Transformer has been successfully used in practical applications due to its powerful advantages. However, users' input is leaked to the model provider during the service. With people's attention to privacy, privacy-preserving Transformer inference is on the demand of such services. Secure protocols for non-linear functions are crucial in privacy-preserving Transformer inference, which are not well studied. Thus, designing practical secure protocols for non-linear functions is hard but significant to model performance. In this work, we propose a frameworkEastto enable efficient and accurate secure Transformer inference. Firstly, we propose a new oblivious piecewise polynomial evaluation algorithm and apply it to the activation functions, which reduces the runtime and communication of GELU by over 1.5× and 2.5×, compared to prior arts. Secondly, the secure protocols for softmax and layer normalization are carefully designed to faithfully maintain the desired functionality. Thirdly, several optimizations are conducted in detail to enhance the overall efficiency. We appliedEastto BERT and the results show that the inference accuracy remains consistent with the plaintext inference without fine-tuning. Compared to Iron, we achieve about 1.8× lower communication within 1.2× lower runtime.

In this paper, we consider constructions of rotation symmetric bent functions, which are of the forms: fc(x) = Σi=1m-1ci(Σj=0n-1xjxi+j) + cm(Σj=0m-1xjxm+j) and ft(x) = Σi=0n-1(xixt+ixm+i+ xixt+i) + Σi=0m-1xixm+i, where n = 2m, ciϵ {0,1} (the subscript u of xuin the previous expressions is taken as u modulo n). For each case, a necessary and sufficient condition is obtained. To the best of our knowledge, this class of cubic rotation symmetric bent functions is the first example of an infinite class of nonquadratic rotation symmetric bent functions.

In this paper, we consider the conjecture that σ2t+1l-1,2tare the only nonlinear balanced elementary symmetric Boolean functions wheretandlare positive integers. We prove ifn=2t+1l-1,lodd and 2t+1\nmidd, σn,dis balanced if and only ifd=2k, 1 ≤k≤t. Our results verify most cases of the conjecture forn≡ 3 (mod 4) .

Abstract In the traditional identity‐based cryptography, a user, who holds multiple identities, has to manage multiple private keys, where each private key is associated with an identity. In this paper, we present a key agreement protocol, which allows a single private key to map multiple public keys (identities) that are selectable by the user. That is, the established session key is associated with an arbitrary subset of identities held by the user, while the unselected identities remain secret to other participants. As a bonus, our scheme can be considered as a credential‐based key agreement, where the unique private key can be treated as a credential of the user and the user only proves that his credential is associated with some selected identities. We prove that our scheme is secure in the random oracle model. Copyright © 2010 John Wiley & Sons, Ltd.

We propose an efficient certificateless public key encryption (CL-PKE) scheme which is provably secure against chosen ciphertext attacks without random oracles. Our scheme is more computationally efficient than the existing schemes and provides the shortest public key length compared to other existing CL-PKEs with random oracles. We also propose a practical self-generated-certificate encryption (SGC-PKE) scheme based on our CL-PKE scheme. One of merits of such cryptographic systems is that it can be applied to countermeasure "Denial-of-Decryption (DoD) Attacks" that is inherent in CL-PKE.