Nimbus: Secure and Efficient Two-Party Inference for Transformers

Transformer models have gained significant attention due to their power in machine learning tasks. Their extensive deployment has raised concerns about the potential leakage of sensitive information during inference. However, when being applied to Transformers, existing approaches based on secure two-party computation (2PC) bring about efficiency limitations in two folds: (1) resource-intensive matrix multiplications in linear layers, and (2) complex non-linear activation functions like $\mathsf{GELU}$ and $\mathsf{Softmax}$. This work presents a new two-party inference framework $\mathsf{Nimbus}$ for Transformer models. For the linear layer, we propose a new 2PC paradigm along with an encoding approach to securely compute matrix multiplications based on an outer-product insight, which achieves $2.9\times \sim 12.5\times$ performance improvements compared to the state-of-the-art (SOTA) protocol. For the non-linear layer, through a new observation of utilizing the input distribution, we propose an approach of low-degree polynomial approximation for $\mathsf{GELU}$ and $\mathsf{Softmax}$, which improves the performance of the SOTA polynomial approximation by $2.9\times \sim 4.0\times$, where the average accuracy loss of our approach is 0.08\% compared to the non-2PC inference without privacy. Compared with the SOTA two-party inference, $\mathsf{Nimbus}$ improves the end-to-end performance of \bert{} inference by $2.7\times \sim 4.7\times$ across different network settings.

Paper

Similar papers

Peer review

Reviewer zib56/10 · confidence 4/52024-07-08

Summary

This work proposes a new secure two-party computation (2PC) protocol called Nimbus for Transformer models to improve the efficiency and effectiveness of large matrix multiplication and non-linear layer approximation in Transformer inference. First, this work exploits client-side outer product and output compact to enhance layer multiplication. Second, input distributions are taken into consideration to better approximate GELU and exponential with lower-order piecewise polynomials. Comprehensive experiments and analyses are demonstrated in this work, and the results indicate Nimbus is effective and efficient.

Strengths

- Nimbus proposes client-side outer product (COP) and output compact with shift operation to reduce the computing and communication overhead. - Nimbus considers the impact of input distribution to simplify the polynomial approximation of GELU and Softmax with lower-order piecewise polynomials and small rings. - The authors provide a comprehensive discussion of Nimbus efficiency and feasibility, including client-side resources, asynchronous weight loading, free ring conversion, and more. - This work presents comprehensive complexity analyses, protocol definitions, and evaluation experiments, making the results and conclusion convincing and practical. - The evaluations prove that Nimbus significantly improves the performance and efficiency of secure 2PC for Transformer models, compared with existing works like BumbleBee, Iron, and BOLT.

Weaknesses

The major concerns are the accuracy and feasibility of estimating input distribution by sampling. - The server samples a batch of data from the training dataset to estimate the input distribution. I notice the work lack details of this process. For example, what is the exact batch size of sampling? I think such hyper-parameter can influence the effectiveness and efficiency of sampling. Does Nimbus compute the results of all training data to get the distribution, or just sample a subset? The precise process of sampling is worth further mentioning. - It seems that Nimbus assumes that the training data and test data share the same distribution, or at least the distributions are similar. What if the two distributions are more significantly skewed? - The initial state of piecewise approximation polynomials is pre-defined empirically despite the precise split points optimized by equation (3). For example, the approximation for GELU is divided into three pieces, with the middle piece being a quadratic polynomial. However, what if the distributions of inputs differ in practical cases? Figure 4 illustrates the distribution of non-linear functions for one specific dataset. If there exists another dataset with a more uniform distribution, such pre-defined piecewise polynomials may result in unwanted inaccuracy. - In some special cases, to further protect privacy, not only the inference stage is protected by secure 2PC, but the training dataset are also protected by secure training. In such case, the server may fail to estimate the input distributions.

Questions

Please refer to the contents of the Weaknesses part. Besides, there are some writing mistakes. For example, in Line 4 of Algorithm 1 in the appendix, it should be $\widetilde{c} - r(\theta)$ rather than $r(\theta) - \widetilde{c}$.

Rating

6

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

As mentioned above, the input distributions estimated by sampling when approximating non-linear functions may suffer from inaccuracy, and the description of the exact sampling process is not very clear.

Reviewer 7qmF5/10 · confidence 4/52024-07-12

Summary

This paper proposes Nimbus, a secure inference protocol for transformers in the 2pc setting. They propose distribution-aware nonlinear function approximation to use low-degree polynomials to compute GELU and softmax. They showed that their method can preserve accuracy and achieve efficient performance by comparing it with several baselines.

Strengths

- Improving the efficiency of the secure inference systems is an important and timely topic. - Extensive experiments are conducted to demonstrate the efficiency and accuracy of the proposed system.

Weaknesses

- The nonlinear approximation is leaking private information. - This proposed system might require huge storage overhead on the client side. - There is incorrect information regarding BOLT (S&P'24) and BumbleBee (NDSS'24). - There is a gap between the authors' reported results and BumbleBee's results in their paper, which needs further explanations.

Questions

- The major reason that prevents me from advocating this paper is that the nonlinear function approximations actually leak sensitive information about the training input distribution, which is not desirable in a secure inference system. For instance, the approximations polynomials are available to both parties, such that the client can easily reverse engineering the training inputs' distribution. For the GELU function, you can save one comparison and multiplication in 2PC compared to Bumblebee and BOLT but at the cost of leaking private information. - Additionally, the input ranges for different models, datasets, training parameters, and even different layers could be significantly different. Thus, you might need different approximations for different tasks, which will leak model information and is not friendly to use. - In your system, the matrix multiplication is done on the client side, which introduces a large memory overhead on the client side as they need to load the encrypted model into the memory. The encrypted model could be hundreds of times larger than the plaintext model. Considering that the client could be a normal user, such an issue should be avoided in a 2PC inference system. - I'm wondering why BumbleBee's performance is not as good as reported in their paper. It's about 5x faster compared to your reported numbers. Are you running their code correctly? - In line 308, you mentioned that BOLT uses aggressive approximation for efficiency, which is not the case. MPCFormer indeed introduces significant modifications to the nonlinear functions, but I believe BOLT's approximations are accurate, and they should be comparable to your designs. Additionally, BOLT seems to be open-sourced as BumbleBee mentioned that they obtained the results by rerunning their code.

Rating

5

Confidence

4

Soundness

2

Presentation

2

Contribution

2

Limitations

See my concerns in the Question section.

Authorsrebuttal2024-08-09

We are pleased to hear that the rebuttal addresses your concerns and thank you for raising your score. We will clarify the security of the polynomial approximation protocol in the revision. We will also describe the zero-leakge version of the protocol, and provide the performance comparison. For the question of where the savings come from, there are three advantages in theoretical to consider. Firstly, the number of truncations called in Nimbus is the same as the number of secure multiplications called, which is two. In contrast, BOLT calls secure multiplication twice but makes four truncation calls. This is because BOLT includes additional multiplication between the public value and secret. While the multiplication between the public value and secret can be done locally, the truncation of the result sharing cannot be saved. The truncation protocol used in BOLT requires $\log \ell+3$ rounds of communication [1], where $\ell$ represents the bit length of the ring. As a result, this increases the overall communication overhead. Secondly, our low-degree approximation reduces the fixed-point error during computation, allowing computation on a smaller ring. Since other layers still require computation on a higher ring, to eliminate the overhead of upcasting ring elements from a smaller ring to a larger ring, we also propose a truncation-upcast fusion protocol. In contrast, BOLT requires $\log m+2$ rounds of communication [1] for this upcast, where $m$ is the bit length of the smaller ring. Thirdly, all computations of the Nimbus are performed on the ring, while the BOLT evaluates the linear layer on the field and the nonlinear layer on the ring. As a result, an additional conversion between the field and the ring is needed. As for the implementation, Nimbus uses HE based secure multiplication [2], while the BOLT uses OT-based secure multiplication [1]. The former saves more communication, and performances better when the network condition is bad. The underlying OT protocol also causes difference. The SOTA Ferret OT [3] used in Nimbus takes less communication than the IKNP OT [4] used by BOLT. [1] Sirnn: A math library for secure rnn inference, SP 2021 [2] BumbleBee: Secure Two-party Inference Framework for Large Transformers, NDSS 2021 [3] Ferret: Fast extension for correlated ot with small communication, CCS 2020 [4] Extending Oblivious Transfers Efficiently, CRYPTO 2003

Reviewer 5SDb6/10 · confidence 3/52024-07-12

Summary

This paper provides a hybrid method that uses both HE and additive secret sharing (Add-SS) to perform 2PC privacy-preserving transformers. Two main contributions are discussed in this paper: (1) Client-side Outer Product Protocol and (2) Lower Degree Polynomial Approximation and Smaller Rings.

Strengths

The paper presents the complexity analysis and memory impact analysis well. These analyses help readers understand the advantages of the COP protocol.

Weaknesses

1. Not quite sure why HE + Add-SS is used for 2PC; why not directly use multi-party computing for 2PC? Please compare the differences between these two techniques and related papers, as it is uncertain whether HE + Add-SS is a more promising technique for privacy-preserving transformers. 2. The Client-side Outer Product Protocol is one of the main contributions. However, there is no security proof for section 3.2 Client-side Outer Product Protocol, especially for the content from lines 165 to 170.

Questions

Why HE + Add-SS is used for 2PC; why not directly use multi-party computing for 2PC?

Rating

6

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

No security proof for section 3.2 Client-side Outer Product Protocol

Reviewer dGsE5/10 · confidence 4/52024-07-15

Summary

This submission proposed secure inference protocols for Transformer-based model, involving two crucial components: HE-based linear operations and approximation-based no-linear operations. Experiments were conducted to verify the feasibility of the proposed protocols and to compare the performance with prior works on Transformer secure inference.

Strengths

The author focused on the critical part of designing efficient MPC protocols for Transformer, with detailed analysis on drawbacks of prior works. For the linear layer, the solution takes into consideration the different computation sources that the client and server hold. As such, during the linear operations, the server side is responsible for the heavy cryptographic operations. For the non-linear layer, the protocol in the submission is based on the distribution of function input. Concretely, low-degree approximation was used, for the selected range. The experiment in the paper is comprehensive and complete. Results indicate that it outperforms the baseline.

Weaknesses

1. One of the insights of the non-linear construction is based on the non-uniformed distribution of the input. It is not quite convincing as insufficient explanation was provided, thus limiting the feasibility of the protocol. Is it applicable to all types of input datasets or just limited to certain categories? 2. The contributions and novelty of the non-linear design are not sufficiently highlighted. It can be viewed as the variant of spline approximations with carefully selected coefficients, which is commonly applied in prior works [1]. 3. Truncation in Alg. 5 discards the high-order bits rather than low-order bits. However, commonly it is the variant of the logical right shift [2]. Please clarify the definition of such an operation. [1] Hou, Xiaoyang et al. “CipherGPT: Secure Two-Party GPT Inference.” IACR Cryptol. ePrint Arch. 2023 (2023): 1147. [2] D. Rathee et al., "SiRnn: A Math Library for Secure RNN Inference," 2021 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 2021, pp. 1003-1020,

Questions

See above.

Rating

5

Confidence

4

Soundness

2

Presentation

3

Contribution

2

Limitations

See above.

Reviewer 7qmF2024-08-08

Thanks for the authors' rebuttal. I have comments as follows: Thanks for the clarifications on the function privacy. I think it should be clearly explained in the paper. I still do not understand where are the savings from. In your GELU approximation, you need to evaluate 2 multiplications between secret shares and 2 comparisons, which should be the same as BOLT. Are the savings from the efficient crypto primitives used in Bumblebee? Given that my major concern is addressed, I've slightly raised my score. I suggest the authors add a paragraph to discuss the function privacy in the revision.

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC