# Research papers

Prioritized paper reimplementation plan, source status, contribution summaries, and PLLM implementation boundaries.

[View canonical HTML](https://pllm.run/research/papers/)

Document ID: `pllm.docs.research.papers`  
Release: `0.1.0`

This catalog is generated from the canonical research registry as of 2026-09-16. A tracked source, target module, or similar data flow is not evidence of implementation, reproduction, security, or benchmark parity.

R03 has a scoped clean-room component adaptation in the compact Q7 implementation. R23 has a structural `DecoderPlan` adaptation. Neither is a paper reproduction or protected-runtime result. R01-R02 remain reference primitives only, and R24 is planned.

## Reimplementation plan

The execution order is dependency-driven rather than paper-number order. Work starts only after these prerequisites:

1. Complete one executable Qwen composition without hidden fallback regions. The code-generated masked-linear CPU preset is now complete for untransformed Qwen2: a topology-derived prefill/decode schedule fuses q/k/v and gate/up stages, covers every layer plus KV state, final norm, output head, greedy selection, and feedback, and binds the semantic plan to the existing model-aware runtime bundle, tokenizer, runtime configuration, quantized stage bytes, per-row scales, and preparation commitments. A plan-bound session enforces greedy selection and feedback, workload and remote-stage output contracts, and poisoned-state handling. The pinned Qwen2.5-0.5B checkpoint passes a clear native-kernel prefill-to-decode functionality check through this binding; retained prepared-runtime evidence separately covers the masked protocol. This does not complete protected fixed-Q10/Q7 whole-model execution. Qwen3, KV-cache-eviction selection execution, transformed plans, and incompatible families remain incomplete or fail closed explicitly.
2. Current prepared-runtime comparison complete: the matched four-thread experiment measured 5.229 s median full latency versus 7.886 s with one thread on the recorded loopback host.
3. Bounded Q7 SiLU review complete: exact profile authorization, process-local issued-payload binding, and single-pass Python copying are enforced; cryptographic review and cross-process replay protection remain unavailable.

Plan status as of 2026-09-18:

| Priority | Capability track | Papers | Track status |
| ---: | --- | --- | --- |
| 1 | Delegated matrix-vector execution | [R07](/research/papers/r07-slalom/), [R24](/research/papers/r24-maverick/), [R08](/research/papers/r08-carnival/), [R16](/research/papers/r16-trapdoored-matrices/) | `planned` |
| 2 | Activation approximation | [R18](/research/papers/r18-compact/) | `planned` |
| 3 | Arithmetic garbling foundation | [R03](/research/papers/r03-garbling-gadgets/), [R04](/research/papers/r04-half-gates/), [R01](/research/papers/r01-dash/), [R02](/research/papers/r02-redash/) | `partial PLLM component adaptation` |
| 4 | Protected conversions and lookup | [R06](/research/papers/r06-duty-free-bits/), [R05](/research/papers/r05-logrow/) | `planned` |
| 5 | Protected KV-cache policy | [R23](/research/papers/r23-mpcache/) | `structural adaptation only` |
| 6 | Decision structures and regional selection | [R11](/research/papers/r11-fevbdd/), [R10](/research/papers/r10-oblivious-decision-programs/), [R09](/research/papers/r09-hycc/) | `planned` |
| 7 | Preparation, compression, and acceleration | [R15](/research/papers/r15-ring-pcg/), [R20](/research/papers/r20-oblivious-compression/), [R12](/research/papers/r12-piranha/) | `planned` |
| 8 | Full-system comparison targets | [R21](/research/papers/r21-nexus/), [R22](/research/papers/r22-openbumblebee/), [R13](/research/papers/r13-sigma/), [R14](/research/papers/r14-fusefss/), [R17](/research/papers/r17-curl/) | `tracked` |
| 9 | Source-gated verifiable comparison | [R19](/research/papers/r19-open-weight-verifiable/) | `source gated` |

### 1. Delegated matrix-vector execution

**Status:** `planned`
**Papers:** [R07](/research/papers/r07-slalom/), [R24](/research/papers/r24-maverick/), [R08](/research/papers/r08-carnival/), [R16](/research/papers/r16-trapdoored-matrices/)

Establish the exact Slalom baseline, implement Maverick masking and verification, reproduce the Carnival attack, and compare trapdoored-matrix delegation.

Module homes:

- `pllm-core::delegation::{masked_matvec,lpn_mask,batch_verify,trapdoored_matrix}`
- `pllm-assurance::attacks::carnival_projection`

### 2. Activation approximation

**Status:** `planned`
**Papers:** [R18](/research/papers/r18-compact/)

Reproduce Compact fitting and add immutable approximation profiles for SiLU, GeLU, and related bounded activations.

Module homes:

- `pllm-core::activation::piecewise`
- `pllm-compiler::approximation::{fit,profile}`

### 3. Arithmetic garbling foundation

**Status:** `partial PLLM component adaptation`
**Papers:** [R03](/research/papers/r03-garbling-gadgets/), [R04](/research/papers/r04-half-gates/), [R01](/research/papers/r01-dash/), [R02](/research/papers/r02-redash/)

Complete reviewed arithmetic and Boolean foundations, tensor evaluation, and residue scaling before full decoder-region composition.

Module homes:

- `pllm-garble::{arithmetic,boolean,half_gates,projection,label_tensor,rns_scale}`

### 4. Protected conversions and lookup

**Status:** `planned`
**Papers:** [R06](/research/papers/r06-duty-free-bits/), [R05](/research/papers/r05-logrow/)

Add typed Boolean-to-arithmetic conversion and efficient protected lookup only where an accepted complete-model plan requires them.

Module homes:

- `pllm-garble::conversion`
- `pllm-garble::lookup`

### 5. Protected KV-cache policy

**Status:** `structural adaptation only`
**Papers:** [R23](/research/papers/r23-mpcache/)

Validate the existing model-neutral transform, then reproduce protected static and dynamic cache selection in an explicitly compatible topology.

Module homes:

- `pllm-models::cache::{policy,full,static_eviction,dynamic_eviction}`

### 6. Decision structures and regional selection

**Status:** `planned`
**Papers:** [R11](/research/papers/r11-fevbdd/), [R10](/research/papers/r10-oblivious-decision-programs/), [R09](/research/papers/r09-hycc/)

Represent public functions compactly, add protected traversal where justified, and select legal protocol regions with conversion costs included.

Module homes:

- `pllm-compiler::{decision_diagram,region_selection,conversion_costs}`
- `pllm-garble::branching`

### 7. Preparation, compression, and acceleration

**Status:** `planned`
**Papers:** [R15](/research/papers/r15-ring-pcg/), [R20](/research/papers/r20-oblivious-compression/), [R12](/research/papers/r12-piranha/)

Compare correlation generation, bounded wire compression, and GPU kernels after exact CPU components establish correctness baselines.

Module homes:

- `pllm-core::correlation`
- `pllm-core::codec::oblivious_linear_code`
- `pllm-core::kernels::gpu`

### 8. Full-system comparison targets

**Status:** `tracked`
**Papers:** [R21](/research/papers/r21-nexus/), [R22](/research/papers/r22-openbumblebee/), [R13](/research/papers/r13-sigma/), [R14](/research/papers/r14-fusefss/), [R17](/research/papers/r17-curl/)

Reproduce unlike HE, two-party, FSS, and wavelet systems in isolated adapters without importing their topology or claims into the default profile.

Module homes:

- `protocol capability family`
- `preparation capability family`
- `activation capability family`
- `kernel capability family`

### 9. Source-gated verifiable comparison

**Status:** `source gated`
**Papers:** [R19](/research/papers/r19-open-weight-verifiable/)

Acquire and lock the complete protocol and artifact before specifying or implementing its open-weight verification boundary.

Module homes:

- `protocol open-weight verification capability`
- `verification model-owner setup capability`

Paper names remain provenance. Implementations live in capability-oriented modules so compatible alternatives can be composed and benchmarked through the same plan slots.

## Source registry

| Source order | ID | Paper | Implementation status |
| ---: | --- | --- | --- |
| 1 | [R01](/research/papers/r01-dash/) | Dash: Accelerating Distributed Private Convolutional Neural Network Inference with Arithmetic Garbled Circuits | `reference primitive only` |
| 2 | [R02](/research/papers/r02-redash/) | ReDASH: Fast and efficient Scaling in Arithmetic Garbled Circuits for Secure Outsourced Inference | `reference primitive only` |
| 3 | [R03](/research/papers/r03-garbling-gadgets/) | Garbling Gadgets for Boolean and Arithmetic Circuits | `PLLM component adaptation` |
| 4 | [R04](/research/papers/r04-half-gates/) | Two Halves Make a Whole: Reducing Data Transfer in Garbled Circuits using Half Gates | `tracked` |
| 5 | [R05](/research/papers/r05-logrow/) | Garbled Circuit Lookup Tables with Logarithmic Number of Ciphertexts | `tracked` |
| 6 | [R06](/research/papers/r06-duty-free-bits/) | Duty-Free Bits: Projectivizing Garbling Schemes | `tracked` |
| 7 | [R07](/research/papers/r07-slalom/) | Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware | `tracked` |
| 8 | [R08](/research/papers/r08-carnival/) | Slalom at the Carnival: Privacy-preserving Inference with Masks from Public Knowledge | `tracked` |
| 9 | [R09](/research/papers/r09-hycc/) | HyCC: Compilation of Hybrid Protocols for Practical Secure Computation | `tracked` |
| 10 | [R10](/research/papers/r10-oblivious-decision-programs/) | Oblivious decision program evaluation | `tracked` |
| 11 | [R11](/research/papers/r11-fevbdd/) | Factored Edge-Valued Binary Decision Diagrams | `tracked` |
| 12 | [R12](/research/papers/r12-piranha/) | Piranha: A GPU Platform for Secure Computation | `tracked` |
| 13 | [R13](/research/papers/r13-sigma/) | SIGMA: Secure GPT Inference with Function Secret Sharing | `tracked` |
| 14 | [R14](/research/papers/r14-fusefss/) | FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing | `tracked` |
| 15 | [R15](/research/papers/r15-ring-pcg/) | Efficient Pseudorandom Correlation Generators over Z/p^k Z | `tracked` |
| 16 | [R16](/research/papers/r16-trapdoored-matrices/) | Practical Secure Delegated Linear Algebra with Trapdoored Matrices | `tracked` |
| 17 | [R17](/research/papers/r17-curl/) | Curl: Private LLMs through Wavelet-Encoded Look-Up Tables | `tracked` |
| 18 | [R18](/research/papers/r18-compact/) | Compact: Approximating Complex Activation Functions for Secure Computation | `tracked` |
| 19 | [R19](/research/papers/r19-open-weight-verifiable/) | Private and Verifiable Outsourcing of Open-Weight LLM Inference | `tracked` |
| 20 | [R20](/research/papers/r20-oblivious-compression/) | Oblivious Ciphertext Compression via Linear Codes | `tracked` |
| 21 | [R21](/research/papers/r21-nexus/) | NEXUS: Secure Transformer Inference Made Non-interactive | `tracked` |
| 22 | [R22](/research/papers/r22-openbumblebee/) | BumbleBee: Secure Two-party Inference Framework for Large Transformers | `tracked` |
| 23 | [R23](/research/papers/r23-mpcache/) | MPCache: MPC-Friendly KV Cache Eviction for Efficient Private Large Language Model Inference | `PLLM reimplementation` |
| 24 | [R24](/research/papers/r24-maverick/) | Maverick: Private and Verifiable LLM Inference Made Practical via Matrix-Vector Multiplication Delegation | `planned` |

See the [research backlog](/research/backlog/) for cross-paper gates and current unfinished work.