Pith. sign in

REVIEW 3 major objections 4 minor 36 references

Towards Anonymous Neural Network Inference

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read funion recasts neural network inference as a store-compute-store mixnet choreography, inheriting Echomix anonymity with a bounded advantage of $4\varepsilon_E + \delta$.

desk verdict The store-compute-store architecture is a useful new application of Echomix, but the paper's central IO-U claim breaks against its own honest-but-curious-service threat model, and the hybrid proof is a sketch that doesn't close the gap. read the letter →

arxiv 2505.18398 v1 pith:T62PYDR6 submitted 2025-05-23 cs.CR cs.AI

Liao Peiyuan This is my paper · ORCID
classification cs.CRcs.AI
keywords anonymousneuralnetworkinferencemixnetanonymitysender-receiverunlinkabilityBACAPblinding-and-capabilityPigeonholestoragemetadataprivacylatencybucketsSphinxechoes
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

funion aims to give neural network inference the same metadata privacy that modern mixnets give messaging: a user should be able to submit a prompt and later collect the output without any observer—even one watching all traffic—being able to pair the two events. The paper's central claim is that this can be achieved by splitting inference into five Sphinx echoes inside the Echomix mixnet, with input tensors stored under blinded-and-capability (BACAP) records and computation performed by a courier that tunnels its own reads and writes back through the mixnet. The security theorem states that any global passive adversary's advantage in the input–output unlinkability game is at most $4\varepsilon_E + \delta$, where $\varepsilon_E$ is the anonymity advantage against one Echomix echo and $\delta$ the advantage of linking one BACAP box pair. This matters because cloud inference today leaks who queries, when, and what workload shape, even when content is encrypted; funion targets the stronger guarantee that the very fact of the query stays hidden, at the cost of roughly nine seconds of expected mixnet delay and a per-client cover-traffic bandwidth budget.

What carries the argument

The load-bearing machinery is the five-echo store-compute-store protocol built on Echomix's Pigeonhole storage and BACAP (blinding-and-capability) scheme. A Sphinx echo is a constant-length, onion-encrypted packet whose layered routing and single-use reply blocks make it indistinguishable from cover traffic; Pigeonhole is a stateless courier API that stores opaque blobs at pseudorandom 32-byte Box-IDs; BACAP turns one 256-bit seed into an unlinkable chain of storage locations, write capabilities, and read capabilities, so a write authority cannot forge reads and a holder of a read capability cannot forge writes. The protocol's distinctive move is that the compute courier Charlie treats the mixnet as a secure path to storage nodes: his fetch and store requests are themselves Sphinx echoes tunneled back through the mixnet, preserving a uniform wire-image. A second mechanism, the latency-bucket release policy, quantizes observable computation time into a public grid and leaks at most one overflow bit, blocking computation-time side channels without contributing to SRTU.

What would settle it

Deploy the five-echo protocol on a test mixnet, record full packet timings, and attempt to match each Alice upload echo (E1) with the corresponding Alice fetch echo (E5) using a timing-correlation classifier with honest-but-curious compute couriers; if the classifier's advantage exceeds the paper's $4\varepsilon_E + \delta$ bound, the reduction does not cover the stated adversary class.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is a reduction: anonymous inference can inherit the proven anonymity of Echomix if inference is restructured as a fixed five-echo store-compute-store protocol. Alice writes her input tensor into Pigeonhole boxes under a write capability $W_{\mathrm{in}}$, dispatches a read capability $R_{\mathrm{in}}$ and a fresh output write capability $W_{\mathrm{out}}$ to a compute courier Charlie, who fetches the input through the mixnet, computes $y = F_\theta(x)$ locally, stores the result under $W_{\mathrm{out}}$, and then Alice fetches the output with $R_{\mathrm{out}}$. Each step is an ordinary Sphinx echo, and the four packets Charlie sends or receives are the only extra routing information compared with plain Echomix; the proof replaces those packets with fresh random echoes one at a time in hybrids H0 through H4, then replaces all BACAP triples with random strings, losing at most $2\varepsilon_E$ per pair of packet substitutions and $\delta$ for the BACAP step. The resulting bound $\varepsilon \le 4\varepsilon_E + \delta$ is what the paper means by inheriting Echomix + BACAP anonymity: funion leaks no more than four Echomix echoes plus one BACAP box pair. The same section also proves a self-receiver lemma that input–output unlinkability strictly implies sender–receiver third-party unlinkability in this workflow.

Load-bearing premise

The proof assumes that Echomix's anonymity theorem applies unchanged to the four Charlie-visible packets—the compute courier's inbound and outbound fetch and store echoes—so that replacing each with a fresh random Sphinx echo can lose at most $2\varepsilon_E$ each; the paper neither states the exact Echomix theorem nor proves that a courier acting as both sender and receiver of echoes falls under it.

Editorial extensions

If this is right

  • A user can ask a large model a question without any single network observer being able to connect the uploaded input to the fetched output, provided the Echomix and BACAP assumptions hold.
  • The observable timing of a query reveals only the public latency bucket plus one overflow bit, no matter how long the inference actually takes.
  • For a 70-billion-parameter model, the expected mixnet delay (about 9 seconds) is a manageable fraction of end-to-end latency; the mixnet portion drops below 20% for output-heavy workloads.
  • A client's continuous cover traffic of roughly 6.7 GB per day supports about 50 inferences per minute, meaning funion is practical for sporadic human use but needs rate adaptation for API-driven power users.
  • Input–output unlinkability strictly implies sender–receiver third-party unlinkability whenever each sender is the sole authorized fetcher of her own result.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: The paper doesn't say so, but the same five-echo skeleton should generalize to other stateful remote computations—encrypted search, federated aggregation, or private key-value operations—wherever the client can write a job and read a result.
  • Editorial: An unstated consequence of the latency buckets is a direct trade-off: wider buckets reduce timing leakage but raise resubmission latency on overflow, so production deployments could tune the bucket width per workload class rather than globally.
  • Editorial: Because the proof targets a global passive adversary while the threat model also lists honest-but-curious service nodes, a natural testable extension is a formal treatment of compute-courier and replica collusion, which the paper mitigates only informally by rotation and an explicit no-collusion assumption.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes funion, a system for anonymous neural network inference built on the Echomix mixnet. A client uploads encrypted input tensors to storage replicas through a mixnet, dispatches a compute courier with read/write capabilities, the courier fetches the input, computes the model output locally, stores the result, and the client fetches it. The authors claim that this store-compute-store workflow inherits Echomix's sender-receiver unlinkability, formalized as Input-Output Unlinkability (IO-U), with Theorem 4.4 bounding the adversary's advantage by 4εE+δ, where εE is the Echomix echo advantage and δ is the BACAP box-pair linkability. The paper also gives latency and bandwidth estimates for Llama-3-70B inference.

Significance. The conceptual idea of reusing a mixnet's storage and communication anonymity for ML inference is interesting and timely. The paper is clearly organized and honestly discusses limitations such as hidden-state privacy and lack of empirical evaluation. However, the paper's central security claim is not established. The proof of Theorem 4.4 is a hybrid argument that relies on an unstated Echomix theorem, and the security game is defined only for a global passive adversary, while the threat model includes honest-but-curious service nodes that plainly observe the input/output pair. As a result, the claimed 'end-to-end sender-receiver unlinkability' and 'no traceable connection between input and output parties' do not follow from the presented analysis. The work is better described as a design proposal with a plausible outline rather than a system with provable anonymity.

major comments (3)
  1. [§4.3, Theorem 4.4, hybrids H1-H2] The proof sketch invokes 'the Echomix anonymity theorem' without stating its exact content. The paper must state the theorem (its adversary, indistinguishability notion, and advantage bound) and then prove that it applies to the four Charlie-visible packets of echoes E3 and E4. In particular, E3 and E4 are two-packet SURB round-trips in which Charlie is both the initiating sender and the recipient; it is not obvious that Echomix's theorem covers this sender=receiver pattern. Without this, the per-packet loss bound of εE and the union bound 4εE are unsupported, so the main reduction does not go through.
  2. [§2.3, §3.2, §4.3 hybrid H3] The threat model includes honest-but-curious service nodes, and Charlie is a service node that processes plaintext input x and computes y. The IO-U game (Definition 4.1) is formalized only for a GPA, and hybrid H3 randomizes BACAP records but leaves Charlie's plaintext view unchanged. An honest-but-curious Charlie can directly observe which input produced which output, yielding an unbounded distinguishing advantage. Consequently Theorem 4.4 does not support the abstract's claim of 'no traceable connection between input and output parties' under the paper's own threat model. Indeed, Section 6.1 states that 'the input is directly available' to a compromised service and Section 4.4 acknowledges that a compute courier plus replicas reveal the input-output link. The authors must either restrict their security notion to non-service adversaries or redesign the protocol to keep the input/output pair hidden from Charlie.
  3. [§4.1 Assumption 4.1] The 'Limited courier–replica collusion' assumption is ad hoc and unquantified. It states that for every job, either Charlie is honest or none of the k replicas storing that job collude with him. This effectively excludes the most natural collusion among storage and compute providers, and the paper does not analyze the probability of such collusion under the system's random replica selection. Since the security reduction depends on this assumption, the result is conditioned on a strong, untested trust assumption that should be explicitly justified or replaced with a quantitative bound.
minor comments (4)
  1. [§4.2, Lemma 4.3] The reduction from SRTU to IO-U is described at a high level; it would benefit from a formal definition of the IO-U challenger's interface and a precise argument that the simulation is perfect. The current text says 'the reduction simulates the entire network' without specifying how the IO-U game's two challenge inputs map to the SRTU experiment.
  2. [§5.4] The formula for ρ uses `trounded_mix`, which is not defined; one assumes the author means the fixed mix delay of 9.0 s, but the notation should be clarified.
  3. [§5.1 and §5.5] The paper alternately refers to 'five echoes per inference' and '3 Sphinx packets per inference' without reconciling the client-side vs total packet counts; a short note would avoid confusion.
  4. [§2.7] In the BACAP key derivation, `Hi, Ei, Ki = KDF(Hi−1, i)`, the encryption key `Ei` appears in later equations but its derivation is not expanded; please clarify how `Ei` is computed from the KDF output.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: funion's Theorem 4.4 is an explicit hybrid reduction to the external Echomix and BACAP results, with no fitted parameter or self-citation chain carrying the central claim.

full rationale

The paper's central security claim, Theorem 4.4 (Section 4.3), is an inheritance/reduction argument with bound ε ≤ 4 ε_E + δ, where ε_E is the stated anonymity advantage of one Echomix echo and δ is the stated BACAP box-pair unlinkability. Both advantages come from Echomix [18], whose authors are disjoint from the present paper, so this is an ordinary modular reduction to external results rather than a self-citation or a definitional identity. The hybrids H0→H1→H2→H3 (Section 4.3) replace the four Charlie-visible Sphinx packets and the BACAP records by fresh random values and charge exactly the imported ε_E and δ advantages; no fitted parameter is later relabeled as a prediction, and the bound is not assumed as an input. Lemmas 4.1 and 4.2 (Section 4.1) restate the deterministic timing behavior of the bucket-release policy, and Lemma 4.3 (Section 4.2) gives an explicit reduction under the stated self-receiver model; these are consequences of the definitions, not circular derivations of the target properties. The one author self-citation, [20], appears in Section 6.1 as speculative future work on LoRA-based hidden-state obfuscation and is not load-bearing for any claimed anonymity property. The genuine weaknesses of the paper—that the Echomix anonymity theorem is never stated and its applicability to Charlie's sender-and-receiver echo pattern is not proved, and that honest-but-curious Charlie sees plaintext tensors that hybrid H3 does not randomize—are soundness or assumption-coverage defects, not circularity: they do not show that the claimed conclusion is equivalent to its own input. Accordingly, no circular step is established.

Assumptions & free parameters 3 free parameters · 7 assumptions · 1 invented entities

The paper's security argument is a black-box reduction: it assumes Echomix's anonymity theorem and BACAP's unlinkability bound, then adds a set of modeling assumptions (limited courier-replica collusion, self-receiver model, no early release) to make the reduction work. The performance estimate inherits Echomix's deployment parameters and NVIDIA NIM benchmarks; there are no fitted constants in the security proof itself, but the trust assumptions are narrower than the abstract's wording suggests.

free parameters (3)
  • Latency bucket spacing Δ (Δ = 0.2 s) = 0.2 s
    Chosen by hand in §5.4 for the performance estimate; it controls timing quantization and the n+1 leakage bound in Lemma 4.2, but the bucket index j is public metadata.
  • Mean mix delay µ (µ = 0.20 s) = 0.20 s
    Inherited from Echomix's deployment parameters in §5.2; used in the Erlang timing estimate, not fitted to funion data.
  • Client loop-cover rate λs (2.5 packets/s) = 2.5 pkt/s
    Inherited from Echomix in §5.2; determines the 6.7 GB/day bandwidth floor and the 50 inferences per minute throughput estimate.
assumptions (7)
  • domain assumption Memoryless exponential mixing: each node releases messages after an independent Exp(λ) delay and clients emit Pois(λs) cover traffic.
    Modeling assumption in §4.1, inherited from Echomix; it underlies the traffic-analysis protection.
  • domain assumption Echomix anonymity theorem provides a per-echo advantage bound ε_E when one Sphinx echo is substituted by a random echo.
    Used in hybrids H0 to H2 of Theorem 4.4; the paper cites [18] but never states the exact theorem or proves it applies to echoes terminated at a compute service.
  • domain assumption BACAP unlinkability gives a per-pair advantage bound δ for linking two blinded Box-ID records.
    Used in hybrid H3 and Theorem 4.4; inherited from Echomix and BACAP as a black box.
  • ad hoc to paper Limited courier-replica collusion: for every job, either Charlie is honest or none of the k replicas storing that job collude with him (Assumption 4.1).
    Introduced in §4.1 to make the security reduction go through; it is a strong trust assumption not present in the abstract's claim of 'largely the same trust assumptions'.
  • ad hoc to paper Self-receiver model: each sender is the sole authorized fetcher of the output.
    Stated in §4.1 and used in Lemma 4.3; under this model IO-U ⇒ SRTU is nearly definitional, which weakens the significance of the implication.
  • domain assumption Path independence and constant Sphinx packet size at every layer.
    Section 4.1 modeling assumptions needed for the uniform wire-image and the hybrid argument.
  • domain assumption No early release: honest services wait until the chosen bucket edge before releasing results.
    Design commitment in §3.4 and the 'No early release' assumption in §4.1; needed for Lemma 4.1's leakage bound.
invented entities (1)
  • Latency-bucket release policy (including the overflow flag)
    purpose: Quantizes all observable service release times to a public grid, limiting on-path timing leaks to the bucket index and a 1-bit overflow flag.
    Introduced in §3.4; it is a design mechanism with no falsifiable handle outside the paper, and its leakage bound is the basis for Lemmas 4.1 and 4.2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Anonymous Neural Network Inference." pith.science (2026). https://pith.science/paper/T62PYDR6

@misc{pith2026250518398,
  author       = {Pith},
  title        = {Pith review of: Towards Anonymous Neural Network Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T62PYDR6}},
  note         = {Machine review of arXiv:2505.18398}
}
read the original abstract

We introduce funion, a system providing end-to-end sender-receiver unlinkability for neural network inference. By leveraging the Pigeonhole storage protocol and BACAP (blinding-and-capability) scheme from the Echomix anonymity system, funion inherits the provable security guarantees of modern mixnets. Users can anonymously store input tensors in pseudorandom storage locations, commission compute services to process them via the neural network, and retrieve results with no traceable connection between input and output parties. This store-compute-store paradigm masks both network traffic patterns and computational workload characteristics, while quantizing execution timing into public latency buckets. Our security analysis demonstrates that funion inherits the strong metadata privacy guarantees of Echomix under largely the same trust assumptions, while introducing acceptable overhead for production-scale workloads. Our work paves the way towards an accessible platform where users can submit fully anonymized inference queries to cloud services.

Figures

Figures reproduced from arXiv: 2505.18398 by the authors.

Figure 1
Figure 1. funion store → compute → store workflow. Bob and Ben are storage couriers inside the mixnet; Charlie is a compute courier whose fetch/store requests are themselves anonymized by first entering the mixnet. B/E mark the BA￾CAP boxes handled along each chain. query, the response, nor the fact that such a user made the query should be exposed to prying eyes. At the time of writing, most cloud LLM services lack any type … view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 28 canonical work pages

  1. [1]

    Zero-knowledge proofs of training for deep neural networks

    Kasra Abbaszadeh, Christodoulos Pappas, Jonathan Katz, and Dimitrios Papadopoulos. Zero-knowledge proofs of training for deep neural networks. Cryptology ePrint Archive, Paper 2024/162, 2024

    work page 2024

  2. [2]

    Bender, Timnit Gebru, Angelina McMillan- Major, and Shmargaret Shmitchell

    Emily M. Bender, Timnit Gebru, Angelina McMillan- Major, and Shmargaret Shmitchell. On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM Conference on Fair- ness, Accountability, and Transparency, pages 610–623, Virtual Event, 2021. ACM

    work page 2021

  3. [3]

    Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S

    Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S. Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportunities and risks of Foun- dation Models. arXiv preprint arXiv:2108.07258, 2021

    arXiv 2021

  4. [4]

    Remote timing attacks on efficient language model inference

    Nicholas Carlini and Milad Nasr. Remote timing attacks on efficient language model inference. arXiv preprint arXiv:2410.17175, 2024

    arXiv 2024

  5. [5]

    Compulsion re- sistant anonymous communications

    George Danezis and Jolyon Clulow. Compulsion re- sistant anonymous communications. In Information Hiding, volume 3790 of Lecture Notes in Computer Science, pages 11–25. Springer, 2005

    work page 2005

  6. [6]

    Sphinx: A compact and provably secure mix format

    George Danezis and Ian Goldberg. Sphinx: A compact and provably secure mix format. In Proceedings of the 30th IEEE Symposium on Security and Privacy (S&P 2009), pages 269–282, Oakland, California, USA, May

    work page 2009

  7. [7]

    Statistical dis- closure or intersection attacks on anonymity systems

    George Danezis and Andrei Serjantov. Statistical dis- closure or intersection attacks on anonymity systems. In Information Hiding, volume 3727 of Lecture Notes in Computer Science, pages 293–308. Springer, 2005

    work page 2005

  8. [8]

    Bridging and fin- gerprinting: Epistemic attacks on route selection

    George Danezis and Paul Syverson. Bridging and fin- gerprinting: Epistemic attacks on route selection. In Proceedings of the 8th Privacy Enhancing Technologies Symposium, volume 5134 of Lecture Notes in Computer Science, pages 133–150, Leuven, Belgium, July 2008. Springer

    work page 2008

Show all 36 references
  1. [9]

    Preventing active timing attacks in low-latency anony- mous communication

    Joan Feigenbaum, Aaron Johnson, and Paul Syverson. Preventing active timing attacks in low-latency anony- mous communication. In Proceedings of the 10th Pri- vacy Enhancing Technologies Symposium, volume 6205 of Lecture Notes in Computer Science , pages 166–183, Berlin, German...

    2010

  2. [10]

    An overview of the hybrid argument

    Marc Fischlin and Arno Mittelbach. An overview of the hybrid argument. Cryptology ePrint Archive, Paper 2021/088, 2021

    2021

  3. [11]

    F oundations of Cryptography: V olume 1, Basic Tools

    Oded Goldreich. F oundations of Cryptography: V olume 1, Basic Tools. Cambridge University Press, Cambridge, 2001

    2001

  4. [12]

    Deep Learning

    Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, Cambridge, MA, 2016

    2016

  5. [13]

    Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, Andrew Tulloch, Yangqing Jia, and Kaiming He

    Priya Goyal, Piotr Dollár, Ross B. Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, Andrew Tulloch, Yangqing Jia, and Kaiming He. Accurate, large minibatch SGD: Training ImageNet in 1 hour. arXiv preprint arXiv:1706.02677, 2017

    2017 arXiv

  6. [14]

    Penet remailer, 1996

    Johan “Julf” Helsingius. Penet remailer, 1996

    1996

  7. [15]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large lan- guage models. In International Conference on Learning Representations, 2022

    2022

  8. [16]

    Le, Yonghui Wu, and Zhifeng Chen

    Yanping Huang, Youlong Cheng, Ankur Bapna, Orhan Firat, Dehao Chen, Mia Chen, HyoukJoong Lee, Jiquan Ngiam, Quoc V . Le, Yonghui Wu, and Zhifeng Chen. GPipe: Efficient training of giant neural networks using pipeline parallelism. In Advances in Neural Informa- tion Processing ...

    2019

  9. [17]

    Infeld and David Stainton

    Ewa J. Infeld and David Stainton. Mixnet research review. Technical report, Katzenpost, April 2024. Sup- ported by the Wau Holland Foundation

    2024

  10. [18]

    Infeld, David Stainton, Leif Ryge, and Threebit Hacker

    Ewa J. Infeld, David Stainton, Leif Ryge, and Threebit Hacker. Echomix: A Strong anonymity system with messaging. arXiv preprint arXiv:2501.02933, 2025

    2025 arXiv

  11. [19]

    SentencePiece: A sim- ple and language-independent subword tokenizer and detokenizer for neural text processing

    Taku Kudo and John Richardson. SentencePiece: A sim- ple and language-independent subword tokenizer and detokenizer for neural text processing. InProceedings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations , pages 66–71, Brusse...

    2018

  12. [20]

    Gordon, Stefanie Jegelka, and Ruslan 13 Salakhutdinov

    Peiyuan Liao, Han Zhao, Keyulu Xu, Tommi Jaakkola, Geoffrey J. Gordon, Stefanie Jegelka, and Ruslan 13 Salakhutdinov. Information obfuscation of graph neural networks. In Proceedings of the 38th International Con- ference on Machine Learning, volume 139 of Proceed- ings of Mac...

  13. [21]

    Intel ® software guard extensions (intel ® sgx) support for dynamic memory management inside an enclave

    Frank McKeen, Ilya Alexandrovich, Ittai Anati, Dror Caspi, Simon Johnson, Rebekah Leslie-Hurd, and Car- los Rozas. Intel ® software guard extensions (intel ® sgx) support for dynamic memory management inside an enclave. In Proceedings of the Hardware and Archi- tectural Suppor...

    2016

  14. [22]

    Machine learning with confidential computing: A systematization of knowledge

    Fan Mo, Zahra Tarkhani, and Hamed Haddadi. Machine learning with confidential computing: A systematization of knowledge. ACM computing surveys, 56(11):1–40, 2024

    2024

  15. [23]

    Nvidia nim llms benchmarking, May 2025

    NVIDIA. Nvidia nim llms benchmarking, May 2025

    2025

  16. [24]

    Toploc: A locality sensitive hashing scheme for trustless verifiable inference

    Jack Min Ong, Matthew Di Ferrante, Aaron Pazdera, Ryan Garner, Sami Jaghouar, Manveer Basra, and Jo- hannes Hagemann. Toploc: A locality sensitive hashing scheme for trustless verifiable inference. arXiv preprint arXiv:2501.16007, 2025

    2025 arXiv

  17. [25]

    Hidden no more: Attacking and defending private third-party LLM inference

    Arka Pal, Rahul Krishna Thomas, Louai Zahran, Erica Choi, Akilesh Potti, and Micah Goldblum. Hidden no more: Attacking and defending private third-party LLM inference. In ICLR 2025 Workshop on Building Trust in Language Models and Applications , 2025. Workshop paper

    2025

  18. [26]

    Neural machine translation of rare words with subword units

    Rico Sennrich, Barry Haddow, and Alexandra Birch. Neural machine translation of rare words with subword units. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers), pages 1715–1725, Berlin, Germany, Au- gust 2016. ...

    2016

  19. [27]

    From a trickle to a flood: Active attacks on several mix types

    Andrei Serjantov, Roger Dingledine, and Paul Syverson. From a trickle to a flood: Active attacks on several mix types. In Privacy Enhancing Technologies , volume 2578 of Lecture Notes in Computer Science , pages 32–

  20. [28]

    Timing analy- sis in low-latency mix networks: Attacks and defenses

    Vitaly Shmatikov and Ming-Hsiu Wang. Timing analy- sis in low-latency mix networks: Attacks and defenses. In Computer Security – ESORICS 2006 , volume 4189 of Lecture Notes in Computer Science , pages 18–33. Springer, 2006

    2006

  21. [29]

    Sigy: Breaking intel sgx enclaves with malicious exceptions & signals

    Supraja Sridhara, Andrin Bertschi, Benedict Schlüter, and Shweta Shinde. Sigy: Breaking intel sgx enclaves with malicious exceptions & signals. arXiv preprint arXiv:2404.13998, 2024

    2024 arXiv

  22. [30]

    zk- llm: Zero knowledge proofs for large language models

    Haochen Sun, Jason Li, and Hongyang Zhang. zk- llm: Zero knowledge proofs for large language models. In Proceedings of the 2024 on ACM SIGSAC Confer- ence on Computer and Communications Security , pages 4405–4419, 2024

    2024

  23. [31]

    The bayesian traffic analysis of mix networks

    Carmela Troncoso and George Danezis. The bayesian traffic analysis of mix networks. In Proceedings of the 16th ACM Conference on Computer and Communica- tions Security, pages 369–378, Chicago, IL, USA, 2009. ACM

    2009

  24. [32]

    Gomez, Łukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in Neural Information Processing Systems 30, pages 5998–6008, Long Beach, CA, USA, 2017. Curran Associates, Inc

    2017

  25. [33]

    Will we run out of data? limits of llm scaling based on human- generated data

    Pablo Villalobos, Anson Ho, Jaime Sevilla, Tamay Be- siroglu, Lennart Heim, and Marius Hobbhahn. Will we run out of data? limits of llm scaling based on human- generated data. arXiv preprint arXiv:2211.04325, 2022

    2022 arXiv

  26. [34]

    Roofline: An insightful visual performance model for multicore architectures

    Samuel Williams, Andrew Waterman, and David Patter- son. Roofline: An insightful visual performance model for multicore architectures. Communications of the ACM, 52(4):65–76, 2009

    2009

  27. [35]

    OVERFLOW

    Yuxing Xiang, Xue Li, Kun Qian, Wenyuan Yu, Ennan Zhai, and Xin Jin. ServeGen: Workload characteriza- tion and generation of large language model serving in production, May 2025. A Position Statement Privacy is a fundamental human right. funion embodies this principle while in...

    2025

  28. [2009]

    IEEE Computer Society

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.