{"id":"https://openalex.org/W7165032359","doi":"https://doi.org/10.48550/arxiv.2606.17421","title":"Bifrost: Hybrid TEE-FHE Inference for Privacy-Preserving Transformer and LLM Serving","display_name":"Bifrost: Hybrid TEE-FHE Inference for Privacy-Preserving Transformer and LLM Serving","publication_year":2026,"publication_date":"2026-06-16","ids":{"openalex":"https://openalex.org/W7165032359","doi":"https://doi.org/10.48550/arxiv.2606.17421"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.17421","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17421","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.17421","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138825219","display_name":"Chenghao Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Chenghao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101343479","display_name":"Kailun Qin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qin, Kailun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138781578","display_name":"Xiaolin Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Xiaolin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138775278","display_name":"Chi Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Chi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5008204306","display_name":"Dawu Gu","orcid":"https://orcid.org/0000-0002-0504-9538"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gu, Dawu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.7075999975204468,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.7075999975204468,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.07169999927282333,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.06270000338554382,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5303999781608582},{"id":"https://openalex.org/keywords/central-processing-unit","display_name":"Central processing unit","score":0.506600022315979},{"id":"https://openalex.org/keywords/ciphertext","display_name":"Ciphertext","score":0.45649999380111694},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.45579999685287476},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.4287000000476837},{"id":"https://openalex.org/keywords/trusted-computing-base","display_name":"Trusted computing base","score":0.3971000015735626},{"id":"https://openalex.org/keywords/backup","display_name":"Backup","score":0.3702000081539154},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.3521000146865845},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.3366999924182892},{"id":"https://openalex.org/keywords/cryptosystem","display_name":"Cryptosystem","score":0.3257000148296356}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7896000146865845},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5303999781608582},{"id":"https://openalex.org/C49154492","wikidata":"https://www.wikidata.org/wiki/Q5300","display_name":"Central processing unit","level":2,"score":0.506600022315979},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.49970000982284546},{"id":"https://openalex.org/C93974786","wikidata":"https://www.wikidata.org/wiki/Q1589480","display_name":"Ciphertext","level":3,"score":0.45649999380111694},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.45579999685287476},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.44209998846054077},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.4287000000476837},{"id":"https://openalex.org/C147346212","wikidata":"https://www.wikidata.org/wiki/Q5492632","display_name":"Trusted computing base","level":4,"score":0.3971000015735626},{"id":"https://openalex.org/C2780945871","wikidata":"https://www.wikidata.org/wiki/Q194274","display_name":"Backup","level":2,"score":0.3702000081539154},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.3521000146865845},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.3366999924182892},{"id":"https://openalex.org/C6295992","wikidata":"https://www.wikidata.org/wiki/Q976521","display_name":"Cryptosystem","level":3,"score":0.3257000148296356},{"id":"https://openalex.org/C100980136","wikidata":"https://www.wikidata.org/wiki/Q4668956","display_name":"Malleability","level":4,"score":0.3142000138759613},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.30059999227523804},{"id":"https://openalex.org/C180613757","wikidata":"https://www.wikidata.org/wiki/Q5013757","display_name":"CPU shielding","level":3,"score":0.290800005197525},{"id":"https://openalex.org/C203062551","wikidata":"https://www.wikidata.org/wiki/Q201339","display_name":"Public-key cryptography","level":3,"score":0.2858000099658966},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.2831999957561493},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2827000021934509},{"id":"https://openalex.org/C46331935","wikidata":"https://www.wikidata.org/wiki/Q4651362","display_name":"AES implementations","level":4,"score":0.2822999954223633},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.2775999903678894},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2703999876976013},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.2662000060081482},{"id":"https://openalex.org/C172191483","wikidata":"https://www.wikidata.org/wiki/Q1071806","display_name":"Provisioning","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C96147967","wikidata":"https://www.wikidata.org/wiki/Q190686","display_name":"Subroutine","level":2,"score":0.2635999917984009},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.260699987411499},{"id":"https://openalex.org/C158338273","wikidata":"https://www.wikidata.org/wiki/Q2154943","display_name":"Homomorphic encryption","level":3,"score":0.257099986076355},{"id":"https://openalex.org/C118463975","wikidata":"https://www.wikidata.org/wiki/Q220849","display_name":"Digital signature","level":3,"score":0.2563999891281128},{"id":"https://openalex.org/C2776834041","wikidata":"https://www.wikidata.org/wiki/Q25346349","display_name":"Execution model","level":2,"score":0.25429999828338623},{"id":"https://openalex.org/C9368797","wikidata":"https://www.wikidata.org/wiki/Q117010","display_name":"Disk encryption","level":4,"score":0.25119999051094055},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.25099998712539673},{"id":"https://openalex.org/C136085584","wikidata":"https://www.wikidata.org/wiki/Q910289","display_name":"Overlay","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.17421","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17421","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.17421","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17421","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.6223939657211304,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cloud-hosted":[0],"transformer":[1],"and":[2,37,62,115,134,149,172,197,215,236,240],"large":[3],"language":[4],"model":[5],"(LLM)":[6],"inference":[7,51],"creates":[8],"a":[9,76,92,128,160],"direct":[10,204],"confidentiality":[11],"problem:":[12],"user":[13],"prompts":[14],"may":[15],"contain":[16],"sensitive":[17],"code,":[18],"business":[19],"data,":[20],"personal":[21],"information,":[22],"or":[23],"regulated":[24],"documents,":[25],"yet":[26],"remote":[27],"serving":[28,95],"exposes":[29],"intermediate":[30],"state":[31,165,175],"to":[32,103],"the":[33,109,120,154,169,177,244],"cloud":[34],"software":[35,117],"stack":[36],"accelerator":[38,86,232],"runtime.":[39],"Fully":[40],"homomorphic":[41],"encryption":[42],"(FHE)":[43],"keeps":[44],"accelerator-side":[45],"execution":[46,67],"ciphertext-only,":[47],"but":[48,75],"end-to-end":[49],"LLM":[50],"remains":[52],"expensive":[53],"because":[54],"linear":[55,136],"layers":[56,137],"are":[57,100],"interleaved":[58],"with":[59],"non-linear,":[60,238],"cache-state,":[61],"refresh-sensitive":[63],"operators.":[64],"CPU":[65,77,106,155,170,245],"trusted":[66,121],"environments":[68],"(TEEs)":[69],"can":[70],"execute":[71,152],"those":[72],"operators":[73],"natively,":[74],"TEE":[78],"alone":[79],"does":[80],"not":[81],"define":[82],"how":[83],"an":[84,104,182],"untrusted":[85],"should":[87],"participate.":[88],"We":[89],"present":[90],"Bifrost,":[91],"hybrid":[93,178],"TEE-FHE":[94],"architecture":[96],"in":[97],"which":[98],"secrets":[99],"provisioned":[101],"only":[102,173,229],"attested":[105],"TEE,":[107,171],"while":[108,141],"accelerator,":[110],"device":[111],"memory,":[112],"driver/runtime":[113],"stack,":[114],"host":[116],"remain":[118],"outside":[119],"computing":[122],"base.":[123],"Bifrost":[124,188],"uses":[125],"FHE":[126,228],"as":[127],"secure":[129],"delegation":[130,233],"mechanism":[131],"for":[132],"projection":[133],"feed-forward":[135],"on":[138,194,199,212,217],"accelerator-backed":[139],"CKKS,":[140],"non-linear":[142],"operators,":[143],"attention-side":[144],"control":[145],"logic,":[146],"KV-state":[147],"transitions,":[148],"decrypt-then-encrypt":[150],"refresh":[151],"inside":[153,168,243],"TEE.":[156,246],"Bifrost+":[157,207],"further":[158],"applies":[159],"prefill/decode":[161],"split:":[162],"prompt-side":[163,241],"KV":[164],"is":[166,223,234],"built":[167],"decode-side":[174],"enters":[176],"ciphertext":[179],"path.":[180],"In":[181,203],"estimator-style":[183],"comparison":[184],"matching":[185],"Euston's":[186],"methodology,":[187],"reduces":[189,208],"projected":[190],"latency":[191],"by":[192,210],"9.25x":[193],"GPT-2":[195,213],"(1.5B)":[196],"9.91x":[198],"LLaMA":[200],"3":[201],"(8B).":[202],"CKKS/FHE":[205],"deployments,":[206],"TTFT":[209],"14.6-45.8x":[211],"(124M)":[214],"15.3-53.4x":[216],"Qwen3":[218],"(0.6B).":[219],"The":[220],"systems":[221],"lesson":[222],"selective":[224],"encrypted":[225],"execution:":[226],"use":[227],"where":[230],"ciphertext-only":[231],"required,":[235],"keep":[237],"refresh,":[239],"work":[242]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-18T00:00:00"}