SHAFT: Secure, Handy, Accurate, and Fast Transformer Inference

Andes Y. L. Kei; Sherman S. M. Chow

Paper 2025/2324

SHAFT: Secure, Handy, Accurate, and Fast Transformer Inference

Andes Y. L. Kei

, Chinese University of Hong Kong

Sherman S. M. Chow

, Chinese University of Hong Kong

Abstract

A growing adoption of transformer-based machine learning models is raising concerns about sensitive data exposure. Nonetheless, current secure inference solutions incur substantial overhead due to their extensive reliance on non-linear protocols, such as softmax and Gaussian error linear unit (GELU). Driven by numerical stability needs, softmax approximations (e.g., NeurIPS 2021) typically extract the maximum element of an input vector, incurring logarithmic rounds (in the input length). Existing GELU protocols (e.g., S&P 2024) use piecewise approximations with high-degree polynomials that rely heavily on secure multiplications and comparisons, which are expensive. Such complexities also hinder model owners unfamiliar with cryptography from deploying custom models. SHAFT, our proposed system, provides a secure, handy, accurate, and fast transformer inference framework for deployment. Highlights of our contributions include 1) the first constant-round (independent of sequence length) softmax protocol for transformers, using input clipping and an ordinary differential equation characterization, and 2) a highly accurate GELU protocol on a novel characterization designed for Fourier series approximation. Extending to broader contexts, our new protocols also apply to general neural networks that use softmax as the final layer and to transformer architectures with different activation functions. Remarkably, SHAFT outperforms state-of-the-art SIGMA (PETS 2024), which uses secret sharing, and BumbleBee (NDSS 2025), which additionally uses RLWE-based homomorphic encryption. More specifically, SHAFT reduces communication by 62–70% and is 1.8–2.4× faster than SIGMA, while also surpassing BumbleBee in terms of running time by 2.6–3.7× under LAN settings. Alongside these improvements, SHAFT attains accuracy comparable to plaintext models, confirming its numerical stability. Next in this progression, SHAFT provides an accessible open-source framework for secure and handy deployment by smoothly integrating with the Hugging Face library (EMNLP Demos 2020).

Note: corrected evaluation numbers and reporting; conclusions unchanged

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Published elsewhere. Minor revision. Network and Distributed System Security Symposium (NDSS) 2025
DOI: 10.14722/ndss.2025.242287
Keywords: Secure multiparty computation Softmax Model privacy Constant-round Transformer Inference Privacy-preserving ML GELU ONNX
Contact author(s): kyl022 @ ie cuhk edu hk
smchow @ ie cuhk edu hk
History: 2025-12-29: approved; 2025-12-25: received; See all versions
Short URL: https://ia.cr/2025/2324
License: CC BY

BibTeX

@misc{cryptoeprint:2025/2324,
      author = {Andes Y. L. Kei and Sherman S. M. Chow},
      title = {{SHAFT}: Secure, Handy, Accurate, and Fast Transformer Inference},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/2324},
      year = {2025},
      doi = {10.14722/ndss.2025.242287},
      url = {https://eprint.iacr.org/2025/2324}
}