Research papers

Prioritized paper reimplementation plan, source status, contribution summaries, and PLLM implementation boundaries.

This catalog is generated from the canonical research registry as of 2026-09-16. A tracked source, target module, or similar data flow is not evidence of implementation, reproduction, security, or benchmark parity.

R03 has a scoped clean-room component adaptation in the compact Q7 implementation. R23 has a structural DecoderPlan adaptation. Neither is a paper reproduction or protected-runtime result. R01-R02 remain reference primitives only, and R24 is planned.

Reimplementation plan

The execution order is dependency-driven rather than paper-number order. Work starts only after these prerequisites:

Complete one executable Qwen composition without hidden fallback regions. The code-generated masked-linear CPU preset is now complete for untransformed Qwen2: a topology-derived prefill/decode schedule fuses q/k/v and gate/up stages, covers every layer plus KV state, final norm, output head, greedy selection, and feedback, and binds the semantic plan to the existing model-aware runtime bundle, tokenizer, runtime configuration, quantized stage bytes, per-row scales, and preparation commitments. A plan-bound session enforces greedy selection and feedback, workload and remote-stage output contracts, and poisoned-state handling. The pinned Qwen2.5-0.5B checkpoint passes a clear native-kernel prefill-to-decode functionality check through this binding; retained prepared-runtime evidence separately covers the masked protocol. This does not complete protected fixed-Q10/Q7 whole-model execution. Qwen3, KV-cache-eviction selection execution, transformed plans, and incompatible families remain incomplete or fail closed explicitly.
Current prepared-runtime comparison complete: the matched four-thread experiment measured 5.229 s median full latency versus 7.886 s with one thread on the recorded loopback host.
Bounded Q7 SiLU review complete: exact profile authorization, process-local issued-payload binding, and single-pass Python copying are enforced; cryptographic review and cross-process replay protection remain unavailable.

Plan status as of 2026-09-18:

Priority	Capability track	Papers	Track status
1	Delegated matrix-vector execution	R07, R24, R08, R16	`planned`
2	Activation approximation	R18	`planned`
3	Arithmetic garbling foundation	R03, R04, R01, R02	`partial PLLM component adaptation`
4	Protected conversions and lookup	R06, R05	`planned`
5	Protected KV-cache policy	R23	`structural adaptation only`
6	Decision structures and regional selection	R11, R10, R09	`planned`
7	Preparation, compression, and acceleration	R15, R20, R12	`planned`
8	Full-system comparison targets	R21, R22, R13, R14, R17	`tracked`
9	Source-gated verifiable comparison	R19	`source gated`

1. Delegated matrix-vector execution

Status: planned
Papers: R07, R24, R08, R16

Establish the exact Slalom baseline, implement Maverick masking and verification, reproduce the Carnival attack, and compare trapdoored-matrix delegation.

Module homes:

pllm-core::delegation::{masked_matvec,lpn_mask,batch_verify,trapdoored_matrix}
pllm-assurance::attacks::carnival_projection

2. Activation approximation

Status: planned
Papers: R18

Reproduce Compact fitting and add immutable approximation profiles for SiLU, GeLU, and related bounded activations.

Module homes:

pllm-core::activation::piecewise
pllm-compiler::approximation::{fit,profile}

3. Arithmetic garbling foundation

Status: partial PLLM component adaptation
Papers: R03, R04, R01, R02

Complete reviewed arithmetic and Boolean foundations, tensor evaluation, and residue scaling before full decoder-region composition.

Module homes:

pllm-garble::{arithmetic,boolean,half_gates,projection,label_tensor,rns_scale}

4. Protected conversions and lookup

Status: planned
Papers: R06, R05

Add typed Boolean-to-arithmetic conversion and efficient protected lookup only where an accepted complete-model plan requires them.

Module homes:

pllm-garble::conversion
pllm-garble::lookup

5. Protected KV-cache policy

Status: structural adaptation only
Papers: R23

Validate the existing model-neutral transform, then reproduce protected static and dynamic cache selection in an explicitly compatible topology.

Module homes:

pllm-models::cache::{policy,full,static_eviction,dynamic_eviction}

6. Decision structures and regional selection

Status: planned
Papers: R11, R10, R09

Represent public functions compactly, add protected traversal where justified, and select legal protocol regions with conversion costs included.

Module homes:

pllm-compiler::{decision_diagram,region_selection,conversion_costs}
pllm-garble::branching

7. Preparation, compression, and acceleration

Status: planned
Papers: R15, R20, R12

Compare correlation generation, bounded wire compression, and GPU kernels after exact CPU components establish correctness baselines.

Module homes:

pllm-core::correlation
pllm-core::codec::oblivious_linear_code
pllm-core::kernels::gpu

8. Full-system comparison targets

Status: tracked
Papers: R21, R22, R13, R14, R17

Reproduce unlike HE, two-party, FSS, and wavelet systems in isolated adapters without importing their topology or claims into the default profile.

Module homes:

protocol capability family
preparation capability family
activation capability family
kernel capability family

9. Source-gated verifiable comparison

Status: source gated
Papers: R19

Acquire and lock the complete protocol and artifact before specifying or implementing its open-weight verification boundary.

Module homes:

protocol open-weight verification capability
verification model-owner setup capability

Paper names remain provenance. Implementations live in capability-oriented modules so compatible alternatives can be composed and benchmarked through the same plan slots.

Source registry

Source order	ID	Paper	Implementation status
1	R01	Dash: Accelerating Distributed Private Convolutional Neural Network Inference with Arithmetic Garbled Circuits	`reference primitive only`
2	R02	ReDASH: Fast and efficient Scaling in Arithmetic Garbled Circuits for Secure Outsourced Inference	`reference primitive only`
3	R03	Garbling Gadgets for Boolean and Arithmetic Circuits	`PLLM component adaptation`
4	R04	Two Halves Make a Whole: Reducing Data Transfer in Garbled Circuits using Half Gates	`tracked`
5	R05	Garbled Circuit Lookup Tables with Logarithmic Number of Ciphertexts	`tracked`
6	R06	Duty-Free Bits: Projectivizing Garbling Schemes	`tracked`
7	R07	Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware	`tracked`
8	R08	Slalom at the Carnival: Privacy-preserving Inference with Masks from Public Knowledge	`tracked`
9	R09	HyCC: Compilation of Hybrid Protocols for Practical Secure Computation	`tracked`
10	R10	Oblivious decision program evaluation	`tracked`
11	R11	Factored Edge-Valued Binary Decision Diagrams	`tracked`
12	R12	Piranha: A GPU Platform for Secure Computation	`tracked`
13	R13	SIGMA: Secure GPT Inference with Function Secret Sharing	`tracked`
14	R14	FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing	`tracked`
15	R15	Efficient Pseudorandom Correlation Generators over Z/p^k Z	`tracked`
16	R16	Practical Secure Delegated Linear Algebra with Trapdoored Matrices	`tracked`
17	R17	Curl: Private LLMs through Wavelet-Encoded Look-Up Tables	`tracked`
18	R18	Compact: Approximating Complex Activation Functions for Secure Computation	`tracked`
19	R19	Private and Verifiable Outsourcing of Open-Weight LLM Inference	`tracked`
20	R20	Oblivious Ciphertext Compression via Linear Codes	`tracked`
21	R21	NEXUS: Secure Transformer Inference Made Non-interactive	`tracked`
22	R22	BumbleBee: Secure Two-party Inference Framework for Large Transformers	`tracked`
23	R23	MPCache: MPC-Friendly KV Cache Eviction for Efficient Private Large Language Model Inference	`PLLM reimplementation`
24	R24	Maverick: Private and Verifiable LLM Inference Made Practical via Matrix-Vector Multiplication Delegation	`planned`

See the research backlog for cross-paper gates and current unfinished work.

Research papers

On this page