[53]
Guidelines: • The answer NA means that there is no societal impact of the work performed
Broader Impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: We discuss the potential positive societal impacts of using privacy-preserving inference in the Introduct...
-
[54]
Guidelines: • The answer NA means that the paper poses no such risks
Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: The answer NA m...
-
[55]
Guidelines: • The answer NA means that the paper does not use existing assets
Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: We cite the orig...
-
[56]
Guidelines: • The answer NA means that the paper does not release new assets
New Assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [NA] Justification: This paper does not release new assets. Guidelines: • The answer NA means that the paper does not release new assets....
-
[57]
Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects
Crowdsourcing and Research with Human Subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? A...
-
[58]
Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects
Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals...
Reviewed August 12, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.