2PC -- rotation-free coefficient-encoded HE for linear layers + silent OT (Ferret) for non-linear

PROMOTED FROM AN external: GRAPH STUB TO A REAL PAPER, 2026-07-13, and that promotion is the point. Cheetah is one of the THREE NODES this SoK's headline bridge finding rests on -- "the only three papers cited by both columns are SIRNN, Cheetah and SecFloat" -- and we had never read it. It was a name in a graph. Its lasting contribution, and what every later paper in this section builds on: a ROTATION-FREE homomorphic linear layer. By coefficient-encoding the convolution rather than using SIMD/CRT packing, a whole CONV or FC becomes a SINGLE homomorphic polynomial multiplication -- no HE rotations at all, which lets it drop the lattice dimension from 8192 to 4096 and accept secret shares from Z_{2^l} for free. Iron, BOLT, BumbleBee and Nimbus all inherit this encoding. Its second half is VOLE-style silent OT (Ferret) for comparison and truncation. AND ITS TRUNCATION IS APPROXIMATE, ON PURPOSE. Cheetah keeps a 1-bit error with probability 1/2 and eliminates only the "harsh" error -- 13l bits of communication against CrypTFlow2's faithful lambda(l+f+2) + 19l + 14f. This is the MPC bargain the numerics page is about, made explicitly: accept a bounded, benign error and pay far less. In ZK the same trade is unavailable, because the prover chooses the input. Cheetah is the cleanest primary source for that contrast and we have been making the argument without it.

2PC, SEMI-HONEST, dishonest majority (one of two corrupted). The client learns the network ARCHITECTURE and the inference result, nothing else. No malicious security.

Promoted from an external: stub in the citation graph to a real paper, and the promotion is the point.

Cheetah is one of the three nodes this SoK's headline finding rests on, the only three papers cited by both columns are SIRNN, Cheetah and SecFloat, and all three are MPC numerics. We held SecFloat's PDF. Cheetah was a name in a graph. We had been arguing from it without reading it.

What is new

A rotation-free homomorphic linear layer. By coefficient-encoding the convolution instead of using SIMD/CRT packing, a whole CONV or FC layer becomes a single homomorphic polynomial multiplication, no HE rotations at all. That lets Cheetah drop the lattice dimension from 8192 to 4096 and accept secret shares from $\mathbb{Z}_{2^\ell}$ for free.

Iron, BOLT, BumbleBee and Nimbus all inherit this encoding. When you read a 2024 private-transformer paper and find a coefficient-encoded matmul, you are reading Cheetah.

Its other half is VOLE-style silent OT (Ferret) for comparison and truncation, 11.6× less communication than CrypTFlow2 on the millionaires' protocol, 12× on truncation, and 88× when the MSB is known.

And its truncation is approximate, on purpose

This is why the paper matters to the numerics page, and it is not what it is famous for.

Cheetah deliberately keeps a 1-bit truncation error (probability $1/2$) and eliminates only the "harsh" error. The saving is enormous: $13\ell$ bits of communication against CrypTFlow2's faithful $\lambda(\ell + f + 2) + 19\ell + 14f$.

That is the MPC bargain, made explicitly: accept a bounded, benign error and pay far less.

And it is exactly the trade ZK cannot take. In MPC the error is benign because the input is not adversarial. In ZK the prover chooses the input, so a bounded error with probability $1/2$ is not an accuracy cost, it is a soundness hole the prover steers into. Cheetah is the cleanest primary source for that contrast, and it sits right next to SIRNN, whose truncation is exact and also cheap.

Two papers, same authors' community, same year, one probabilistic and one exact, and the ZK world borrowed the exact one without ever citing either.

The crossing edge

Adding Cheetah as a real paper creates the first citation edge in this corpus that crosses from the verifiability column into the privacy column: Hao et al. → Cheetah.

Before you believe it means anything: it is a bibliography-only citation. Cheetah is reference [30] in Hao et al. and appears zero times in its body. Contrast SIRNN, reference [47], which appears five times in the body and is load-bearing.

The full argument is on the bridge page. The short version: the two columns still do not read each other as cryptography.

What to distrust

Little, and the paper is careful. The one thing to note is that no accuracy delta is reported. The evidence is that on ~1000 ImageNet images Cheetah "outputs the same classification label as SCI_HE", which is a statement about agreement with another secure system, not about agreement with the float model. And its own DELPHI comparison is caveated: Cheetah matches Delphi "if we assume the harsh truncation error in DELPHI does not occur on shallow NNs."