Efficient matmul + non-linear protocols with ML-level optimizations. Improves on Iron.

SOURCE OF THE IRON ANCHOR EVERYONE QUOTES -- and it is BOLT'S OWN RE-IMPLEMENTATION of Iron, not Iron's self-report: "our implementation of Iron requires 280.99 GB communication for an end-to-end inference, taking 216 minutes for an end-to-end inference on the BERT-base model (110 M parameters) under one of the WAN settings (100 Mbps, 80 ms)" (Sec 1). Iron itself only ever measured a LAN. BOLT is candid that the NETWORK is the axis doing the work: for Linear 1 it is 45.7x faster than Iron under {100 Mbps, 40 ms} but only 2.3x faster under {3 Gbps, 0.8 ms} (Sec 7.5.1) -- the same protocol pair, the same claim, a 20x different ratio, decided by nothing but the simulated link. Any cross-system speedup in this cell that does not name a network setting is uninterpretable.

semi-honest 2PC (MPC + HE)

What is new

BOLT attacks Iron on four fronts at once, and the honest summary is that two of them are cryptography and two of them are machine learning.

The cryptography. A better ciphertext packing for matrix-matrix multiplication that stops wasting SIMD slots, plus a baby-step giant-step rotation schedule that cuts the ciphertext rotations the new packing would otherwise require. And a polynomial pre-processing technique that reduces the multiplication count when evaluating a fixed polynomial on secret-shared input, a generic MPC result the authors correctly flag as independently useful. Where Iron used HE for matmul and OT for everything else, BOLT pushes more of the computation into HE specifically to trade communication for computation, on the bet that compute is what gets cheaper.

The machine learning. Oblivious word elimination: rank tokens by their attention scores, compute the median obliviously via a bitonic sort, and discard every token below it. And secure-computation-aware fine-tuning: retrain the model so it tolerates the fixed-point scales and polynomial approximations BOLT wants to use.

Both halves work. It matters enormously which half you credit for the headline.

What it actually proves

Nothing, no proof. Privacy against a semi-honest counterparty, on BERT-base, across four GLUE tasks, with the parameters stated (37-bit ring, scale 12, and the HE parameters given explicitly). The reporting discipline here is better than the zkML column's: bit widths, ring, scale, HE modulus, network settings, and an ablation table all appear.

The claim to hold onto is that BOLT is the paper that pins Iron's cost, since Iron itself publishes only ratios and log-scale plots. But note exactly what that means:

Because Iron [28] is not open-sourced, we implement Iron's end-to-end system following the protocols described in their paper.

BOLT · §7.1.4, Iron's System

The Iron anchor figure everyone quotes is BOLT's reimplementation of Iron, under a narrow WAN setting BOLT chose. Iron's own paper benchmarked on a LAN and, as it happens, publishes no absolute figures at all. So: the communication volume half of that anchor is bandwidth-independent and fair, while the wall-clock half is a direct function of the pipe BOLT picked. Both halves are routinely quoted as though they were Iron's own measurements.

What to distrust

The headline communication reduction is not a cryptographic result. It requires throwing away half the input tokens.

And the model itself is different. BOLT does not merely quantize BERT, it fine-tunes it, with word elimination active in the forward pass, so the network learns to cope both with the fixed-point arithmetic and with having half its tokens deleted. "Matches the accuracy of plaintext models" is therefore comparing a retrained model against a non-retrained floating-point baseline. This is the "bend the model" move, executed twice, and CipherGPT criticizes exactly this class of approach: "all such solutions require retraining the model, which is less desirable to machine learning practitioners." BOLT's own defence, fine-tuning is a one-time cost amortized over inferences, is reasonable, but it does not make the accuracy comparison apples-to-apples.

The paper does state the mechanism plainly ("word elimination introduces negligible accuracy drops, and can significantly improve the performance of BOLT") and it does publish the ablation. The criticism is not that BOLT hid this. It is that everyone downstream quotes the number that includes it as if it were a protocol result.

The reported runtime speedup is a range because it is a bandwidth sweep, not a protocol range. BOLT cuts communication by an order of magnitude but cuts the round count by only about a quarter. On a fast link, rounds and compute dominate and BOLT's advantage sits at the bottom of its range; on a slow link, bytes dominate and it sits at the top. The spread is a property of the network, not of the system, and the number people quote is the one achieved against the narrowest pipe.

Accuracy beats plaintext again. BOLT with word elimination scores above the floating-point baseline on SST-2, and Iron scores above it on two tasks. These are within the reported standard deviation of the plaintext baseline, which is the right explanation, but it also means that the sub-1% accuracy deltas this entire cluster reports are inside the noise floor, and "comparable accuracy to floating-point" is not a claim any of these papers has the statistical power to distinguish from its negation. More curiously, BOLT reports that dropping half the tokens improves accuracy over not dropping them, attributing it to a ring-to-field conversion approximation. That is an odd thing to leave at one sentence.