3PC replicated secret sharing, MALICIOUS security with abort, honest majority

THE PAPER THAT CLOSES THE "NOBODY HAS MALICIOUS SECURITY AT TRANSFORMER SCALE" GAP -- and it closes it by adding a party, exactly as this SoK predicted it would have to. Read the threat_model field before quoting anything here. Its real claim to the record is narrower and more interesting than "first maliciously secure transformer inference": NO PRIOR MALICIOUS PROTOCOL COULD RUN BERT OR GPT-2 AT ALL. Privformer is limited to the vanilla transformer of Vaswani et al.; Falcon is a CNN framework. So the malicious-vs-malicious comparison (5.3x over Privformer, 3.4x over a Falcon the authors extended themselves) is run on a 45M-parameter vanilla transformer, NOT on BERT or GPT-2. The BERT/GPT-2 rows have no malicious baseline to beat because there was none. THE RESULT THAT SHOULD EMBARRASS THE SEMI-HONEST LINE. Mosformer's MALICIOUS online phase beats the SEMI-HONEST 2PC state of the art on its own benchmark: BERT-base LAN online 59.47 s / 4.60 GB against BOLT's 533.4 s / 59.61 GB, BumbleBee's 184.86 s / 6.40 GB and SHAFT's 171.31 s / 10.46 GB. Stronger security, faster online phase. THE CATCH, and it is the whole catch: THAT IS AN ONLINE NUMBER AND THE OFFLINE PHASE IS ENORMOUS. Malicious BERT-base costs a further 547.66 s and 67.35 GB of preprocessing on LAN (1339.14 s / WAN), because the VDPF correlated randomness has to come from somewhere. BOLT, BumbleBee, PUMA and Ditto report ZERO offline. SHAFT reports 39.36 s / 4.92 GB. Comparing Mosformer's online column against a system with no offline column is not a comparison. The honest total for malicious BERT-base on LAN is ~607 s and ~72 GB. The cost of malicious security over its own semi-honest variant is the clean number, and the paper lets you compute it: BERT-base LAN online 59.47 s vs 20.09 s (~3.0x) and 4.60 GB vs 1.15 GB (4.0x). Three to four times, not the order of magnitude folklore assumes. Accuracy: with modulus conversion on, up to 2.4% degradation (WikiText-103 perplexity 37.5 -> 38.4; QNLI -1.7 points). Without it, under 0.4%. The paper's own conclusion is worth the price of admission: "running modern large language models under cryptographic settings remains impractical at present."

3PC, MALICIOUS, SECURITY WITH ABORT, HONEST MAJORITY -- at most one of three non-colluding servers is corrupted, and a corrupted server may deviate arbitrarily. NOT robust / not guaranteed output delivery: a detected cheat aborts the protocol. NOT dishonest-majority 2PC. Every one of those qualifiers is load-bearing before you cite this against anyone. Malicious security is obtained in three layers: verifiable DPF key checks in the offline phase, redundant three-party execution of the online comparison (so RSS consistency detects tampering), and MAC-based consistency checks deferred to the end of each encoder/decoder block (16 rounds, ~5% of runtime).

Mosformer closes the gap this SoK named, nobody has malicious security at transformer scale, and it closes it in exactly the way the private inference page predicted it would have to: by adding a party.

Read the threat model before you quote anything else.

The threat model, precisely

Consistent with the threat models adopted in [1, 2], we assume a security model with abort under the honest-majority setting against malicious adversaries, where at most one out of three parties may be corrupted.

Mosformer · §3.3, Threat Model

Four qualifiers, all load-bearing:

• Three parties, not two. Three non-colluding servers. That is a substantially stronger trust assumption than the dishonest-majority 2PC of Iron, BOLT, Cheetah and Nimbus.
• Honest majority, at most one of three is corrupted.
• Malicious, a corrupted server may deviate arbitrarily. This is the real advance.
• With abort, not robust, not guaranteed output delivery. A detected cheat kills the protocol.

So the corrected statement is: maliciously-secure transformer inference exists, in 3PC honest-majority-with-abort. In dishonest-majority 2PC it still does not. Our claim was right about 2PC and wrong about the field.

What is new

Malicious security is bought in three layers. Verifiable DPFs let the parties check in the offline phase that the key-dealer distributed well-formed keys. Redundant three-party execution of the online comparison produces three (2,2)-shares that fold into one replicated sharing, whose consistency property detects online tampering, the paper is explicit that VDPFs alone "provide no guarantees against online adversarial behavior." And MAC-based consistency checks, deferred to the end of each encoder/decoder block, cost 16 rounds and about 5% of runtime.

On top of that sits an idea worth stealing: operation-aware modulus conversion. Different rings for different operators, linear layers in $\mathbb{Z}_{2^{64}}$, softmax and reciprocal-sqrt in $\mathbb{Z}_{2^{32}}$, ReLU and GELU in $\mathbb{Z}_{2^{16}}$. That is mixed-precision quantization, in MPC vocabulary, and like every mixed-precision scheme it trades accuracy for speed: 30% runtime and 25% communication, at up to 2.4% accuracy loss. The paper reports both numbers, which is more than most.

The result that should embarrass the semi-honest line

Mosformer's malicious online phase beats the semi-honest 2PC state of the art on its own benchmark. BERT-base, LAN, online: 59.47 s and 4.60 GB, against BOLT's 533.4 s / 59.61 GB, BumbleBee's 184.86 s / 6.40 GB, and SHAFT's 171.31 s / 10.46 GB.

Stronger security. Faster online phase.

What to distrust

No prior malicious protocol can run these models at all, which is simultaneously the paper's best claim and the reason its comparison is thin. Privformer is limited to the vanilla transformer of Vaswani et al.; Falcon is a CNN framework. So the malicious-vs-malicious comparison, 5.3× over Privformer, 3.4× over a Falcon the authors extended themselves, runs on a 45M-parameter vanilla transformer, not on BERT or GPT-2. The BERT and GPT-2 rows have no malicious baseline because there was none. That is a real first; it is just not the head-to-head the abstract implies.

Privformer was reimplemented by the authors (no public source), so the malicious baseline is their reconstruction of a competitor.

The clean number the paper does let you compute, the cost of malicious security over its own semi-honest variant, is the one worth carrying: BERT-base online, 59.47 s vs 20.09 s (≈3.0×) and 4.60 GB vs 1.15 GB (4.0×). Three to four times, not the order of magnitude the folklore assumes.

And the conclusion is worth the price of admission:

Although our work makes meaningful progress toward secure and efficient transformer inference, running modern large language models under cryptographic settings remains impractical at present.

Mosformer · §8, Conclusion