SpliTEE extends the split‑inference architecture of Slalom to large language models by protecting intermediate GPU computations with differential privacy rather than encryption. The authors show that masking intermediate representations is essential, as a prompt‑reconstruction attack can recover prompts with about 80% accuracy. Their global sensitivity analysis bounds the noise needed, and they demonstrate that SpliTEE on Intel TDX achieves near‑double the speed of fully CPU‑based inference and outperforms encryption‑based Slalom while maintaining higher accuracy.
By Shashie Dilhara Batan Arachchige, Robin Carpentier, Hassan Jameel Asghar, Dali Kaafar
arXiv:2609.15039v3 Announce Type: replace-cross
Abstract: User prompts provided to large language models (LLMs) may contain private information. One way to protect them is to execute the LLM inside a...
By Shashie Dilhara Batan Arachchige, Robin Carpentier, Hassan Jameel Asghar, Dali Kaafar
TensorCommitments (TCs) is a lightweight, tensor-native proof‑of‑inference scheme designed to enable verifiable inference for large language models (LLMs). It binds each LLM inference to a commitment using multivariate Terkle Trees, ensuring that any tampering breaks the commitment. For the LLaMA2 model, TC adds only 0.97% overhead for the prover and 0.12% for the verifier, while improving robustness to tailored attacks by up to 48% compared to prior work that requires a verifier GPU.
By Oguzhan Baser, Elahe Sadeghi, Eric Wang, Nico Vergauwen, Sam Kazemian, Hong Kang, Sandeep P. Chinchali, Sriram Vishwanath
TensorCommitments (TCs) is a lightweight, tensor-native proof‑of‑inference scheme that enables verifiable inference for large language models (LLMs) without requiring the verifier to rerun the model or possess a powerful GPU. By binding each inference to a commitment stored in multivariate Terkle Trees, TCs detect tampering with only a 0.97% overhead for the prover and 0.12% for the verifier on LLaMA2. The approach improves robustness against tailored LLM attacks by up to 48% compared to previous methods that needed a verifier GPU.
By Oguzhan Baser, Elahe Sadeghi, Eric Wang, Nico Vergauwen, Sam Kazemian, Hong Kang, Sandeep P. Chinchali, Sriram Vishwanath
arXiv:2607. 29221v1 Announce Type: cross Abstract: We address the challenge of securely and efficiently outsourcing AI computations from a trusted but computationally weak client to an untrusted but powerful server, in the setting where the client holds both the input and the model, and the server must learn neither.
By James Hsin-yu Chiang, Sheila Zingg, Kari Kostiainen, Srdjan Capkun
arXiv:2606. 09551v1 Announce Type: cross Abstract: Two-server secure inference allows a client to query a hosted large language model (LLM) without revealing prompts or embeddings.
By Yuhan Ma, Yong Li, Stefan Schmid
arXiv:2603. 18046v2 Announce Type: replace-cross Abstract: We present NanoZK, a zero-knowledge proof system for verifiable LLM inference: clients and third-party auditors check that a provider executed the advertised model on a committed input without learning weights or activations.
By Zhaohui Wang
Giskard is a scalable protocol for private and Byzantine‑robust decentralized aggregation in large‑scale learning. It organizes participants into a tree of committees of size O(log n) and computes a differentially private coordinate‑wise approximate median using secure multi‑party computation within each committee. Experiments with up to one million participants show that Giskard reduces per‑party communication by nearly three orders of magnitude compared to its closest competitors while maintaining robustness against up to n/4 Byzantine parties.
By Ousmane Touat, C\'esar Sabater, Mohamed Maouche, Sonia Ben Mokhtar
arXiv:2607. 06612v1 Announce Type: cross Abstract: Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy.
By Harsh Kasyap, Anil Kumar Pradhan, Ugur Ilker Atmaca, Graham Cormode, Carsten Maple
arXiv:2606. 11416v1 Announce Type: cross Abstract: Repository-level benchmarks for evaluating Large Language Model (LLM) code repair on Secure Multi-Party Computation (MPC) software do not yet exist, and directly transplanting general-purpose benchmarks such as SWE-bench fails on three structural fronts: (i) MPC repositories are dominated by generic Python infrastructure rather than cryptographic logic; (ii) high-value MPC fixes lack the standardized tests rigid extraction pipelines require; and (iii) standard fail-to-pass evaluation is insufficient for code that must also be cryptographically safe.
By Yukuan Zhang, Mengxin Zheng, Qian Lou
arXiv:2606. 19129v1 Announce Type: cross Abstract: Dealing simultaneously with confidentiality and Byzantine behaviors in decentralized learning is a challenging problem.
By Ousmane Touat, C\'esar Sabater, Mohamed Maouche, Sonia Ben Mokhtar
Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks.