CryptoGen: 通过加密的KV缓存重用来实现安全的Transformer生成
CryptoGen: Secure Transformer Generation with Encrypted KV-Cache Reuse
AI总结：
CryptoGen通过加密的KV缓存重用实现了高效的隐私保护神经生成，显著降低了生成延迟并保持线性扩展。
摘要：
云托管生成模型的广泛部署提出了一个根本性挑战：在不可信环境中实现高效的自回归生成的同时保护用户提示和模型参数的隐私。我们在一个客户端-服务器设置中解决这一挑战，其中不可信的服务器托管一个自回归的Transformer，而客户端需要对输入和推理进行加密保护。我们提出了CryptoGen，这是首个能够实现可扩展隐私保护神经生成的系统，通过持久化的加密键值（KV）缓存重用。判别任务安全推理系统在适应自回归解码时由于缺乏原生加密KV缓存支持而导致二次延迟和内存增长。相比之下，CryptoGen通过在整个生成过程中安全地重用和更新加密的KV缓存，实现了近线性扩展。CryptoGen集成了同态加密和秘密共享，以支持预填充和生成。关键技术包括统一的加密KV缓存框架、不同阶段的异构SIMD编码、优化的密码-密码矩阵-矩阵和矩阵-向量运算，以及高效的噪声刷新和密文连接机制。在生成Transformer模型上训练的WikiText-2、PTB和LAMBADA上评估显示，对于输入长度为128-512个token时，CryptoGen的每token延迟比最先进的判别安全推理系统低4.4x-7.6x，同时保持了近线性的延迟和内存扩展，对于更长的序列具有优势。CryptoGen作为开源库发布。
英文摘要：
The widespread deployment of cloud-hosted generative models raises a fundamental challenge: enabling efficient autoregressive generation while preserving the privacy of both user prompts and model parameters in untrusted environments. We address this challenge in a client-server setting where an untrusted server hosts an autoregressive Transformer and the client requires cryptographic protection for both inputs and inference. We present CryptoGen, the first system to enable scalable privacy-preserving neural generation with persistent encrypted key-value (KV) cache reuse. Discriminative-task secure inference systems incur quadratic latency and memory growth when adapted to autoregressive decoding due to the lack of native encrypted KV-cache support. In contrast, CryptoGen achieves near-linear scaling by securely reusing and updating encrypted KV caches throughout generation. CryptoGen integrates homomorphic encryption and secret sharing to support both prefilling and generation. Key techniques include a unified encrypted KV-cache framework, heterogeneous SIMD encodings for different phases, optimized cipher-cipher matrix-matrix and matrix-vector operations, and efficient noise refresh and ciphertext concatenation mechanisms. Evaluation on generative Transformer models trained on WikiText-2, PTB, and LAMBADA shows that for input lengths of 128-512 tokens, CryptoGen achieves 4.4x-7.6x lower per-token latency than state-of-the-art discriminative secure inference systems, while maintaining near-linear latency and memory scaling, with advantages increasing for longer sequences. CryptoGen is released as an open-source library.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
