Pith. sign in

REVIEW 4 major objections 5 minor 135 references

CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation

T0 review · 4 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CrypTorch compiles MPC-based ML into modular stages and auto-tunes per-layer operator approximations, claiming 1.17–1.38× speedup without accuracy loss over an optimized baseline.

desk verdict Worth taking seriously: a genuinely useful compiler framework for MPC inference, with one load-bearing validation gap around the non-MPC auto-tuning runtime. read the letter →

arxiv 2511.19711 v2 pith:PNVFFYL4 submitted 2025-11-24 cs.CR cs.AIcs.PL

Jinyu Liu , Gang Tan , Kiwan Maeng This is my paper
classification cs.CRcs.AIcs.PL
keywords multi-partycomputationMPC-basedmachinelearningoperatorapproximationauto-tuningcompilerprivateinferencefixed-pointarithmeticPyTorchexportIRaccuracy-performancetradeoff
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that in modern MPC-based machine learning, the dominant remaining bottleneck is no longer matrix multiplication or comparison kernels but the approximations used for operators MPC cannot run natively, such as Softmax, GELU, LayerNorm, and SiLU. Existing frameworks fix these approximations globally, and the paper shows they are often both too inaccurate—ruining output on some inputs—and unnecessarily slow. CrypTorch splits compilation into modular stages, exposes approximations as tunable compiler passes, and automatically chooses an approximation per operator under a user-supplied accuracy budget. On top of a heavily optimized baseline, the auto-tuner alone gives 1.17–1.38× speedup without accuracy loss and 1.22–1.8× when some degradation is allowed; the full framework is 3.22–8.6× faster than CrypTen. The broader point is that approximation selection should be a compiler optimization, not a manual runtime design decision.

What carries the argument

The load-bearing mechanism is the tunable approximation pass combined with per-operator search. CrypTorch represents approximations as compiler passes with explicit knobs, provides a programming interface so new approximations are added as short pass bodies, and uses a greedy or hill-climbing tuner that lowers candidate graphs to a non-MPC PyTorch GPU runtime, compares output quality against the most accurate baseline, and rolls back unacceptable changes. Because graphs at that point are MPC-agnostic export IR, search cost stays low. The backend's formal type and scale rules—secret versus public, integer ring size, scaling-factor propagation, truncation—then make the chosen approximations ex

What would settle it

Run a model from the paper, such as BERT-SST2, under CrypTorch's chosen moderate configuration on a real two-party MPC setup and compare the resulting accuracy against the non-MPC estimate from the auto-tuner's search. If any operator's MPC-specific fixed-point error changes the final accuracy by more than the user's budget, or if two configurations ranked on GPU reverse their ranking on MPC, the 'without accuracy loss' claim is falsified.

Watch

Extended reading notes

Core claim

Operator approximation—not communication or MatMul—is the main performance and accuracy bottleneck in a well-optimized MPC-based ML framework, and it can be removed automatically. CrypTorch makes approximation a compiler stage: a frontend annotates tensor ownership on PyTorch export IR; an approximation stage rewrites unsupported operators into supported ones, each exposing tunable knobs (iteration count, clamping, polynomial degree); an auto-tuner searches these knobs per operator, tests candidates on a fast non-MPC GPU runtime, and rolls back changes that violate an accuracy threshold. A backend then lowers the chosen graph to MPC with formal encryption, scaling, truncation, and comparison

Load-bearing premise

The tuner judges candidate approximations by running them on a non-MPC PyTorch GPU and assumes this reflects their relative accuracy on the real MPC integer-ring runtime, where fixed-point truncation, scaling-factor mismatches, and local-truncation underflow also inject errors.

Editorial extensions

If this is right

  • If correct, the standard practice of hard-coding one approximation per operator globally in an MPC runtime can be replaced by automatic per-layer selection, removing a source of both wasted communication and accuracy failures.
  • Users can specify an accuracy budget (e.g., <0.5%, <2%, <5% degradation) and the tuner trades speed against that budget at operator granularity, including automatically discovering that some LayerNorm and Softmax instances tolerate very aggressive approximations.
  • New approximations can be added as short IR passes rather than by modifying runtime internals, lowering the barrier to adopting future advances in MPC kernels and protocols.
  • The speedup grows with longer BERT sequences and larger batch sizes because approximation tuning cuts communication bytes more than rounds; the benefit holds when models are encrypted, though slightly reduced.
  • Because the IR and backend formalism are separable from the specific MPC runtime, the same auto-tuning idea can be reapplied to other MPC backends once they are ported into the compiler.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to treat the accuracy budget as one axis of a latency–accuracy Pareto search rather than a hard threshold, letting the tuner expose a frontier of configurations instead of a single point.
  • Because the tuner independently rediscovers known MPC-friendly design choices, such as ReLU-like Softmax and low-degree polynomial activations, it could serve as an automated oracle for architecture search: run the tuner on a candidate architecture to see which non-linearities are actually cheap.
  • The non-MPC search step is the main risk point: if fixed-point truncation, scaling-factor mismatch, or local-truncation underflow changes candidate rankings, the chosen configuration could violate a tight budget on the real MPC runtime. A cheap validation would be to run only the tuner's final configuration and its top alternates on real MPC during search.
  • The search currently uses loss on held-out data; using per-layer sensitivity metrics or calibrated uncertainty could reduce the hundreds of candidates tested and shorten the multi-hour search times reported.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents CrypTorch, a multi-stage compiler for MPC-based ML built on PyTorch 2's compiler infrastructure. The authors first engineer CrypTen++, an optimized variant of CrypTen (14.4–96.2× kernel speedups), and use it to characterize MPC inference overheads, finding that operator approximations (Softmax, GELU, SiLU, etc.) dominate in Transformer and EfficientNet models (72.8–97%). CrypTorch separates operator approximation from the MPC runtime, exposes a tunable-pass programming interface, and auto-tunes per-operator approximation choices using a greedy/hill-climbing search that evaluates candidates on a non-MPC PyTorch GPU runtime. The paper claims 1.17–1.38× speedup without sacrificing accuracy and 1.22–1.8× speedup when some accuracy degradation is allowed, on top of CrypTen++; compared to CrypTen, it claims 3.22–8.6× end-to-end speedup. It also formalizes backend translation rules for scaling/truncation/encryption and demonstrates extensibility via a HummingBird auto-tuner pass.

Significance. If validated, CrypTorch would be a practically valuable contribution: it converts a manual, global, and often opaque approximation-selection process into an automatic per-operator compiler stage, and it ships a usable optimized baseline (CrypTen++) as well as a formal specification of MPC-specific lowering rules. The modular design on PyTorch 2's IR is sensible, and the characterization study is a useful update to older overhead analyses. However, the central accuracy-preservation claim currently rests on an unvalidated proxy: candidate approximations are ranked on a non-MPC GPU runtime, while the actual MPC backend introduces fixed-point truncation, scaling-conversion, and underflow errors that are not modeled during the search. No final task accuracy numbers are reported for any tuned configuration, so the 'without accuracy loss' claim is not established by the evidence in the paper.

major comments (4)
  1. [§4.3.2, Figure 8] The load-bearing assumption is stated in §4.3.2: testing on a non-MPC PyTorch GPU runtime 'still captur[es] all the approximation-induced errors.' This is not supported. The search graph is lowered before the MPC backend inserts MPC-specific operations: truncation after every secret multiplication (Sec-Sec Mul, §4.4.2), scaling-factor conversion errors (Sec-PubFloat Add/Mul, §4.4.2), and probabilistic underflow from local truncation (§2.2.1). These errors are not candidate-independent: changing t or the polynomial degree changes the distribution of intermediate values, which can change the sign and magnitude of fixed-point error, and hence which approximation is actually best on the MPC runtime. The paper provides no experiment comparing candidate rankings or final accuracy between the non-MPC search runtime and the real CrypTen++ runtime. Without such validation, the 'without accuracy l
  2. [§6.2, Figure 14] No final task accuracy numbers are reported for CrypTorch-eco, -moderate, or -aggressive. The text and figure only state user-supplied thresholds (<0.5%, <2%, <5%) and report speedups. The claim that CrypTorch-eco 'mostly maintains accuracy' therefore lacks direct evidence. The manuscript should report achieved accuracy (with variance or confidence intervals) for each model and task, for CrypTen++ and for each CrypTorch configuration, and clearly state how many runs were averaged.
  3. [§4.3.2 / §6.1] The output-quality metric used by the auto-tuner is not precisely defined. §4.3.2 says quality is compared with the 'maximally accurate approximation' against a user-given threshold, and §6.1 says both model accuracy and loss were explored with loss working better. The exact loss function, the search dataset size per model, whether the threshold is checked on a held-out split, and the rollback rule are not specified. This matters because the search result—and therefore the speedup numbers—depends on this metric. Please provide the concrete definition and the values used for each experiment.
  4. [§1 / §6.2.1] The speedup claims are reported differently in the abstract, introduction, and evaluation body. The abstract says auto-tuning alone gives 1.21–1.5× and 1.33–1.74×; the introduction says 1.20–1.7× and 1.31–1.8×; §6.2.1 reports LAN 1.20–1.38× / 1.21–1.55× / 1.31–1.7× and WAN 1.19–1.42× / 1.24–1.62× / 1.35–1.80×. The end-to-end CrypTen comparison also varies (abstract 3.74–8.32×, introduction and §6.2.2 3.22–8.6×). The central claim should be stated with one consistent set of numbers and clearly tied to the experimental section.
minor comments (5)
  1. [§3.1 / §4.5] The HummingBird technique [78] is used both inside CrypTen++ as a static guess and as an additional auto-tuned pass in CrypTorch. The paper does isolate its incremental benefit (6–10%, Figure 17), which is good. Given that [78] is a co-authored work of one of the authors, please add an explicit disclosure in the final version.
  2. [§3.2.2, Figure 4] The axis labels in Figure 4 are difficult to read and appear garbled (e.g., the x-axis around '-520/-515/-510' and the labels '5 0 5'). Please redraw with clearer tick labels and larger fonts.
  3. [§4.5] Typo: 'addational speedup' should be 'additional speedup'.
  4. [§6.5] The usability comparison reports lines of code added (3 vs. 46), but no information is given about the complexity or maintainability of the pass interface beyond line counts. Please also provide the actual pass code for LayerNorm in an appendix or artifact.
  5. [§5] The security argument says MPC kernels are secure by themselves and 'their security does not degrade upon composition.' This is stated without reference to standard composition theorems or to the semi-honest threat model. A brief justification or citation would strengthen the claim.

Circularity Check

0 steps flagged · score 2.0 of 10

No derivation-level circularity: the speedup claims are measured on the actual MPC runtime, and the only self-citation (HummingBird) is isolated and not load-bearing. The main caveat is an unvalidated transfer assumption from the non-MPC search runtime to MPC fixed-point behavior, which is a correctness risk rather than a circular step.

full rationale

The paper's central claims are empirical measurements, not quantities derived from a fitted model. The auto-tuner in Section 4.3.2 selects approximations by evaluating output quality on a non-MPC PyTorch GPU runtime, but the reported speedups in Section 6.2.1 are measured end-to-end on the CrypTen++ MPC runtime. No equation-level reduction equates the search-time quality metric to the final MPC accuracy or to the speedup numbers; the speedup is observed, not derived. The backend translation rules in Section 4.4.2 are formalizations of standard fixed-point scaling and do not constitute a prediction that is forced by construction. The only notable self-citation is [78] (HummingBird), by co-author Maeng, used in the CrypTen++ baseline and as an additional pass. This is not load-bearing: the auto-tuning speedup is reported on top of CrypTen++, which already includes the HummingBird-based improvements, and Figure 17 isolates the additional benefit of the CrypTorch HummingBird tuner at only 6-10%. The paper also explicitly states its HummingBird implementation 'does not follow the original proposal's search strategy exactly' and is a proof-of-concept, further reducing any reliance on the self-cited work. The genuine risk flagged by the paper's own design is Section 4.3.2's statement that testing on a non-MPC GPU runtime 'still captur[es] all the approximation-induced errors.' The MPC backend in Section 4.4.2 inserts truncation, scaling-factor conversion, and probabilistic underflow effects (Section 2.2.1, Sec-Sec Mul, Sec-PubFloat Add) that the non-MPC GPU runtime does not model. If those fixed-point effects change the relative ranking of approximation candidates, the selected configurations could violate the user's accuracy budget on the real MPC runtime. The paper reports no experiment comparing candidate rankings or final task accuracy on CrypTen++ versus the non-MPC search runtime. This is an internal-correctness / validation gap, not circularity: the speedup is not a consequence of the search metric, and the accuracy claim is an empirical transfer assumption rather than an equation that reduces to its input. There is also a wording inconsistency: the abstract/intro claim 'without sacrificing accuracy' is looser than the Section 6.2.1 definition of CrypTorch-eco as tolerating '< 0.5% accuracy degradation.' That is a reporting discrepancy, not a circular derivation. Overall, the central auto-tuning speedup claims have independent empirical content, so the

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

CrypTorch introduces no new cryptographic primitives or physical entities. The central claim rests on empirical assumptions about approximation-error dominance, the fidelity of non-MPC testing, and the representativeness of the search data, plus inherited MPC protocol security assumptions.

free parameters (3)
  • Accuracy budget thresholds = 0.5% / 2% / 5%
    User-specified bounds used by the auto-tuner. All reported speedup ranges are conditional on these choices, and no sensitivity analysis across threshold values is shown.
  • Fixed-point scale s_d = 2^16
    Inherited from CrypTen; determines truncation error in the backend. The paper uses it without evaluating its effect on the accuracy of tuned approximations.
  • Search dataset sizes = 8k (BERT) / 10k (image models)
    Chosen by hand for the auto-tuner; the speedup/accuracy results depend on this choice and on the held-out split being representative.
assumptions (5)
  • domain assumption Underlying MPC protocols (Beaver triples, GMW, CUTLASS kernels, HummingBird) are secure and correct as claimed by their original papers.
    Section 2.1.2: 'We reuse low-level MPC protocols and kernel designs from existing literature and build atop them, assuming they are secure.'
  • ad hoc to paper Approximation output quality measured on a non-MPC GPU runtime is a faithful proxy for final MPC output quality.
    Section 4.3.2: The auto-tuner lowers candidates to a PyTorch GPU runtime to test output quality; this ignores MPC fixed-point truncation and underflow effects.
  • domain assumption Parties are semi-honest and non-colluding.
    Section 2.1.2: 'We assume the parties do not collude... and the parties are semi-honest.'
  • domain assumption The held-out search dataset is representative of deployment inputs and can be treated as public.
    Section 5: 'the approximation auto-tuner... relies on a representative training data that is considered public' and assumes deployment inputs follow the same distribution.
  • ad hoc to paper Per-operator approximation choices compose independently, so greedy/hill-climbing search over individual operators reaches a safe global configuration.
    CrypTorch tunes at per-operator granularity and relies on the search to capture context-dependent error tolerance; no formal guarantee is provided for composition of many tuned approximations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation." pith.science (2026). https://pith.science/paper/PNVFFYL4

@misc{pith2026251119711,
  author       = {Pith},
  title        = {Pith review of: CrypTorch: PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PNVFFYL4}},
  note         = {Machine review of arXiv:2511.19711}
}
read the original abstract

MPC-based ML uses multi-party computation (MPC) to run machine learning (ML) workloads across multiple parties without each having to share their private data or model parameters. However, existing frameworks frequently degrade accuracy and performance due to a series of MPC-specific transformations that add errors and overheads. These transformations are mostly opaque to users, making it hard to find and/or optimize problematic transformations. We propose CrypTorch, a modular, extensible, and iteratively-testable compiler framework for MPC-based ML. CrypTorch splits MPC-specific transformations into modular compilation stages, allowing users to easily inspect and optimize them. CrypTorch emits an executable graph after each transformation, allowing iterative testing to pinpoint any problematic transformations. Building on these features, CrypTorch automatically chooses a set of transformations from a pool of choices to balance performance and accuracy during the operator approximation stage, which we identified as the biggest contributor to accuracy/performance degradation. CrypTorch's auto-tuning alone provides 1.21-1.5x speedup without accuracy loss, and 1.33-1.74x speedup when some accuracy degradation is allowed. Combined with better engineering and adoption of state-of-the-art practices (made easier due to CrypTorch's modular design), CrypTorch brings 3.74-8.32x end-to-end speedup compared to the popular CrypTen. CrypTorch is built as an extension to PyTorch 2's compiler.

Figures

Figures reproduced from arXiv: 2511.19711 by the authors.

Figure 1
Figure 1. Scenarios for MPC-based ML. MPC-based ML frameworks run ML training/inference with￾out the parties having to reveal their secret data or model weights to others. Existing frameworks can be categorized into either client-server MPC or multi-server MPC. Client￾server MPC [16, 32, 46, 53, 70, 73, 81, 83, 89, 95] assumes MPC between a powerful server and a less-powerful client device (e.g., smartphone). They run linear … view at source ↗
Figure 3
Figure 3. Overhead breakdown from CrypTen++. The thick contour shows the breakdown between higher [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 2
Figure 2. Speedups from CrypTen++’s kernels compared to the original CrypTen’s. CrypTen++ adopted the following optimizations. First, it replaced the slow 64-bit integer MatMul and Conv2d kernels from CrypTen with more efficient ones based on the NVIDIA CUTLASS [86] library, as suggested by several recent works [40, 76, 120]. This improved the per￾formance of these compute kernels by 96.2× and 14.4×, respectively, on our A500… view at source ↗
Figures from the paper (14 more)
Figure 4
Figure 4. Figure 4: Functional behavior (left) and the latency (right) for various MPC approximations for [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Overview of CrypTorch. Compared to existing approaches where the approximation of an operation [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: User-level code for CrypTorch. 4.2.1 Programming Model and IR [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: During the search, each candidate is lowered to a non-MPC GPU runtime and tested. [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 7
Figure 7. Figure 7: Approximation with tunable knobs (highlighted). [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 9
Figure 9. Figure 9: Grammar for the input graph to the CrypTorch compiler backend. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Grammar for the output of the CrypTorch compiler backend. [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: Rules for encryption. 𝐸 contains the normal (non-MPC) add/mul-like operators (⊕, ⊗), and is additionally equipped with MPC-specific operators. 𝐸 has an MPC version of mul-like operators (⊗𝑀𝑃𝐶) and an MPC version of less-than-zero (ltz𝑀𝑃𝐶), which correspond to the MPC …
Figure 12
Figure 12. Figure 12: Rules for add-like operators. Γ ⊢ 𝑒1 ⇒𝑖 𝐸1 : ⟨Sec, Int𝑑, 𝑠1⟩ Γ ⊢ 𝑒2 ⇒𝑖 𝐸2 : ⟨Sec, Int𝑑, 𝑠2⟩ min(𝑠1, 𝑠2) = 𝑠𝑚𝑖𝑛 max(𝑠1, 𝑠2) = 𝑠𝑚𝑎𝑥 Γ ⊢ ⊗(𝑒1, 𝑒2) ⇒𝑖 trunc(⊗𝑀𝑃𝐶 (𝐸1, 𝐸2), 𝑠𝑚𝑖𝑛) : ⟨Sec, Int𝑑, 𝑠𝑚𝑎𝑥 ⟩ (Sec-Sec Mul) Γ ⊢ 𝑒1 ⇒𝑖 𝐸1 : ⟨Sec, Int𝑑, 𝑠1⟩ Γ ⊢ 𝑒2 ⇒𝑖 𝐸2 : ⟨Pub,𝑖𝑡, 𝑠2⟩ …
Figure 13
Figure 13. Figure 13: Rules for mul-like operators. CrypTorch always performs the addition in party 0. Again, if the two scaling factors do not match, CrypTorch adds a scale operator. When adding a secret and a public floating-point (Sec-PubFloat Add), the floating-point is first converted…
Figure 14
Figure 14. Figure 14: End-to-end speedup of CrypTorch with a varying degree of approximation (-eco tolerates <0.5% [PITH_FULL_IMAGE:figures/full_fig_p016_14.png]
Figure 15
Figure 15. Figure 15: Visualization of the auto-tuner results from CrypTorch-moderate. The x-axis shows each operator, [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]
Figure 16
Figure 16. Figure 16: Speedup over CrypTen++ under various param [PITH_FULL_IMAGE:figures/full_fig_p018_16.png]
Figure 17
Figure 17. Figure 17: Impact of HummingBird auto-tuning vs. ap [PITH_FULL_IMAGE:figures/full_fig_p019_17.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

135 extracted references · 15 canonical work pages

  1. [1]

    Kusner, and Adrià Gascón

    Nitin Agrawal, Ali Shahin Shamsabadi, Matt J. Kusner, and Adrià Gascón. 2019. QUOTIENT: Two-Party Secure Neural Network Training and Prediction. InProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, London, UK, November 11-15, 2019. ACM, 1231–1247. doi:10.1145/3319535.3339819

    arXiv 2019

  2. [2]

    Chandrakasan, Vinod Vaikuntanathan, and Ajay Joshi

    Rashmi Agrawal, Leo de Castro, Guowei Yang, Chiraag Juvekar, Rabia Tugce Yazicigil, Anantha P. Chandrakasan, Vinod Vaikuntanathan, and Ajay Joshi. 2023. FAB: An FPGA-based Accelerator for Bootstrappable Fully Homomorphic Encryption. InIEEE International Symposium on High-Performance Computer Architecture, HPCA 2023, Montreal, QC, Canada, February 25 - Mar...

    arXiv 2023

  3. [3]

    Amazon. 2023. Amazon Echo & Alexa Devices. https://www.amazon.com/smart-home-devices/b?ie=UTF8&node= 9818047011

    2023

  4. [4]

    AMD. 2023. AMD Secure Encrypted Virtualization (SEV). https://www.amd.com/en/developer/sev.html

    2023

  5. [5]

    hack_softmax

    anakinxc. 2025. "hack_softmax" (spu/examples/python/ml/flax_llama7b/flax_llama7b.py, Line 56). https://github.com/secretflow/spu/blob/e86227631b115f5983aef8315adde387e0c0f63a/examples/python/ml/ flax_llama7b/flax_llama7b.py#L56

    2025

  6. [6]

    Jason Ansel, Edward Z. Yang, Horace He, Natalia Gimelshein, Animesh Jain, Michael Voznesensky, Bin Bao, Peter Bell, David Berard, Evgeni Burovski, Geeta Chauhan, Anjali Chourdia, Will Constable, Alban Desmaison, Zachary DeVito, Elias Ellison, Will Feng, Jiong Gong, Michael Gschwind, Brian Hirsh, Sherlock Huang, Kshiteej Kalambarkar, Laurent Kirsch, Michae...

    arXiv 2024

  7. [7]

    Apple. 2024. Private Cloud Compute: A new frontier for AI privacy in the cloud. https://security.apple.com/blog/ private-cloud-compute/

    2024

  8. [8]

    Arm. 2023. TrustZone for Cortex-A. https://www.arm.com/technologies/trustzone-for-cortex-a

    2023

Show all 135 references
  1. [9]

    Donald Beaver. 1991. Efficient Multiparty Protocols Using Circuit Randomization. InAdvances in Cryptology - CRYPTO ’91, 11th Annual International Cryptology Conference, Santa Barbara, California, USA, August 11-15, 1991, Proceedings (Lecture Notes in Computer Science, Vol. 576...

    1991 doi

  2. [10]

    Dan Bogdanov, Sven Laur, and Jan Willemson. 2008. Sharemind: A Framework for Fast Privacy-Preserving Com- putations. InComputer Security - ESORICS 2008, 13th European Symposium on Research in Computer Security, Málaga, Spain, October 6-8, 2008. Proceedings (Lecture Notes in Co...

    2008 doi

  3. [11]

    Megha Byali, Harsh Chaudhari, Arpita Patra, and Ajith Suresh. 2020. FLASH: Fast and Robust Framework for Privacy- preserving Machine Learning.Proc. Priv. Enhancing Technol.2020, 2 (2020), 459–480. doi:10.2478/popets-2020-0036

    2020 doi

  4. [12]

    Han Cai, Chuang Gan, Tianzhe Wang, Zhekai Zhang, and Song Han. 2020. Once-for-All: Train One Network and Specialize it for Efficient Deployment. In8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net. htt...

    2020

  5. [13]

    Han Cai, Ligeng Zhu, and Song Han. 2019. ProxylessNAS: Direct Neural Architecture Search on Target Task and Hardware. InInternational Conference on Learning Representations. https://openreview.net/forum?id=HylVB3AqYm

    2019

  6. [14]

    Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Shuang Song, Abhradeep Thakurta, and Florian Tramèr. 2020. An Attack on InstaHide: Is Private Learning Possible with Instance Encoding?CoRRabs/2011.05315 (2020). arXiv:2011.05315 http...

    2020 arXiv

  7. [15]

    Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Thomas Steinke, Jonathan Hayase, A Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, et al. 2024. Stealing part of a production language model.arXiv preprint arXiv:2403.06634(2024). 22 Jinyu L...

    2024 arXiv

  8. [16]

    Nishanth Chandran, Divya Gupta, Aseem Rastogi, Rahul Sharma, and Shardul Tripathi. 2019. EzPC: Programmable and Efficient Secure Two-Party Computation for Machine Learning. InIEEE European Symposium on Security and Privacy, EuroS&P 2019, Stockholm, Sweden, June 17-19, 2019. IE...

    2019

  9. [17]

    Harsh Chaudhari, Ashish Choudhury, Arpita Patra, and Ajith Suresh. 2019. ASTRA: High Throughput 3PC over Rings with Application to Secure Prediction. InProceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop(London, United Kingdom)(CCSW’19). Associat...

    2019

  10. [18]

    Harsh Chaudhari, Rahul Rachuri, and Ajith Suresh. 2019. Trident: Efficient 4PC Framework for Privacy Preserving Machine Learning. Cryptology ePrint Archive, Paper 2019/1315. doi:10.14722/ndss.2020.23005

    2019

  11. [19]

    Wahby, Fraser Brown, and Wenting Zheng

    Edward Chen, Jinhao Zhu, Alex Ozdemir, Riad S. Wahby, Fraser Brown, and Wenting Zheng. 2023. Silph: A Framework for Scalable and Accurate Generation of Hybrid MPC Protocols. In44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023. IEEE, ...

    2023

  12. [20]

    Siddhartha Chhabra, Brian Rogers, Yan Solihin, and Milos Prvulovic. 2011. SecureME: a hardware-software approach to full system security. InProceedings of the 25th International Conference on Supercomputing, 2011, Tucson, AZ, USA, May 31 - June 04, 2011, David K. Lowenthal, Br...

    2011

  13. [21]

    Minsu Cho, Zahra Ghodsi, Brandon Reagen, Siddharth Garg, and Chinmay Hegde. 2022. Sphynx: A Deep Neural Network Design for Private Inference.IEEE Secur. Priv.20, 5 (2022), 22–34. doi:10.1109/MSEC.2022.3165475

    2022

  14. [22]

    Minsu Cho, Ameya Joshi, Brandon Reagen, Siddharth Garg, and Chinmay Hegde. 2022. Selective Network Linearization for Efficient Private Inference. InInternational Conference on Machine Learning, ICML 2022, 17- 23 July 2022, Baltimore, Maryland, USA (Proceedings of Machine Learn...

    2022

  15. [23]

    Wonseok Choi, Jongmin Kim, and Jung Ho Ahn. 2025. Cheddar: A Swift Fully Homomorphic Encryption Library Designed for GPU Architectures.arXiv preprint arXiv:2407.13055(2025)

    2025 arXiv

  16. [24]

    Daniel Demmler, Thomas Schneider, and Michael Zohner. 2015. ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation. In22nd Annual Network and Distributed System Security Symposium, NDSS 2015, San Diego, California, USA, February 8-11, 2015. The Internet So...

    2015

  17. [25]

    Naren Dhyani, Jianqiao Mo, Minsu Cho, Ameya Joshi, Siddharth Garg, Brandon Reagen, and Chinmay Hegde. 2023. PriViT: Vision Transformers for Fast Private Inference.CoRRabs/2310.04604 (2023). doi:10.48550/ARXIV.2310.04604 arXiv:2310.04604

    2023 doi arXiv

  18. [26]

    Ye Dong, Wen-jie Lu, Yancheng Zheng, Haoqi Wu, Derun Zhao, Jin Tan, Zhicong Huang, Cheng Hong, Tao Wei, and Wenguang Chen. 2023. PUMA: Secure Inference of LLaMA-7B in Five Minutes.CoRRabs/2307.12533 (2023). doi:10.48550/ARXIV.2307.12533 arXiv:2307.12533

    2023 doi

  19. [27]

    Austin Ebel, Karthik Garimella, and Brandon Reagen. 2025. Orion: A Fully Homomorphic Encryption Framework for Deep Learning. InProceedings of the 30th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2(Rotterdam, Net...

    2025

  20. [28]

    EPFL-LDS. 2021. Lattigo v2.3.0. https://github.com/ldsec/lattigo

    2021

  21. [29]

    facebookresearch. 2025. CrypTen/crypten/mpc/primitives/arithmetic.py, Line 362. https://github.com/ facebookresearch/CrypTen/blob/775868a02d6dac50774ce376a55b01fbd8bd85b6/crypten/mpc/primitives/arithmetic. py#L362

    2025

  22. [30]

    Liyue Fan. 2018. Image Pixelization with Differential Privacy. InData and Applications Security and Privacy XXXII - 32nd Annual IFIP WG 11.3 Conference, DBSec 2018, Bergamo, Italy, July 16-18, 2018, Proceedings (Lecture Notes in Computer Science, Vol. 10980), Florian Kerschbau...

    2018 doi

  23. [31]

    Liyue Fan. 2019. Differential privacy for image publication. InTheory and Practice of Differential Privacy (TPDP) Workshop, Vol. 1. 6

    2019

  24. [32]

    Karthik Garimella, Zahra Ghodsi, Nandan Kumar Jha, Siddharth Garg, and Brandon Reagen. 2023. Characterizing and Optimizing End-to-End Systems for Private Inference. InProceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Op...

    2023

  25. [33]

    Karthik Garimella, Nandan Kumar Jha, and Brandon Reagen. 2021. Sisyphus: A Cautionary Tale of Using Low- Degree Polynomial Activations in Privacy-Preserving Deep Learning.CoRRabs/2107.12342 (2021). arXiv:2107.12342 https://arxiv.org/abs/2107.12342 CrypTorch : PyTorch-based Aut...

    2021 arXiv

  26. [34]

    Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. InProceedings of the 41st Annual ACM Symposium on Theory of Computing, STOC 2009, Bethesda, MD, USA, May 31 - June 2, 2009, Michael Mitzenmacher (Ed.). ACM, 169–178. doi:10.1145/1536414.1536440

    2009

  27. [35]

    Lauter, Michael Naehrig, and John Wernsing

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin E. Lauter, Michael Naehrig, and John Wernsing. 2016. In Proceedings of the 33nd International Conference on Machine Learning, ICML 2016, New York City, NY, USA, June 19-24, 2016 (JMLR Workshop and Conference Proceedings, Vo...

    2016

  28. [36]

    Oded Goldreich, Silvio Micali, and Avi Wigderson. 1991. Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems.J. ACM38, 3 (July 1991), 690–728. doi:10.1145/116825.116852

    1991

  29. [37]

    Google-BERT. 2018. BERT base model (uncased). https://huggingface.co/google-bert/bert-base-uncased

    2018

  30. [38]

    Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nishanth Chandran, Divya Gupta, Ashish Panwar, and Rahul Sharma. 2024. SIGMA: Secure GPT Inference with Function Secret Sharing.Proc. Priv. Enhancing Technol.2024, 4 (2024), 61–79. doi:10.56553/POPETS-2024-0107

    2024 doi

  31. [39]

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. 2022. Iron: Private Inference on Transformers. InAdvances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA...

    2022

  32. [40]

    Christopher Harth-Kitzerow, Yongqin Wang, Rachit Rajat, Georg Carle, and Murali Annavaram. 2025. PIGEON: A High Throughput Framework for Private Inference of Neural Networks using Secure Multiparty Computation.Proc. Priv. Enhancing Technol.2025, 3 (2025), 88–105. doi:10.56553/...

    2025 doi

  33. [41]

    Marcella Hastings, Brett Hemenway, Daniel Noble, and Steve Zdancewic. 2019. SoK: General Purpose Compilers for Secure Multi-Party Computation. In2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019. IEEE, 1220–1237. doi:10.1109/SP.2019.00028

    2019

  34. [42]

    Trang-Thi Ho, Khoa-Dang Tran, and Yennun Huang. 2022. FedSGDCOVID: Federated SGD COVID-19 Detection under Local Differential Privacy Using Chest X-ray Images and Symptom Information.Sensors22, 10 (2022), 3728

    2022

  35. [43]

    Andreas Holzer, Martin Franz, Stefan Katzenbeisser, and Helmut Veith. 2012. Secure two-party computations in ANSI C. Inthe ACM Conference on Computer and Communications Security, CCS’12, Raleigh, NC, USA, October 16-18, 2012, Ting Yu, George Danezis, and Virgil D. Gligor (Eds....

    2012

  36. [44]

    Google Home. 2023. Brands you love, united with Google Home. https://home.google.com/explore-devices/

    2023

  37. [45]

    Pengzhi Huang, Thang Hoang, Yueying Li, Elaine Shi, and G Edward Suh. 2022. STAMP: Lightweight TEE-Assisted MPC for Efficient Privacy-Preserving Machine Learning.arXiv preprint arXiv:2210.10133(2022)

    2022 arXiv

  38. [46]

    Zhicong Huang, Wen-jie Lu, Cheng Hong, and Jiansheng Ding. 2022. Cheetah: Lean and Fast Secure Two-Party Deep Neural Network Inference. In31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022, Kevin R. B. Butler and Kurt Thomas (Eds.). USENI...

    2022

  39. [47]

    Intel. 2023. Intel®Software Guard Extensions. https://www.intel.com/content/www/us/en/developer/tools/software- guard-extensions/overview.html

    2023

  40. [49]

    Siddharth Jayashankar, Edward Chen, Tom Tang, Wenting Zheng, and Dimitrios Skarlatos. 2025. Cinnamon: A Frame- work for Scale-Out Encrypted AI. InProceedings of the 30th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volu...

    2025

  41. [50]

    Nandan Kumar Jha, Zahra Ghodsi, Siddharth Garg, and Brandon Reagen. 2021. DeepReDuce: ReLU Reduction for Fast Private Inference. InProceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event (Proceedings of Machine Learning R...

    2021

  42. [51]

    Nandan Kumar Jha and Brandon Reagen. 2023. DeepReShape: Redesigning Neural Networks for Efficient Private Inference.arXiv preprint arXiv:2304.10593(2023)

    2023 arXiv

  43. [52]

    Wonkyung Jung, Sangpyo Kim, Jung Ho Ahn, Jung Hee Cheon, and Younho Lee. 2021. Over 100x Faster Bootstrapping in Fully Homomorphic Encryption through Memory-centric Optimization with GPUs.IACR Trans. Cryptogr. Hardw. Embed. Syst.2021, 4 (2021), 114–148. doi:10.46586/tches.v202...

    2021 doi

  44. [53]

    Chandrakasan

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha P. Chandrakasan. 2018. GAZELLE: A Low Latency Framework for Secure Neural Network Inference. In27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018, William Enck and Adrienne Porter Felt...

    2018

  45. [54]

    Marcel Keller. 2020. MP-SPDZ: A Versatile Framework for Multi-Party Computation. InCCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13, 2020, Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vigna (Eds.). ACM, 1575...

    2020

  46. [55]

    Mustakimur Rahman Khandaker, Yueqiang Cheng, Zhi Wang, and Tao Wei. 2020. COIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX. InASPLOS ’20: Architectural Support for Programming Languages and Operating Systems, Lausanne, Switzerland, March 16-20, 2020, James R....

    2020

  47. [56]

    Donghwan Kim, Jaiyoung Park, Jongmin Kim, Sangpyo Kim, and Jung Ho Ahn. 2023. HyPHEN: A Hybrid Packing Method and Optimizations for Homomorphic Encryption-Based Neural Networks.CoRRabs/2302.02407 (2023). doi:10.48550/arXiv.2302.02407 arXiv:2302.02407

    2023 doi arXiv

  48. [57]

    Jongmin Kim, Gwangho Lee, Sangpyo Kim, Gina Sohn, Minsoo Rhu, John Kim, and Jung Ho Ahn. 2022. ARK: Fully Homomorphic Encryption Accelerator with Runtime Data Generation and Inter-Operation Key Reuse. In55th IEEE/ACM International Symposium on Microarchitecture, MICRO 2022, Ch...

    2022

  49. [58]

    Sangpyo Kim, Jongmin Kim, Michael Jaemin Kim, Wonkyung Jung, John Kim, Minsoo Rhu, and Jung Ho Ahn. 2022. BTS: an accelerator for bootstrappable fully homomorphic encryption. InISCA ’22: The 49th Annual International Symposium on Computer Architecture, New York, New York, USA,...

    2022

  50. [59]

    Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten

    Brian Knott, Shobha Venkataraman, Awni Y. Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten

  51. [60]

    Nishant Kumar, Mayank Rathee, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. 2020. CrypT- Flow: Secure TensorFlow Inference. In2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, May 18-21, 2020. IEEE, 336–353. doi:10.1109/SP40000.2020.00092

    2020

  52. [61]

    Souvik Kundu, Shunlin Lu, Yuke Zhang, Jacqueline Tiffany Liu, and Peter A. Beerel. 2023. Learning to Linearize Deep Neural Networks for Secure and Efficient Private Inference. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1...

    2023

  53. [62]

    Lee, Vijay Janapa Reddi, Gu-Yeon Wei, David Brooks, and G

    Maximilian Lam, Jeff Johnson, Wenjie Xiong, Kiwan Maeng, Udit Gupta, Minsoo Rhu, Hsien-Hsin S. Lee, Vijay Janapa Reddi, Gu-Yeon Wei, David Brooks, and G. Edward Suh. 2024. GPU-based Private Information Retrieval for On-Device Machine Learning Inference. InProceedings of the 29...

    2024 doi arXiv

  54. [63]

    Chris Lattner and Vikram S. Adve. 2004. LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation. In2nd IEEE / ACM International Symposium on Code Generation and Optimization (CGO 2004), 20-24 March 2004, San Jose, CA, USA. IEEE Computer Society, 75–88. doi...

    2004 arXiv

  55. [64]

    Dayeol Lee, David Kohlbrenner, Shweta Shinde, Krste Asanovic, and Dawn Song. 2020. Keystone: an open framework for architecting trusted execution environments. InEuroSys ’20: Fifteenth EuroSys Conference 2020, Heraklion, Greece, April 27-30, 2020, Angelos Bilas, Kostas Magouti...

    2020

  56. [65]

    Lee, Peter C

    Ruby B. Lee, Peter C. S. Kwan, John Patrick McGregor, Jeffrey S. Dwoskin, and Zhenghong Wang. 2005. Architecture for Protecting Critical Secrets in Microprocessors. In32st International Symposium on Computer Architecture (ISCA 2005), 4-8 June 2005, Madison, Wisconsin, USA. IEE...

    2005 doi

  57. [66]

    Xing, and Hao Zhang

    Dacheng Li, Rulin Shao, Hongyi Wang, Han Guo, Eric P. Xing, and Hao Zhang. 2022. MPCFormer: fast, perfor- mant and private Transformer inference with MPC.CoRRabs/2211.01452 (2022). doi:10.48550/ARXIV.2211.01452 arXiv:2211.01452

    2022 doi arXiv

  58. [67]

    Yunsheng Li, Yinpeng Chen, Xiyang Dai, Dongdong Chen, Mengchen Liu, Lu Yuan, Zicheng Liu, Lei Zhang, and Nuno Vasconcelos. 2021. MicroNet: Improving Image Recognition with Extremely Low FLOPs. In2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC...

    2021

  59. [68]

    Mitchell, Chandramohan A

    David Lie, John C. Mitchell, Chandramohan A. Thekkath, and Mark Horowitz. 2003. Specifying and Verifying Hardware for Tamper-Resistant Software. In2003 IEEE Symposium on Security and Privacy (S&P 2003), 11-14 May 2003, Berkeley, CA, USA. IEEE Computer Society, 166. doi:10.1109...

    2003 arXiv

  60. [69]

    Chang Liu, Xiao Shaun Wang, Kartik Nayak, Yan Huang, and Elaine Shi. 2015. ObliVM: A Programming Framework for Secure Computation. In2015 IEEE Symposium on Security and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015. IEEE Computer Society, 359–376. doi:10.1109/SP.2015.29...

    2015 doi

  61. [71]

    Weijie Liu, Hongbo Chen, XiaoFeng Wang, Zhi Li, Danfeng Zhang, Wenhao Wang, and Haixu Tang. 2021. Under- standing TEE containers, easy to use? Hard to trust.arXiv preprint arXiv:2109.01923(2021)

    2021 arXiv

  62. [72]

    Qian Lou, Yilin Shen, Hongxia Jin, and Lei Jiang. 2021. SAFENet: A Secure, Accurate and Fast Neural Network Inference. In9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net. https://openreview.net/forum?id=...

    2021

  63. [73]

    Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Cheng Hong, Kui Ren, Tao Wei, and Wenguang Chen

  64. [74]

    Jinglong Luo, Yehong Zhang, Jiaqi Zhang, Xin Mu, Hui Wang, Yue Yu, and Zenglin Xu. 2024. SecFormer: Towards Fast and Accurate Privacy-Preserving Inference for Large Language Models.CoRRabs/2401.00793 (2024). doi:10. 48550/ARXIV.2401.00793 arXiv:2401.00793

    2024 doi arXiv

  65. [75]

    lvdmaaten. 2022. comment on: How to directly define the LayerNorm module? https://github.com/facebookresearch/ CrypTen/issues/399#issuecomment-1229263703

    2022

  66. [76]

    Junming Ma, Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi Wu, Wenjing Fang, Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang. 2023. SecretFlow-SPU: A Performant and User-Friendly Framework for Privacy-Preserving Machine Learning. InProceedings of the 2023 USENIX Annual Technical C...

    2023

  67. [77]

    Edward Suh

    Kiwan Maeng, Chuan Guo, Sanjay Kariyappa, and G. Edward Suh. 2023. Bounding the Invertibility of Privacy- preserving Instance Encoding using Fisher Information. InAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2...

    2023

  68. [78]

    Edward Suh

    Kiwan Maeng and G. Edward Suh. 2023. Approximating ReLU on a Reduced Ring for Efficient MPC-based Private Inference. arXiv:2309.04875 [cs.LG] https://arxiv.org/abs/2309.04875

    2023 arXiv

  69. [79]

    Meta. 2023. Meta Portal Go. https://www.meta.com/portal/products/portal-go/

    2023

  70. [80]

    Microsoft. 2025. Azure Confidential Computing. https://learn.microsoft.com/en-us/azure/confidential-computing/

    2025

  71. [81]

    Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan, Wenting Zheng, and Raluca Ada Popa. 2020. Delphi: A Cryptographic Inference Service for Neural Networks. In29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020, Srdjan Capkun and Franziska Roesner (Eds....

    2020

  72. [82]

    Payman Mohassel and Peter Rindal. 2018. ABY 3: A Mixed Protocol Framework for Machine Learning. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, ON, Canada, October 15-19, 2018, David Lie, Mohammad Mannan, Michael Back...

    2018

  73. [83]

    Payman Mohassel and Yupeng Zhang. 2017. SecureML: A System for Scalable Privacy-Preserving Machine Learning. In2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017. IEEE Computer Society, 19–38. doi:10.1109/SP.2017.12

    2017 doi

  74. [84]

    Benjamin Mood, Debayan Gupta, Henry Carter, Kevin R. B. Butler, and Patrick Traynor. 2016. Frigate: A Validated, Extensible, and Efficient Compiler and Interpreter for Secure Computation. InIEEE European Symposium on Security and Privacy, EuroS&P 2016, Saarbrücken, Germany, Ma...

    2016 doi

  75. [85]

    NVIDIA. 2023. NVIDIA Confidential Computing. https://www.nvidia.com/en-us/data-center/solutions/confidential- computing/

    2023

  76. [86]

    NVIDIA. 2025. CUTLASS 4.3.0. https://github.com/NVIDIA/cutlass

    2025

  77. [87]

    OpenAI. 2023. Introducing ChatGPT. https://openai.com/blog/chatgpt

    2023

  78. [88]

    Qi Pang, Yuanyuan Yuan, and Shuai Wang. 2024. MPCDiff: Testing and Repairing MPC-Hardened Deep Learning Models. In31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024. The Internet Society. https://ww...

    2024

  79. [89]

    Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. 2024. BOLT: Privacy-Preserving, Accurate and Efficient Inference for Transformers. InIEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024. IEEE, 4753–4771. doi:10.110...

    2024

  80. [90]

    Jaiyoung Park, Michael Jaemin Kim, Wonkyung Jung, and Jung Ho Ahn. 2022. AESPA: Accuracy Preserving Low-degree Polynomial Activation for Fast Private Inference.CoRRabs/2201.06699 (2022). arXiv:2201.06699 https://arxiv.org/abs/2201.06699

    2022 arXiv

  81. [91]

    Arpita Patra and Ajith Suresh. 2020. BLAZE: Blazing Fast Privacy-Preserving Machine Learning. In27th Annual Network and Distributed System Security Symposium, NDSS 2020, San Diego, California, USA, February 23-26, 2020. The Internet Society. https://www.ndss-symposium.org/ndss...

    2020

  82. [92]

    PyTorch. 2025. Models and pre-trained weights. https://docs.pytorch.org/vision/stable/models.html

    2025

  83. [93]

    Hammer, and Michael Hicks

    Aseem Rastogi, Matthew A. Hammer, and Michael Hicks. 2014. Wysteria: A Programming Language for Generic, Mixed-Mode Multiparty Computations. In2014 IEEE Symposium on Security and Privacy, SP 2014, Berkeley, CA, USA, May 18-21, 2014. IEEE Computer Society, 655–670. doi:10.1109/...

    2014 doi

  84. [95]

    Deevashwer Rathee, Mayank Rathee, Nishant Kumar, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. 2020. CrypTFlow2: Practical 2-Party Secure Inference. InCCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9...

    2020

  85. [96]

    Sadegh Riazi, Kim Laine, Blake Pelton, and Wei Dai

    M. Sadegh Riazi, Kim Laine, Blake Pelton, and Wei Dai. 2020. HEAX: An Architecture for Computing on Encrypted Data. InASPLOS ’20: Architectural Support for Programming Languages and Operating Systems, Lausanne, Switzerland, March 16-20, 2020, James R. Larus, Luis Ceze, and Kar...

    2020

  86. [97]

    Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin E

    M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin E. Lauter, and Farinaz Koushanfar. 2019. XONN: XNOR-based Oblivious Deep Neural Network Inference. In28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019. USENIX Associati...

    2019

  87. [98]

    Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M

    M. Sadegh Riazi, Christian Weinert, Oleksandr Tkachenko, Ebrahim M. Songhori, Thomas Schneider, and Farinaz Koushanfar. 2018. Chameleon: A Hybrid Secure Computation Framework for Machine Learning Applications. In Proceedings of the 2018 on Asia Conference on Computer and Commu...

    2018

  88. [99]

    Sujoy Sinha Roy, Furkan Turan, Kimmo Järvinen, Frederik Vercauteren, and Ingrid Verbauwhede. 2019. FPGA-Based High-Performance Parallel Architecture for Homomorphic Computing on Encrypted Data. In25th IEEE International Symposium on High Performance Computer Architecture, HPCA...

    2019

  89. [100]

    Théo Ryffel, Pierre Tholoniat, David Pointcheval, and Francis R. Bach. 2022. AriaNN: Low-Interaction Privacy- Preserving Deep Learning via Function Secret Sharing.Proc. Priv. Enhancing Technol.2022, 1 (2022), 291–316. doi:10.2478/POPETS-2022-0015

    2022 doi

  90. [101]

    Dreslinski, Christopher Peikert, and Daniel Sánchez

    Nikola Samardzic, Axel Feldmann, Aleksandar Krastev, Srinivas Devadas, Ronald G. Dreslinski, Christopher Peikert, and Daniel Sánchez. 2021. F1: A Fast and Programmable Accelerator for Fully Homomorphic Encryption. InMICRO ’21: 54th Annual IEEE/ACM International Symposium on Mi...

    2021

  91. [102]

    Amazon Web Services. 2025. AWS Confidential Computing. https://aws.amazon.com/confidential-computing/

    2025

  92. [103]

    Songhori, Siam U

    Ebrahim M. Songhori, Siam U. Hussain, Ahmad-Reza Sadeghi, Thomas Schneider, and Farinaz Koushanfar. 2015. TinyGarble: Highly Compressed and Scalable Sequential Garbled Circuits. In2015 IEEE Symposium on Security and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015. IEEE Co...

    2015 doi

  93. [104]

    Edward Suh, Dwaine E

    G. Edward Suh, Dwaine E. Clarke, Blaise Gassend, Marten van Dijk, and Srinivas Devadas. 2003. AEGIS: architecture for tamper-evident and tamper-resistant processing. InProceedings of the 17th Annual International Conference on Supercomputing, ICS 2003, San Francisco, CA, USA, ...

    2003

  94. [105]

    Mingxing Tan, Bo Chen, Ruoming Pang, Vijay Vasudevan, Mark Sandler, Andrew Howard, and Quoc V. Le. 2019. MnasNet: Platform-Aware Neural Architecture Search for Mobile. InIEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 201...

    2019

  95. [106]

    Sijun Tan, Brian Knott, Yuan Tian, and David J. Wu. 2021. CryptGPU: Fast Privacy-Preserving Machine Learning on the GPU. In42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021. IEEE, 1021–1038. doi:10.1109/SP40001.2021.00098

    2021

  96. [107]

    PyTorch team. 2024. Custom Compiler Passes and Partitioners. https://pytorch.org/executorch/stable/compiler- custom-compiler-passes.html. CrypTorch : PyTorch-based Auto-tuning Compiler for Machine Learning with Multi-party Computation 27

    2024

  97. [108]

    PyTorch team. 2024. torch.export IR Specification. https://pytorch.org/docs/stable/export.ir_spec.html

    2024

  98. [109]

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction{APIs}. In25th USENIX security symposium (USENIX Security 16). 601–618

    2016

  99. [110]

    Crowley, and Michael F

    Jack Turner, Elliot J. Crowley, and Michael F. P. O’Boyle. 2021. Neural architecture search as program transformation exploration. InASPLOS ’21: 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Virtual Event, USA, Apri...

    2021

  100. [111]

    Kapil Vaswani, Stavros Volos, Cedric Fournet, Antonio Nino Diaz, Ken Gordon, Balaji Vembu, Sam Webster, David Chisnall, Saurabh Kulkarni, Graham Cunningham, Richard Osborne, and Daniel Wilkinson. 2023. Confidential Computing within an AI Accelerator. In2023 USENIX Annual Techn...

    2023

  101. [112]

    Sameer Wagh, Divya Gupta, and Nishanth Chandran. 2018. SecureNN: Efficient and Private Neural Network Training. Cryptology ePrint Archive, Paper 2018/442. https://eprint.iacr.org/2018/442

    2018

  102. [113]

    Sameer Wagh, Shruti Tople, Fabrice Benhamouda, Eyal Kushilevitz, Prateek Mittal, and Tal Rabin. 2020. FALCON: Honest-Majority Maliciously Secure Framework for Private Deep Learning. arXiv:2004.02229 [cs.CR] https://arxiv. org/abs/2004.02229

    2020 arXiv

  103. [114]

    Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R. Bowman. 2019. GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understanding. In7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, Ma...

    2019

  104. [115]

    Wenhao Wang, Guoxing Chen, Xiaorui Pan, Yinqian Zhang, XiaoFeng Wang, Vincent Bindschaedler, Haixu Tang, and Carl A. Gunter. 2017. Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX. InProceedings of the 2017 ACM SIGSAC Conference on Computer and...

    2017

  105. [116]

    Malozemoff, and Jonathan Katz

    Xiao Wang, Alex J. Malozemoff, and Jonathan Katz. 2016. EMP-toolkit: Efficient MultiParty computation toolkit. https://github.com/emp-toolkit

    2016

  106. [117]

    Yongqin Wang, Rachit Rajat, and Murali Annavaram. 2022. MPC-Pipe: an Efficient Pipeline Scheme for Secure Multi- party Machine Learning Inference.CoRRabs/2209.13643 (2022). doi:10.48550/ARXIV.2209.13643 arXiv:2209.13643

    2022 doi arXiv

  107. [118]

    Yongqin Wang, Edward Suh, Wenjie Xiong, Brian Knott, Benjamin Lefaudeux, Murali Annavaram, and Hsien-Hsin Lee. 2021. Characterizing and Improving MPC-based Private Inference for Transformer-based Models. InNeurIPS 2021 Workshop Privacy in Machine Learning

    2021

  108. [119]

    Edward Suh, Wenjie Xiong, Benjamin Lefaudeux, Brian Knott, Murali Annavaram, and Hsien- Hsin S

    Yongqin Wang, G. Edward Suh, Wenjie Xiong, Benjamin Lefaudeux, Brian Knott, Murali Annavaram, and Hsien- Hsin S. Lee. 2022. Characterization of MPC-based Private Inference for Transformer-based Models. InInternational IEEE Symposium on Performance Analysis of Systems and Softw...

    2022

  109. [120]

    Jean-Luc Watson, Sameer Wagh, and Raluca Ada Popa. 2022. Piranha: A GPU Platform for Secure Computation. In31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 827–844. https: //www.usenix.org/conference/usenixsecurity22/presentation/watson

    2022

  110. [121]

    Bichen Wu, Xiaoliang Dai, Peizhao Zhang, Yanghan Wang, Fei Sun, Yiming Wu, Yuandong Tian, Peter Vajda, Yangqing Jia, and Kurt Keutzer. 2019. FBNet: Hardware-Aware Efficient ConvNet Design via Differentiable Neural Architecture Search. InIEEE Conference on Computer Vision and P...

    2019

  111. [122]

    Haoqi Wu, Wenjing Fang, Yancheng Zheng, Junming Ma, Jin Tan, and Lei Wang. 2024. Ditto: quantization-aware secure inference of transformers upon MPC. InProceedings of the 41st International Conference on Machine Learning (Vienna, Austria)(ICML’24). JMLR.org, Article 2186, 20 pages

    2024

  112. [123]

    Hanshen Xiao and Srinivas Devadas. 2022. PAC Security: Automatic Privacy Measurement and Control of Data Processing.arXiv preprint arXiv:2210.03458(2022)

    2022 arXiv

  113. [124]

    Edward Suh, and Srinivas Devadas

    Hanshen Xiao, G. Edward Suh, and Srinivas Devadas. 2024. Formal Privacy Proof of Data Encoding: The Possibility and Impossibility of Learnable Encryption. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, Salt Lake City, UT, ...

    2024

  114. [125]

    Andrew Chi-Chih Yao. 1982. Protocols for Secure Computations (Extended Abstract). In23rd Annual Symposium on Foundations of Computer Science, Chicago, Illinois, USA, 3-5 November 1982. IEEE Computer Society, 160–164. doi:10.1109/SFCS.1982.38

    1982 doi

  115. [126]

    Randy Yates. 2009. Fixed-point arithmetic: An introduction.Digital Signal Labs81, 83 (2009), 198

    2009

  116. [127]

    Da Yu, Peter Kairouz, Sewoong Oh, and Zheng Xu. 2024. Privacy-preserving instructions for aligning large language models.arXiv preprint arXiv:2402.13659(2024). 28 Jinyu Liu, Gang Tan, and Kiwan Maeng

    2024 arXiv

  117. [128]

    Huang, Xiaodan Song, Ruoming Pang, and Quoc Le

    Jiahui Yu, Pengchong Jin, Hanxiao Liu, Gabriel Bender, Pieter-Jan Kindermans, Mingxing Tan, Thomas S. Huang, Xiaodan Song, Ruoming Pang, and Quoc Le. 2020. BigNAS: Scaling up Neural Architecture Search with Big Single- Stage Models. InComputer Vision - ECCV 2020 - 16th Europea...

    2020

  118. [129]

    Patrick Yubeaton, Jianqiao Mo, Karthik Garimella, Nandan Kumar Jha, Brandon Reagen, Chinmay Hegde, and Siddharth Garg. 2024. TruncFormer: Private LLM Inference Using Only Truncations.CoRRabs/2412.01042 (2024). doi:10.48550/ARXIV.2412.01042 arXiv:2412.01042

    2024 doi arXiv

  119. [130]

    Samee Zahur and David Evans. 2015. Obliv-C: A Language for Extensible Data-Oblivious Computation.IACR Cryptol. ePrint Arch.(2015), 1153. http://eprint.iacr.org/2015/1153

    2015

  120. [131]

    Wenxuan Zeng, Meng Li, Wenjie Xiong, Tong Tong, Wen-jie Lu, Jin Tan, Runsheng Wang, and Ru Huang. 2023. MPCViT: Searching for Accurate and Efficient MPC-Friendly Vision Transformer with Heterogeneous Attention. In Proceedings of the IEEE/CVF International Conference on Compute...

    2023

  121. [132]

    Jiawen Zhang, Xinpeng Yang, Lipeng He, Kejia Chen, Wen-jie Lu, Yinghao Wang, Xiaoyang Hou, Jian Liu, Kui Ren, and Xiaohu Yang. 2025. Secure Transformer Inference Made Non-interactive. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, Califo...

    2025

  122. [133]

    Yuke Zhang, Dake Chen, Souvik Kundu, Chenghao Li, and Peter A Beerel. 2023. SAL-ViT: Towards Latency Efficient Private Inference on ViT using Selective Attention Search with a Learnable Softmax Approximation. InProceedings of the IEEE/CVF International Conference on Computer V...

    2023

  123. [134]

    Yihua Zhang, Aaron Steele, and Marina Blanton. 2013. PICCO: a general-purpose compiler for private distributed computation. In2013 ACM SIGSAC Conference on Computer and Communications Security, CCS’13, Berlin, Germany, November 4-8, 2013. ACM, 813–826. doi:10.1145/2508859.2516752

    2013

  124. [135]

    Xing Zhou, Zhilei Xu, Cong Wang, and Mingyu Gao. 2022. PPMLAC: high performance chipset architecture for secure multi-party computation. InISCA ’22: The 49th Annual International Symposium on Computer Architecture, New York, New York, USA, June 18 - 22, 2022. ACM, 87–101. doi:...

    2022

  125. [2019]

    doi:10.1109/CVPR.2019.01099

    Computer Vision Foundation / IEEE, 10734–10742. doi:10.1109/CVPR.2019.01099

    2019

  126. [2021]

    InAdvances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual

    CrypTen: Secure Multi-Party Computation Meets Machine Learning. InAdvances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual. 4961–4973. https://proceedings.neurips.cc/paper/...

    2021

  127. [2025]

    In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025

    BumbleBee: Secure Two-party Inference Framework for Large Transformers. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025. The Internet Society. https://www.ndss-symposium.org/ndss-paper/bumblebee-secur...

    2025

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.