Hybrid HE/MPC. Custom HE-based matmul with a compact packing technique (sqrt(m)x less communication than Cheetah's matrix-vector approach, ~8x for transformers). Non-linear Softmax / GELU / LayerNorm via SIRNN-based OT protocols with bespoke optimizations.

The paper that initiated private transformer inference. Hides intermediate results of ALL layers (unlike THE-X, which leaks non-linear-layer inputs to the client). THE ANCHOR EVERYONE QUOTES IS NOT IRON'S. "Iron at 280.99 GB / 216 min for BERT-base" is BOLT'S RE-IMPLEMENTATION of Iron, measured under a WAN ({100 Mbps, 80 ms}) that Iron's own authors never ran -- Iron measured a LAN only (Sec 5.1: "we simulate a LAN network setting, where the bandwidth is 377 MBps and the echo latency is 0.8ms"), and Iron's paper prints no numeric end-to-end communication figure anywhere. Attribute the number to BOLT, not to Iron.

semi-honest 2PC (client-server)

What is new

Iron is the paper that started private transformer inference, and its contribution is one packing trick plus a lot of careful protocol plumbing.

The packing trick. Cheetah had shown that polynomial multiplication computes an inner product if you arrange the coefficients in opposite orders. Iron extends that from matrix-vector to matrix-matrix: define two encodings π_L and π_R such that a single polynomial product places every entry of the output matrix in a distinct coefficient of the result. Where Cheetah must encrypt each row of the left matrix into its own ciphertext, Iron packs the whole matrix into one, as long as mnk ≤ N. Transformers are full of high-dimensional matrix-matrix products, so this is exactly the operation the prior generation had no good protocol for. That is the paper.

The non-linear protocols (Softmax, GELU, LayerNorm) are optimizations on top of SIRNN's OT primitives rather than new constructions: normalize before exponentiating so you only ever need the negative-exponential protocol; compute x² from the cross-term of the shares so you pay half a multiplication instead of a whole one; fold LayerNorm's scale γ into the next layer's weights so it costs nothing. Each is a factor under 2×. They are craft, not invention, and the paper does not pretend otherwise.

What it actually proves

Nothing. That is the point, and it is the axis on which this whole cluster is orthogonal to the zkML column: Iron produces no proof. It computes BERT inference under 2-out-of-2 additive secret sharing so the server never sees the prompt and the client never sees the weights. A malicious server can compute the wrong function and nobody will ever know, the threat model is explicitly honest-but-curious.

What it buys, precisely: - Privacy against a semi-honest counterparty, on BERT-Tiny through BERT-Large, on four GLUE tasks, over a LAN. - Every layer's intermediates are hidden, including the inputs to the non-linear layers, which the contemporaneous THE-X leaks to the client. Iron is right to press this point; it is the difference between a privacy claim and a privacy-flavoured one. - Nothing about the output. The paper is explicit that it does not defend against what can be inferred from the inference result itself; model extraction is out of scope.

What to distrust

The paper contains no absolute performance numbers. None. Every end-to-end result is a ratio against SIRNN or MP-SPDZ, plotted on a log-scale bar chart. The famous anchor figure that the rest of this literature (and this repo) quotes for Iron, hundreds of gigabytes of communication and hours of wall clock for one BERT-base inference, does not appear in Iron's paper. It is BOLT's reimplementation of Iron, benchmarked on a WAN setting BOLT chose. Iron itself measured on a LAN. That provenance should travel with the number every time it is used, and the runtime half of it is a function of BOLT's chosen bandwidth, not of Iron's protocol.

The bit width is never stated. Iron's Discussion says: "Iron works with a uniform bitwidth, which is required to be large enough to accommodate all intermediate values", and then never says what it is. The accuracy figure sweeps the fractional scale from 4 to 16 and shows that scale 12 is needed to match plaintext exactly, but the ring width ℓ, which is what actually determines the cost of every OT-based non-linear protocol, is nowhere. This is the same unreported-bit-width problem the ZKP-VML Survey side of this repo complains about, in a literature that otherwise reports its parameters well (BOLT and CipherGPT both state ring width and scale explicitly).

The accuracy claim is validated on the smallest model only. "Numerically precise, which preserve the model accuracy of plaintext" is asserted for the framework; the accuracy figure is measured on BERT-Tiny. Runtime and communication are measured on all four BERT sizes; accuracy is measured on one, the one where fixed-point error has the fewest layers to accumulate through.

The improvement is concentrated where the cost is not. Iron's breakdown shows non-linear layers consuming the overwhelming majority of communication after its optimizations, and Iron's non-linear protocols improve on SIRNN by less than 2×, while its matmul improves by an order of magnitude. The paper says this itself and calls it an open problem: "the main bottleneck of our work is the communication overhead of non-linear layers." It is the same shape as the zkML side, where DeepProve's own breakdown puts most of the prover cost in activations, softmax and requantization. In both paradigms, matmul is solved and the non-linears are not. That cross-column parallel is the most useful thing to take from this paper.