Prefix caching has become a key technique for LLM serving, and nowadays the reusable KVCache contents are often hosted on distributed servers. For long-context LLM inferences with high cache hit ratio, cross-server KVCache transmission has become an emerging performance bottleneck; such network-intensive LLM inferences are increasingly prevalent in the coming era of agentic AI. However, existing LLM inference engines are essentially compute-centric; we find that they are highly inefficient when serving such workloads due to compute-stage service blocking and ignorance of KVCache-transfer cost.

We consider the federated submodel learning (FSL) problem in a distributed storage system. In the FSL framework, the full learning model at the server side is divided into multiple submodels such that each selected client needs to download only the required submodel(s) and upload the corresponding update(s) in accordance with its local training data. The server comprises multiple independent databases and the full model is stored across these databases. A fundamental problem in FSL is to enable these multiple databases at the parameter server to collectively maintain a consistent view of the global parameters to facilitate parallel computing across distributed clients. In addition, a practically implementable FSL scheme should possess high throughput, efficient performance, fault tolerance, sufficient privacy, adequate security, certifiable stability, elastic scalability and easy usability features. To specifically resolve the fault tolerance and adequate security issues together, we propose a novel coding mechanism coined ramp secure regenerating coding (RSRC), which is a synthesis of ramp secret sharing and secure regenerating code. This coding technique matches FSL perfectly, as the system performance can be further improved when the full model is stored using RSRC in a distributed manner. By incorporating and extending available techniques cleverly, our new RSRC-based distributed FSL approach that is constructed on top of our earlier two-database FSL scheme which uses private set union (PSU), achieves all of the aforementioned important features. A complete one-round FSL process consists of: 1) an FSL-PSU phase where the union of the submodel indices to be updated by the selected clients in the current round is determined, 2) an FSL-write phase where the updated submodels are written back to the databases, and 3) additional auxiliary phases where sufficient amounts of necessary common randomness are generated at both server and client sides.

We consider the federated submodel learning (FSL) problem and propose an approach where clients are able to update the central model information theoretically privately. Our approach is based on private set union (PSU), which is further based on multi-message symmetric private information retrieval (MM-SPIR). The server has two non-colluding databases which keep the model in a replicated manner. With our scheme, the server does not get to learn anything further than the subset of submodels updated by the clients: the server does not get to know which client updated which submodel(s), or anything about the local client data. In comparison to the state-of-the-art private FSL schemes of Jia-Jafar and Vithana-Ulukus, our scheme does not require noisy storage of the model at the databases; and in comparison to the secure aggregation scheme of Zhao-Sun, our scheme does not require pre-distribution of client-side common randomness, instead, our scheme creates the required client-side common randomness via random symmetric private information retrieval (RSPIR) and one-time pads. Our system is initialized with a replicated storage of submodels and a sufficient amount of common randomness at the two databases on the server-side. The protocol starts with a common randomness generation (CRG) phase where the two databases establish common randomness at the client-side using RSPIR and one-time pads (this phase is called FSL-CRG). Next, the clients utilize the established client-side common randomness to have the server determine privately the union of indices of submodels to be updated collectively by the clients (this phase is called FSL-PSU). Then, the two databases broadcast the current versions of the submodels in the set union to clients. The clients update the submodels based on their local training data. Finally, the clients use a variation of FSL-PSU to write the updates back to the databases privately (this phase is called FSL-write). As the databases at the server do not communicate, as a novel approach, we utilize carefully chosen alive clients to route the required information between the two databases. Our proposed private FSL scheme is robust against client drop-outs, client late-arrivals, and database drop-outs.

We consider the federated submodel learning (FSL) problem and propose an approach where clients are able to update the central model information theoretically privately. Our approach is based on private set union (PSU), which is further based on multi-message symmetric private information retrieval (MM-SPIR). With our scheme, the server does not learn anything further than the subset of submodels updated by the clients: the server does not know which client updated which submodel(s), or anything about the local client data. In comparison to the state-of-the-art private FSL schemes of Jia-Jafar and Vithana-Ulukus, our scheme does not require noisy storage of the model at the databases; and in comparison to the secure aggregation scheme of Zhao-Sun, our scheme incorporates the creation of the required client-side common randomness via random symmetric private information retrieval (RSPIR) and one-time pads. Our system is initialized with a replicated storage of submodels and a sufficient amount of common randomness in two databases at the server-side. The protocol starts with a common randomness generation (CRG) where the two databases establish common randomness at the client-side (FSL-CRG phase). Next, the clients utilize the established client-side common randomness to have the server determine privately the union of indices of submodels to be updated collectively by the clients (FSL-PSU phase). Then, the two databases broadcast the current versions of the submodels in the set union to clients. The clients update the submodels based on their local data. Finally, the clients use a variation of FSL-PSU to write the updates back to the databases privately (FSL-write phase). Our proposed private FSL scheme achieves low communication cost, and is also robust against client dropouts, client late-arrivals, and database drop-outs.

We consider the total (upload plus download) communication cost of two-database symmetric private information retrieval (SPIR) through its relationship to conditional disclosure of secrets (CDS). In SPIR, a user wishes to retrieve a message out of K messages from N non-colluding and replicated databases without learning anything beyond the retrieved message, while no individual database learns the retrieved message index. In CDS, two parties each holding an individual input and sharing a common secret wish to disclose this secret to an external party in an efficient manner if and only if their inputs satisfy a public deterministic function. As a natural extension of CDS, we introduce conditional disclosure of multiple secrets (CDMS) where two parties share multiple i.i.d. common secrets rather than a single common secret as in CDS. We show that a special configuration of CDMS is equivalent to two-database SPIR. Inspired by this equivalence, we design download cost efficient SPIR schemes using bipartite graph representation of CDS and CDMS, and determine the exact minimum total communication cost of N = 2 database SPIR for K = 3 messages when the message length is 1.

We introduce the problem of random symmetric private information retrieval (RSPIR). In canonical PIR, a user downloads a message out of K messages from N non-colluding and replicated databases in such a way that no database can know which message the user has downloaded (user privacy). In SPIR, the privacy is symmetric, in that, not only that the databases cannot know which message the user has downloaded, the user itself cannot learn anything further than the particular message it has downloaded (database privacy). In RSPIR, different from SPIR, the user does not have an input to the databases, i.e., the user does not pick a specific message to download, instead is content with any one of the messages. In RSPIR, the databases need to send symbols to the user in such a way that the user is guaranteed to download a message correctly (random reliability), the databases do not know which message the user has received (user privacy), and the user does not learn anything further than the one message it has received (database privacy). This is the digital version of a blind box, also known as gachapon, which implements the above specified setting with physical objects for entertainment. This is also the blind version of 1-out-of-K oblivious transfer (OT), an important cryptographic primitive. We study the information-theoretic capacity of RSPIR for the case of N = 2 databases. We determine its exact capacity for the cases of K = 2,3,4 messages. While we provide a general achievable scheme that is applicable to any number of messages, the capacity for K ≥5 remains open.

We study the problem of private set intersection (PSI). In this problem, there are two entities$E_{i}$, for$i=1, 2$, each storing a set$\mathcal {P}_{i}$, whose elements are picked from a finite set$\mathbb {S}_{K}$, on$N_{i}$replicated and non-colluding databases. It is required to determine the set intersection${\mathcal {P}}_{1} \cap {\mathcal {P}} _{2}$without leaking any information about the remaining elements to the other entity, and to do this with the least amount of downloaded bits. We first show that the PSI problem can be recast as a multi-message symmetric private information retrieval (MM-SPIR) problem with certain added restrictions. Next, as a stand-alone result, we derive the information-theoretic sum capacity of MM-SPIR,$C_{MM-SPIR}$. We show that with$K$messages,$N$databases, and a given size of the desired message set$P$, the exact capacity of MM-SPIR is$C_{MM-SPIR} = 1 - \frac {1}{N}$when$P \leq K-1$, provided that the entropy of the common randomness$S$satisfies$H(S) \geq \frac {P}{N-1}$per desired symbol. When$P = K$, the MM-SPIR capacity is trivially 1 without the need for any common randomness$S$. This result implies that there is no gain for MM-SPIR over successive single-message SPIR (SM-SPIR). For the MM-SPIR problem, we present a novel capacity-achieving scheme which builds seamlessly over the near-optimal scheme of Banawan-Ulukus originally proposed for the multi-message PIR (MM-PIR) problem without any database privacy constraints. Surprisingly, our scheme here is exactly optimal for the MM-SPIR problem for any$P$, in contrast to the scheme for the MM-PIR problem, which was proved only to be near-optimal. Our scheme is an alternative to the successive usage of the SM-SPIR scheme of Sun-Jafar. Based on this capacity result for the MM-SPIR problem, and after addressing the added requirements in its conversion to the PSI problem, we show that the optimal download cost for the PSI problem is given by$\min \left \{{\left \lceil{ \frac {P_{1} N_{2}}{N_{2}-1}}\right \rceil, \left \lceil{ \frac {P_{2} N_{1}}{N_{1}-1}}\right \rceil }\right \}$, where$P_{i}$is the cardinality of set${\mathcal {P}}_{i}$.

We investigate the problem of multi-party private set intersection (MP-PSI). In MP-PSI, there are$M$parties, each storing a data set$\mathcal{P}_{i}$over$N_{i}$replicated and non-colluding databases, and we want to calculate the intersection of the data sets$\cap_{i=1}^{M}\mathcal{P}_{i}$without leaking any information beyond the set intersection to any of the parties. For a specific communication protocol, we propose an information-theoretic scheme for MP-PSI based on the connection between the PSI problem and the multi-message symmetric private information retrieval (MM-SPIR) problem. Our scheme is a non-trivial generalization of the 2-party PSI scheme as it needs an intricate design of the shared common randomness. Interestingly, our scheme does not incur any penalty due to the more stringent privacy constraints in the MP-PSI problem compared to the 2-party PSI problem.

We consider the problem of symmetric private information retrieval (SPIR) with user-side common randomness. In SPIR, a user retrieves a message out of$K$messages from$N$non-colluding and replicated databases in such a way that no single database knows the retrieved message index (user privacy), and the user gets to know nothing further than the retrieved message (database privacy). SPIR has a capacity smaller than the PIR capacity which requires only user privacy, is infeasible in the case of a single database, and requires shared common randomness among the databases. We introduce a new variant of SPIR where the user is provided with a random subset of the shared database common randomness, which is unknown to the databases. We determine the exact capacity region of the triple ($d, \rho S, \rho U$), where$d$is the download cost,$\rho S$is the amount of shared database (server) common randomness, and$\rho U$is the amount of available user-side common randomness. We show that with a suitable amount of$\rho U$, this new SPIR achieves the capacity of conventional PIR. As a corollary, single-database SPIR becomes feasible. Further, the presence of user-side$\rho U$reduces the amount of required server-side$\rho S$.

We study the problem of private set intersection (PSI). In PSI, there are two entities, each storing a set Pi, whose elements are picked from a finite set SK, on Nireplicated and non-colluding databases. It is required to determine the set intersection P1∩P2without leaking any information about the remaining elements to the other entity. We first show that the PSI problem can be recast as a multi-message symmetric private information retrieval (MM-SPIR) problem. Next, as a stand-alone result, we show that the exact capacity of MM-SPIR is CMM-SPIR= 1 - 1/N when P ≤ K - 1, if the common randomness S satisfies H(S) ≥ P/N-1 per desired symbol. This result implies that there is no gain for MM-SPIR over successive single-message SPIR. We present a novel capacity-achieving scheme which builds seamlessly over the multi-message PIR (MM-PIR) scheme. Based on this capacity result for the MM-SPIR problem, we show that the optimal download cost for the PSI problem is given by min{[P1N2/N2-1],[P2N1/N1-1]}, where P i is the cardinality of the set Pi.