A Graph-Based Analysis of Comparability, Scale, and Attribution in Private Transformer Inference

1. Introduction

• PTI protects client inputs, model weights, or both, while cloud deployment otherwise exposes user inputs and intermediate activations to the provider.The motivating concern is the processing of sensitive user data such as medical records, legal filings, and proprietary code.Source: §1 · p. 1
• Prior surveys and SoKs largely taxonomize cryptographic primitives, rebenchmark selected systems, or propose reporting standards without auditing the published record as a whole.This work reconstructs evaluation contracts across 62 papers to assess comparability and reported speedup drivers.Source: §1 · p. 1
• The framework models 62 PTI systems as nodes and pairwise evaluation compatibility as edges, encoding privacy scope, architecture, deployment setting, and reporting practices as node features.Its contributions include a Private Inference Contract Card, eight comparability gates, a progress ledger, and a scaling frontier.Source: §1 · p. 2
• Only 1 of 395 system pairs sharing a workload remains directly comparable after fidelity, privacy scope, threat model, cost scope, and reporting standards are aligned.The surviving pair is a deliberate reimplementation on the same benchmark.Source: §1 · p. 2
• Protocol optimizations contribute to reported gains in 49 of 62 papers, but no headline speedup stems from protocol progress alone.Reported gains also depend on workload, fidelity, amortization, hardware, or baseline selection.Source: §1 · p. 2
• The conventional-protection frontier has plateaued at 13B parameters, while production models exceed one trillion parameters.Demonstrated coverage concentrates heavily in semi-honest two-party settings on BERT-scale encoders.Source: §1 · p. 2
• A single private forward pass of a 70B-class model is projected to require minutes to hours of compute time per token, gigabytes of runtime data movement, and terabytes of one-time setup communication.The cost model is fitted within each paper’s original contract and projected to larger scale.Source: §1 · p. 2

2.1. Transformer Inference

• Cryptographic overhead shifts the cost profile: nonlinear operators dominate PTI layer costs, while GEMMs and residual connections cost little depth under HE and one round under MPC.Figure 1 contrasts HE multiplicative depth with MPC rounds and communication; GELU is especially costly in MPC communication, while LayerNorm’s inverse square root is deepest under HE.Source: §2.1 · p. 2, Figure 1 · p. 3

2.2. Cryptographic Backbones

• MPC distributes secret shares and incurs communication and interaction costs; HE evaluates non-interactively but incurs ciphertext expansion, bounded multiplicative depth, and costly bootstrapping.Hybrid systems execute linear GEMMs under HE and nonlinearities under MPC.Source: §2.2 · p. 3

2.3. Protected Assets

• PTI systems may protect the input, the model, or both; mutual privacy is the most stringent scope and incurs the highest cryptographic overhead.Even encrypted inputs and weights may leave metadata such as sequence length, batch size, token count, or communication volume exposed.Source: §2.3 · p. 3

2.4. Adversary Models

• Most PTI systems assume a semi-honest adversary, while malicious security incurs substantial overhead; helper-assisted or three-party setups rely on non-colluding entities.Non-colluding helpers reduce nonlinear protocol overhead, so equal execution costs across party models can represent different security promises.Source: §2.4 · p. 3

2.5. Deployment Options and Evaluation

• Deployment hardware, network topology, query batching, setup reuse, and reporting conventions all affect practical performance and what reported metrics represent.Interactive protocols work efficiently on high-bandwidth LANs but degrade over high-latency WANs, whereas HE absorbs network round trips more readily.Source: §2.5 · pp. 3–4

3. Related Work

• Prior surveys mainly categorize cryptographic primitives or compile isolated metrics, while this work reconstructs contracts across 62 systems spanning MPC, HE, and hybrid protocols to measure comparability in the published record.Al Badawi et al. propose a Private LLM Card System for future reporting; this paper instead reconstructs contracts retrospectively.Source: §3 · p. 4
• Chen et al. re-benchmark representative systems under standardized configurations, whereas this work audits whether published metrics are mutually comparable and tracks their combined scale.The two studies are described as complementary: rebenchmarking addresses experimental fragmentation, while contract reporting aims to keep future results comparable without continuous reruns.Source: §3 · p. 4
• The corpus snapshot was frozen in July 2026, with subsequent literature treated as contextual evidence.Emerging work targets private generation, larger architectures, and attacks on non-cryptographic split and permutation schemes.Source: §3 · p. 4

4. Corpus Construction and Data Collection

• The corpus includes system-level inference papers that protect Transformer-based models using cryptographic or protocol-level mechanisms and report extractable scale, contract, or progress evidence.It excludes training-time methods, TEE-only systems, watermarking or ownership schemes, and kernels not integrated into inference pipelines.Source: §4 · p. 4
• The final corpus contains 62 peer-reviewed papers and public preprints published between 2022 and 2026, collected through July 2026.Preprints are retained when they introduce a system-level design that shaped the literature or served as a later baseline.Source: §4 · p. 4
• Table 2 organizes the audited corpus by cryptographic backbone and evaluated inference regime, with systems marked [MM] appearing in both columns.Three encoder–decoder systems are also audited; Rhombus [47] is included at protocol level rather than placed in either inference-regime column.Source: Table 2 · p. 5
• Scaling analysis records each paper’s largest empirically evaluated private model, while comparability and attribution analyze progress claims paired with their evaluation contracts.For multiple candidate claims, the primary result highlighted in the abstract or main comparison table is selected.Source: §4 · pp. 4–5
• Extraction binds attributes to specific claims, marks missing or ambiguous fields conservatively, and separates technical merit from comparison validity.Mixed performance gains are not attributed to protocol progress.Source: §4 · p. 5
• Blind re-extraction achieved 70.0% raw agreement across factual fields, and adjudication corrected 40 of 992 fields (4.0%).Agreement was 87–98% on cryptographic backbone, privacy scope, adversary model, and end-to-end status.Source: §4 · p. 5

5. Systematization Methodology

• The framework represents 62 papers as PIC cards and uses pairwise comparability gates to support cross-system comparison, progress attribution, and longitudinal scaling analysis.The cards capture performance claims and operating assumptions; the gates are also evaluated against each paper’s own baseline.Source: §5 · p. 5, Figure 2 · p. 6

5.1. The Private Inference Contract (PIC) Card

• The PIC card records each paper’s performance claim and operating assumptions so results can be interpreted and compared in context.Its fields cover workload and scale, privacy and threat model, mechanism and fidelity, cost and deployment, and baseline and reporting.Source: §5.1 · pp. 5–6

5.2. Comparability Graph and Gates

• Eight gates test distinct dimensions of compatibility, with pass, fail, or unknown outcomes combined into competitive, invalid, or descriptive pair relations.A missing field can yield unknown rather than an explicit incompatibility; the labels assess comparison validity, not technical merit.Source: §5.2 · pp. 6–7, Table 3 · p. 7, Table 4 · p. 7

5.3. Progress Attribution

• Progress attribution compares a reported gain with its baseline and labels the source of change, including protocol progress, assumption tradeoffs, workload or fidelity shifts, deployment shifts, component progress, and reporting artifacts.A claim is pure protocol progress only when every non-cryptographic gate passes; discrepancies are recorded as caveats or mixed attribution.Source: §5.3 · pp. 7–8

5.4. Scaling Frontier Audit

• The scaling audit defines the PTI frontier as the largest protected model published by each year and benchmarks conventional cryptographic implementations against unencrypted production-model scale.The conventional-implementation subset is filtered through model-fidelity and cost-scope gates.Source: §5.4 · p. 8

6.1. Overview of PIC Cards

• The 62-paper corpus spans diverse cryptographic mechanisms, model fidelity, party topologies, workloads, and cost scopes, contributing to a sparse comparability graph.Threat models and privacy scopes show stronger consensus than the other recorded system fields.Source: §6.1 · p. 8, §6 · p. 8

6.2. RQ1: Comparability Between Systems

• Threat and party models and model fidelity account for many hard conflicts, while amortization and reporting sufficiency are often limited by unreported fields.Figure 4 summarizes outcomes across the eight compatibility gates.Source: §6.2 · p. 8, Figure 4 · p. 8
• Only 1 of 1891 candidate pairs remains competitive after all compatibility gates, and it reflects an explicit reimplementation of one system by another.Cumulative filtering leaves 92 descriptive pairs and 1 competitive pair; 1798 pairings are invalidated.Source: §6.2 · p. 9, Figure 6 · p. 9

6.3. RQ2: What Drives Reported Progress?

• Protocol progress is a factor in 49 of 62 papers, but none reports pure protocol progress; every gain co-occurs with non-protocol changes.Primary drivers include protocol progress (22/62), workload or fidelity shifts (17/62), and mixed progress (11/62).Source: §6.3 · p. 9, Figure 7 · p. 9

6.4. RQ3: The PTI Scaling Frontier

• The conventional cryptographic frontier reached 13B parameters in 2024 and has since plateaued, while public models approach 1T parameters.Larger audited points involve structural trade-offs, including CryptoMoE’s mixture-of-experts design and FLUTE’s partial encryption; the private frontier aggregates heterogeneous contracts.Source: §6.4 · p. 10, Figure 8 · p. 10

Fitting a cost model to the corpus

• The cost model fits power laws to measurements within each paper’s isolated evaluation contract and tests projections across scaling exponents from 0.8 to 1.2.The calibration set contains 256 performance tuples from 20 systems; reported leave-one-out error is below 12% where multiple model sizes support curve fitting.Source: §7 · p. 10

The projected cost at production scale

• Private inference for a 70B model costs three to five orders of magnitude more than plaintext, with projections ranging from about two minutes to several hours per token.The projections use each protocol family’s published contract; the table’s 3PC per-token anchors are marginal second-token costs, excluding prefill.Source: §7 · pp. 10–11, Table 5 · p. 11

Three structural walls

• At 70B, communication volume of 18–58 GB per token imposes a bandwidth floor, while FSS preprocessing and HE batching impose separate cost constraints.FSS requires about 1.4 TB of offline dealer keys; non-interactive HE reaches about 7.6 minutes per token only when batching 32 queries, with single-query cost roughly 30× worse.Source: §7 · pp. 10–11

8.1. What This SoK Adds to PTI Progress

• The SoK frames PTI progress against a cryptographic frontier and argues that isolated evaluation contracts obscure whether advances compose into a trajectory.It reports diagnostics on comparability, progress attribution, and scaling to contextualize gains.Source: §8.1 · p. 11

8.2. Report the Contract, Not Just the Number

• A standardized PIC Card should consolidate scale, threat model, fidelity, deployment costs, and baselines, while speedups should be dissected by their explicit sources.The proposed attribution categories include protocol design, workload, relaxed security assumptions, hardware accounting, and component kernels.Source: §8.2 · p. 11

8.3. Measure Scaling Against a Moving Frontier

• Scaling claims should specify whether they concern model scale, cost scaling, component scaling, or a justified deployment scenario.The four settings distinguish larger models under comparable bounds, costs as workloads grow, isolated bottlenecks, and application-grounded scale and workload.Source: §8.3 · p. 11

8.4. Benchmark with Deployment Scenarios

• Benchmarking should organize systems around deployment scenarios, including interactive WAN, batch analytics, collaborative inference, model confidentiality, and component stress testing.These scenarios prioritize different metrics and constraints, such as round complexity, transparent amortization, party topology, equal protection, or isolated operators.Source: §8.4 · p. 11

8.5. Matching Backbones to Deployments

• Cryptographic backbones should be matched to a deployment’s primary bottleneck rather than treated as absolute choices.For example, the discussion maps low-round HE or hybrids to interactive WAN and MPC or hybrids to low-latency LAN; NEXUS trades heavy homomorphic computation for fewer WAN rounds, while round-intensive MPC can degrade over WAN.Source: §8.5 · pp. 11–12

• The SoK evaluates what published results support rather than reproducing performance on unified hardware.Its conclusions therefore concern the published record, not a unified-hardware rebenchmark.Source: §9 · p. 12
• Its corpus excludes split-inference and statistical approaches, so scaling findings apply to cryptographic setups rather than all private inference frameworks.Source: §9 · p. 12
• Contract labels use conservative defaults, and the corpus maps empirical evidence rather than ranking systems.Unknown is preferred over inferred, with blind re-extraction and sensitivity analysis as checks.Source: §9 · p. 12
• Passing a comparability gate means a pair is not provably incomparable, not that the systems are identical.Coarse categorical fields can hide discrepancies; Euston and NEXUS clear every gate but dispute whether user-side preprocessing counts in end-to-end latency.Source: §9 · p. 12
• Parameter count is the PTI frontier’s capability proxy, but it omits architectural quality and context length.The paper uses it because parameter count directly dictates cryptographic compute costs relevant to its scaling analysis.Source: §9 · p. 12

• The scaling frontier has plateaued below production scale, and the measured upper bound is stitched from mutually incompatible contracts.Source: §10 · p. 12
• Virtually no published claims share enough evaluation context for direct comparison, while cryptographic progress is widespread but never the sole driver of reported gains.The conclusion says aligning pairs cluster around a few hub systems rather than spanning the corpus.Source: §10 · p. 12
• A faster system is uninformative in isolation unless its scale, governing contract, and exact source of performance gain are specified.The paper concludes that reporting discipline is needed to show whether speedups converge on deployment.Source: §10 · p. 12

• The study uses public papers, artifacts, and model-scale references, involves no human subjects or sensitive data, and introduces no attacks or deanonymization techniques.Its LLM verifier rereads only the same published text, and the authors report no risk of harm arising from the work.Source: Ethical Considerations · p. 13

Open Science

• The release includes corpus metadata, extraction materials, evaluation contracts, graph and attribution outputs, calibration data, and scripts that regenerate every table and figure.The authors do not redistribute audited papers or full texts; they release derived metadata and short evidence quotes.Source: Open Science · p. 13

Appendix A. Additional Result Tables

• Appendix A collects supporting result tables on reporting sufficiency and the full sensitivity analysis behind robustness checks.Source: Appendix A · p. 16
• Eight reporting requirements govern clean cross-paper latency comparison, and Table 6 measures comparison sufficiency rather than paper quality.The requirements include a headline claim, baseline, latency, communication, end-to-end rounds, network context, cost scope, and amortization context.Source: Table 6 · p. 16

A.1. PIC-Card Field Distributions

• Figure 9 shows 55/62 papers use semi-honest threats and 49/62 protect both input and model, while mechanism, fidelity, topology, and workload vary.The “other” topology category combines five settings with three or more parties.Source: Figure 9 · p. 16, §A.1 · p. 16

A.2. Full Comparability Matrix

• Figure 10 labels all 62 papers on both axes of the comparability graph so individual pairings can be traced.Source: §A.2 · p. 16

A.3. Blind Re-Extraction Agreement

• Table 8 reports per-field agreement between recorded values and an independent blind re-extraction across the 62-paper corpus.Source: §A.3 · p. 16

A.4. PTI frontiers over the year

• Table 10 summarizes the largest PTI systems from 2022 through 2024, which differ in protocols, party topologies, model fidelity, and cost scopes.Source: §A.4 · p. 16

Appendix B. Reliability of the Cost Projections

• 7.7% on time, 2.5% on communication, and 5.3% on key size were the maximum held-out 13B prediction errors when fitting the three smaller SIGMA models.Leave-one-out error never exceeded 12%. Across exponents from 0.8 to 1.2, projected 70B and 405B forward passes remained tens of minutes to a few hours and about an hour to a day, respectively; these are extrapolations 5× and 31× beyond the largest measured model, not specific runtime predictions.Source: Appendix B · pp. 16–17

A.5. Robustness of the Findings

• Under locked/strict labels, 1/1891 pairs were competitive and 0/62 primary claims were baseline-compatible; optimistic labels raised these only to 93/1891 and 2/62.Excluding moderate- and boundary-confidence rows still yielded 1/1891 competitive pairs, with 45/49 protocol-or-mixed and 31/49 non-protocol-primary. The paper concludes that its findings do not hinge on a single pessimistic label and that published evidence does not yet show cumulative progress toward deployment-scale private LLM inference.Source: §A.5 · p. 16, Table 7 · p. 17

Appendix C. Field Extraction Protocol and Codebook

• The extraction protocol ties each recorded value to explicit source-paper evidence, records missing values rather than guessing, and uses Tier-0 contract fields across the analyses.Quantitative performance tuples feed the cost model on its calibration subset, while Tier-1 and Tier-2 fields are often unreported and are not used in the paper’s results.Source: Appendix C · p. 17

C.1. Quantitative Extraction Prompt

• The quantitative extraction prompt requires explicit paper statements, evidence for reported numeric or boolean fields, and a complete JSON output matching the schema.Missing values must use specified tokens, and each evidence entry must identify the exact field path, a short quote, and its source location.Source: §C.1 · pp. 18–19

C.2. Quantitative Performance Extraction Codebook

• The codebook selects one primary setting by preferring end-to-end results, the largest evaluated model, WAN over LAN, and the paper’s headline benchmark.It organizes extraction into required Tier-0 contract and performance fields, Tier-1 diagnostics, and optional Tier-2 primitive, cost, and reproducibility fields; values must be explicit, with normalization only when conversion is unambiguous.Source: §C.2 · p. 20

Appendix D. Audit Case Studies

• Four recurring headline-level comparison patterns show how gates expose mismatched or missing contract fields.The patterns are schematic rather than critiques of individual papers; Table 11 gathers them.Source: Appendix D · p. 20, Table 11 · p. 21
• Design-space taxonomy alone cannot establish comparability; gates determine whether two systems answer the same question.The encoder-versus-decoder pattern illustrates why systems in the same design space may not make comparable claims.Source: Appendix D · p. 20
• Model modifications that improve practicality must be identified as fidelity-shift progress, or speedups may be misattributed to cryptographic protocols.Otherwise, the literature may record a protocol advance that the evidence did not demonstrate.Source: Appendix D · p. 21
• The comparison failure occurs when readers combine measurements from different contracts into one ranking; gates make that step visible and auditable.Source: Appendix D · p. 21