International Association
for Cryptologic Research

Conditional linear cryptanalysis represents an extension of linear cryptanalysis and has been applied to DES and AES. Notably, it enables the construction of a linear distinguisher for 4-round AES, which is considered unattainable through standard linear cryptanalysis. The underlying principle is that the correlation of a linear approximation can be improved when the data is restricted to a specific subspace or subset, thereby allowing more effective linear cryptanalysis. The critical challenge in conditional linear cryptanalysis lies in identifying appropriate conditions to impose on the data; however, previous methods rely on ad hoc strategies that depend heavily on expert intuition, which limits their generalization and application.

In this paper, we propose a generalized framework for conditional linear cryptanalysis. The core tool is the conditional linear approximation table (CLAT), which quantifies linear correlations within constrained data subspaces. We further define a metric termed conditional linear weight, which balances the gain in correlation against the overhead of data filtering, thereby offering a quantitative measure of resistance against conditional linear cryptanalysis. Based on the CLAT and conditional linear weight, we develop an MILP-based automatic search model for conditional linear trails and devise systematic approaches for mounting distinguishing and key recovery attacks using these trails. Applying our framework to AES, Rijndael-256, ARIA, LED, Midori-128, and SKINNY-128, we demonstrate that conventional full-space bounds do not guarantee resistance against conditional linear cryptanalysis, and we propose improved linear attacks.

Our framework provides systematic approaches and automatic tools for conditional linear cryptanalysis. It enables cryptanalysts to gain deeper insights into the statistical linear properties of cryptographic primitives and serves as a useful evaluation technique for new designs.

Modern zero-knowledge (ZK), fully homomorphic encryption (FHE) and Multi-party Computation (MPC) protocols have motivated research interest in Arithmetization-Oriented (AO) cryptographic primitives. The use of these protocols on embedded platforms requires consideration for protection against side-channel analysis (SCA), including timing and power attacks. Compared to traditional bit-oriented block ciphers, the design of side-channel countermeasures for AO-based ciphers poses unique challenges due to their different mathematical properties and computation requirements.

In this work, we perform side-channel analysis of MiMC, a well-known AO block cipher. We first consider its constant-time implementation over the BN254 prime field for both x86 and ARM-v7 targets. Next, we demonstrate both profiled (SASCA) and unprofiled (linear regression) power analysis of our implementation on the ARM Cortex-M4 microcontroller, showing that a DPA adversary can reduce the key-guessing space to just \(2^{30}\) candidates using only \(\approx\) 32000 power measurements, and the profiling adversary can perform full key recovery in as few as 100 measurements.

Hence, we consider and compare two side-channel countermeasures: a classical ISW masking approach, and the redundant number representation (RNR) adapted for large prime fields. For the RNR countermeasure, we show that \(\approx 64\) bits of redundancy are sufficient to reduce the information leakage enough to make DPA attacks impractical. Our claim is supported both by a standard fixed-vs-random leakage assessment with 10 million collected traces and by quantitative analysis via SASCA attacks. Finally, we compare the performance of the RNR countermeasure with first-order masking. While masking incurs in a \(\approx 8.3\times \) overhead on a Cortex-M4 MCU and in an \(\approx 81\times \) overhead on an x86-64 CPU, the RNR approach only introduces a \(\approx 50\%\) overhead on both targets.

Brakedown (CRYPTO 2023) is a transparent polynomial commitment scheme with fast proving. Its reliance on codes with small minimum distance forces the protocol to sample more columns to achieve soundness, resulting in larger proof sizes. Replacing the underlying code with Reed-Solomon codes yields better distance properties and should reduce the number of required queries. However, the standard row-wise RS protocol cannot exploit proximity results beyond the unique-decoding radius, such as the Johnson bound (JACM 2023). The bottleneck is structural: the protocol performs two independent checks—proximity testing and evaluation binding. Increasing the proximity radius reduces queries for the first check but increases queries for the second, leaving the overall proof size unchanged.

Diamond and Posen (CIC 2024) consolidate these checks when the evaluation point is chosen randomly by the verifier. For predetermined or application-specified points, existing approaches introduce a sumcheck reduction that adds logarithmic rounds and prover overhead.

We present DeepBrake, a Reed-Solomon polynomial commitment that consolidates the two checks for arbitrary evaluation points without sumcheck. By fixing row evaluations before the verifier samples the random fold, the protocol uses a single proximity test to verify both properties simultaneously. This enables DeepBrake to exploit stronger proximity bounds and reduce the number of queries.

At $n=2^{20}$ and rate $1/2$ over Ft255, DeepBrake's opening phase is $3.5\times$ faster than the Diamond-Posen baseline with sumcheck, with $16.5\%$ lower total prover time and $2.7\%$ larger proof size.

We further introduce BrakeWHIR, which replaces the explicit proof elements with succinct polynomial commitment openings using WHIR (EUROCRYPT 2025). BrakeWHIR achieves $2.6\times$ faster verification and $1.9\times$ smaller proofs than DeepBrake.

Let $E=\mathbb Q(\zeta_m)$ be a power-of-two cyclotomic field, with maximal totally real subfield $K=\mathbb Q(\zeta_m+\zeta_m^{-1})$. In previous work, Chevignard et al. (Eurocrypt'25) gave a reduction from module-LIP for rank-two module lattices over $\mathcal O_E$ to the norm-reduced Principal Ideal Problem (nrdPIP) in a quaternion algebra. We derive two consequences of this reduction. First, we obtain a polynomial time reduction from rank-$2$ module-LIP over $\mathcal O_E$ to rank-$3$ module-LIP over $\mathcal O_K$. Note that rank-$2$ modules over $\mathcal O_E$ are naturally seen as rank-$4$ modules over $\mathcal O_K$, so this is indeed an improvement. Our second result is specific to the module $\mathcal O_E^2$, underlying the Hawk signature scheme. In this setting, we also obtain a reduction to a rank-$3$ module-LIP instance over $\mathcal O_K$, but we can additionally show that these modules have a simple geometric shape: they are isomorphic to $\mathbb Z^{m/2+1} \perp \sqrt{2}\, \mathbb Z^{m/4-1}$. We then adapt Ducas' result (ePrint'23) to this setting. Putting everything together we obtain an algorithm breaking \Hawk's key recovery by making polynomially many exact-SVP calls in lattices of dimension at most $3m/8+1$. This improves upon the previous analysis from Ducas (ePrint'23) which required exact-SVP calls in lattices of dimension at most $m/2+1$.

Recent advances in lattice-based threshold cryptography, including threshold fully homomorphic encryption (ThFHE) and threshold public key encryption (ThPKE), commonly employ Shamir secret sharing over rings. While conceptually simple, these schemes suffer from rapidly growing denominator-clearing factors required for secret reconstruction as the number of parties $N$ increases, which in turn necessitates larger ciphertext moduli and complex reconstruction procedures.

In this work, we revisit the notion of subtractive sets underlying ring-based Shamir secret sharing and present a refined framework for constructing integer-reconstructible sharing over cyclotomic rings. To that end, we introduce a new geometric analysis of Lagrange coefficients and show that the resulting reconstruction factors can be made significantly smaller under specific settings. In particular, our framework enables smaller ciphertext sizes in $(t,N)$-threshold settings, and yields improved correctness and efficiency when applied to any ring-based threshold construction employing Shamir secret sharing over cyclotomic rings. Specifically, in lattice-based one-round $(t, N)$-ThFHE schemes, our approach reduces the bit-size of ciphertext moduli from $O(N)$ to $O(t\log (N/t^2))$ while ensuring efficient denominator handling. For lattice-based ThPKE, our method yields a new bound on reconstruction factors that improves upon the recent state-of-the-art result of Pilvi. Moreover, we implement ThFHE schemes over cyclotomic rings based on our framework and demonstrate their practical efficiency. Our experimental results show that each algorithm completes within $0.2$ seconds for $N=64$ and remains scalable for larger configurations with $N\geq 256$.

Batched threshold encryption (BTE) is a novel public-key paradigm in which, once a batch of $B$ ciphertexts is designated, a decrypter evaluates them using decryption key shares generated by decryption committee nodes via threshold reconstruction. To mitigate Miner Extractable Value (MEV) attacks in fully decentralized environments like blockchains, it is essential to guarantee mempool privacy while supporting a silent setup that allows decentralized key generation among decryption nodes. Furthermore, to efficiently process large batches of ciphertexts, an outsourcing mechanism that delegates heavy decryption computations to a cloud server is indispensable.

In this paper, we observe that naively adding decryption outsourcing to a threshold batched identity-based encryption with silent setup (TBIBE-SS) scheme of Gong et al.~(EUROCRYPT 2026) causes the outsourcing communication overhead to scale undesirably with the number of decryption nodes. To overcome this limitation, we introduce a partial re-randomization technique--replacing conventional full re-randomization--and incorporate a handle-based oracle query mechanism into the security model. Based on these techniques, we propose a communication-efficient outsourced TBIBE-SS (O-TBIBE-SS) scheme and formally prove its security. We then combine our O-TBIBE-SS scheme with additional cryptographic primitives to construct a verifiable outsourced BTE-SS (VOBTE-SS) scheme, which supports both delegated decryption and verifiability of outsourced computation, proving its security under an augmented threat model. Our VOBTE-SS scheme represents the first construction to achieve efficient batched decryption outsourcing in terms of both communication and computation overhead within decentralized environments.

Privacy-preserving machine learning auditing protocols allow auditors to assess models for properties such as accuracy or fairness, without revealing their internals or training data. This makes them especially attractive for auditing models deployed in sensitive domains such as healthcare or finance. For these protocols to be meaningful in real-world audit settings, though, their guarantees must reflect how the model will behave once deployed, rather than merely certifying its behavior during an audit. Existing security definitions often miss this mark: most certify model behavior only on a fixed audit dataset, without ensuring that the same guarantees generalize to other datasets drawn from the same distribution. As we show, this gap allows a model provider to attack many cryptographic model certification (CMC) schemes built on secure zero knowledge proofs (ZKP) by carefully engineering training data, resulting in models that exhibit benign behavior during an audit, but pathological behavior in practice. For example, we empirically demonstrate that an attacker can certify that a model achieves over 99% accuracy on an audit dataset, but less than 30% accuracy on fresh samples from the same distribution.

To address this gap, we formalize rigorous cryptographic security notions tailored to CMC frameworks, introduce a generic protocol template, and prove that it satisfies these requirements. Our results thus offer both cautionary evidence about existing approaches and constructive guidance for designing secure, privacy-preserving ML auditing protocols.

${\sharp}\textrm{Pencil}$ is a domain-extended pseudorandom function by Bhaumik et al, accepted at CRYPTO 2026, with a claim that it achieves close to $n$-bit security beyond the birthday bound. It is used as the key-derivation layer of the ${\sharp}\textrm{Pencil}$-CAU authenticated-encryption mode. We show that ${\sharp}\textrm{Pencil}$ has a birthday-bound collision attack: its front end $\textsf{Sharp}$ compresses the second half $N_2$ of the input through the $(n-8)$-bit value \[ J(N_2) = \operatorname{msb}_{n-8}\bigl({\mathsf{E}}_{K_1}(N_2 || \texttt{0x00})\bigr), \] after which the entire computation is a deterministic function of $(N_1,J)$. Thus, for any fixed $N_1$, distinct values $(N_2,N_2')$ satisfying $J(N_2)=J(N_2')$ produce identical ${\sharp}\textrm{Pencil}$ outputs. Such collisions occur with probability $1-e^{-1}$ after $2^{(n-7)/2}$ queries, $2^{60.5}$ when $n=128$. This yields a PRF distinguisher with constant advantage, contradicting the security bound of Theorem 4. Since $2^{60.5}$ falls below the birthday bound $2^{n/2}$ that the construction was designed to pass, the beyond-birthday-bound property does not hold. Given the derived key $K_1$, an explicit collision can be constructed in approximately $10^3$ inverse-cipher evaluations in expectation. The same collision breaks ${\sharp}\textrm{Pencil}$-CAU, as two nonce-respecting queries can reuse the key and the nonce of the inner GCM instance, yielding the difference of the two plaintexts.

We study the communication complexity of non-interactive secure computation (NISC) protocols with security against malicious adversaries. We give a general NISC protocol for any two-party function computed by a Boolean circuit $C$ using only $O(|C|\lambda)$ bits of communication, where $\lambda$ is a computational security parameter. This protocol is unconditionally secure in the random oracle model, assuming a standard random bit OT correlations setup. Compared to Yao's semi-honest protocol, our protocol incurs only a constant communication overhead and achieves security against malicious parties with no additional interaction. Prior works achieved such constant overhead by either using a larger number of rounds or more structured correlations.

The Vandermonde Knapsack problem comprises a family of algebraic variants of the Knapsack problem. This includes the Partial Vandermonde $(\mathsf{PV})$ Knapsack problem (DCC’15, ACNS’14, ACISP’18, DCC’20, Indocrypt'25), the Vanishing $\mathsf{SIS}$ $(\mathsf{vSIS})$-based commitment problem (Crypto’23, PKC'25), and related assumptions. These problems have played an important role in enabling efficient lattice-based cryptographic constructions. Recently, two independent works by Boudgoust, Gachon, and Pellet-Mary (Crypto’22), and by Das and Joux (Eurocrypt’24), proposed attacks demonstrating that certain instances of the $\mathsf{PV}$ Knapsack problem are weak. In this paper, we present new attacks on the $\mathsf{PV}$ Knapsack problem for power-of-two cyclotomic rings. By combining our techniques with the attack of Das and Joux, we show that a substantially larger fraction of keys are weak in this setting than was previously known. We then extend our attack to the integer variant of the $\mathsf{vSIS}$ commitment problem, demonstrating that certain instances are also weak for specific parameter regimes.

We study amortization of prover work in the multi-verifier setting, motivated by proof-as-a-service deployments in which a shared prover serves $K$ independent clients holding distinct statements. Each verifier checks only its own statement and proof, with no inter-verifier communication. The challenge is therefore to amortize prover work across many proofs while preserving local verification.

We consider polynomial relations arising naturally in IOP-based proof systems, where verification reduces to polynomial identities and polynomial openings at verifier-chosen random points. Existing amortization techniques rely on shared verifier randomness, for example, to batch openings at a common evaluation point. However, under the standard Fiat--Shamir transform, independently verifiable proofs derive challenges from separate transcripts, preventing such amortization.

We address this obstacle through a multi-verifier Fiat--Shamir transform that correlates verifier challenges across independently verifiable proofs while preserving locality. We further introduce promise local folding schemes, which defer polynomial-constraint checks generated during folding and amortize them later. Together, these techniques provide a generic framework for amortization under local verification.

We apply this framework to the witness-independent component arising in R1CS- and CCS-based SNARK provers, which reduces to bivariate polynomial evaluation claims over the public constraint matrices. This component accounts for a substantial portion of the concrete proving cost. Applying our techniques to these claims reduces the server's cryptographic cost for this component from $O(K\cdot s)$ to $O(K\log K+s)$ group operations, where $s$ denotes the sparsity of the public constraint matrices, with each verifier performing only $O(\log K)$ cryptographic work and requiring no inter-verifier communication. Because the amortized component depends only on the public circuit description, our framework composes cleanly with collaborative zk-SNARK protocols, which target the complementary witness-dependent component.

Updatable vector commitments let users store and authenticate values contained within an evolving data vector. Existing work on updatable vector commitments studies how clients can store only the values and authentication proofs relevant to them, and can refresh stale opening proofs, with the help of an online maintainer that keeps the current vector and proof state. This work studies the complementary problem: how to decentralize the maintainer, in order to distribute the cost and availability requirements.

We formalize this problem as extendable distributed vector commitments (EDVC). A public control plane, such as consensus or a trusted party, determines batches of updates and extensions of stored vector. Maintainers accept and apply a batch only after validating it against the current authenticated state. The resulting state is stored across many maintainer nodes, each of which holds a publicly assigned coded data fragment and updates it non-interactively. A stale client can obtain the current state, and a fresh authenticated opening, from the current maintainers (without replaying the updates history).

We construct the first EDVC protocol, called Borg, from two components: a sparse vector commitment, and a coded storage layer that can be updated by linear operations. This construction applies when all active positions lie within a known growing prefix of the vector. We then construct a coded storage layer with the operations needed for this setting, including single-position openings, aligned range openings, public updates, adding new nodes, repairing failed nodes, and moving storage responsibilities between nodes. This is then used to flexibly distribute the data alongside a sparse Merkle tree for authentication.

Our construction is particularly simple when the maintained data is an append-only public log (e.g., a blockchain’s block archive, or certificate transparency logs). In this setting, distributed updates to the data and its authentication structure can be made just by broadcasting the new log entries, with no coordination across maintainer nodes. We empirically evaluate maintainers’ cost for various workflows, showing that nodes can process hundreds of thousands of updates per second. We also show that node addition, repair of lost local state, and changes to the proof-serving threshold can all be supported efficiently.

Privacy-preserving machine learning under fully homomorphic encryption (FHE) faces a structural limitation: numerical precision is bound to cryptographic parameters and key material, forcing precision to be fixed at scheme initialization. Existing frameworks must regenerate keys or recompile circuits whenever bit-width changes, eliminating precision as a deployment-time performance knob and making mixed-precision strategies - widely used in plaintext machine learning - impractical under encryption.

We present $\mathtt{Tailor}$, a backend-agnostic framework for exact, runtime-configurable mixed-precision neural inference over bitwise FHE. By representing signed integers as vectors of independently encrypted bits and constructing all arithmetic and neural-network operators from precision-parametric Boolean circuits, $\mathtt{Tailor}$ decouples bit-width from cryptographic state. Per-layer precision becomes a runtime parameter under a single keygen, and nonlinear operators, including ReLU, absolute value, and comparisons, are evaluated exactly rather than via polynomial approximation. A fused saturating requantize - ReLU produces compact unsigned activations, and each accumulator is provisioned at its provably minimal width. A $\mathtt{Scheme}$ abstraction makes the framework portable across bitwise FHE families; we instantiate it for both TFHE and FINAL, along with a plaintext reference backend for functional validation and exact gate accounting.

Our evaluation of an MNIST classifier shows that mixed-precision configurations strictly Pareto-dominate uniform deployment. Reducing only the output-layer weights to 2 bits while keeping inputs, activations, and hidden-layer weights at 4 bits yields the highest accuracy among all evaluated settings, 96.44% in 222.0s. This is both more accurate and faster than uniform 4-bit inference (96.17% in 236.1s) and $2.8\times$ faster than uniform 8-bit (96.14% in 632.4s). Reducing the hidden-layer weights to 2 bits instead trades 0.4 accuracy points for a $1.5\times$ speedup over uniform 4-bit (95.80% in 158.2s).

We present new sample-runtime tradeoffs for the decisional sparse Learning With Errors (LWE) and sparse Learning Parity with Noise (LPN) problems over $\mathbb{Z}_q$, specifically in regimes where the secret vector is constrained by a small $l_{\infty}$ norm. While small-secret constraints are useful for the practical efficiency of lattice-based cryptography—such as homomorphic encryption and zero-knowledge proofs—the extent to which an adversary can exploit these bounds when the coefficient matrix is sparse is an open question. We address this by reducing the distinguishing task to a relaxed variant of the Short Integer Solution (SIS) problem, where the strict $A^\text{T} \mathbf{c} = 0$ requirement is replaced with an $l_1$-norm bound on $A^\text{T} \mathbf{c}$. To solve this relaxed SIS problem, we design an algorithm that samples distinct, non-trivial walks on a Kikuchi graph having close end points. For LWE, this approach directly separates planted from random instances. For LPN, where the noise is uniformly distributed over non-zero elements, the proof is more involved. We first derive a different reduction from LPN to (relaxed) SIS and then extend the anti-concentration framework given by Gupta, He, O'Donnell, and Singer (SODA 2026).

In this work, we propose three techniques for advancing cryptanalysis of round-reduced AES, two of which exploit the multiplicative inverse, and a third, structural, property that generalizes the S-box switch to multiple quartets.

Firstly, we formalize the cross-ratio property for tracing a nonlinear equation over $F_{2^8}$ from the differences of four distinct inputs or their respective outputs through the key-wrapped multiplicative inverse. While the underlying properties of the multiplicative inverse have been well-studied, their usefulness for non-algebraic attacks has surprisingly remained unexamined. We demonstrate that it allows a more efficient matching between the sets of many related texts in a Demirci-Selçuk Meet-in-the-middle attack, leading to reductions in time and memory of both the online and offline phases for the seminal seven-round AES-128 by Derbez et al. from Eurocrypt 2013.

Secondly, we show that the cross-ratio property gives rise to a relevant special case: when its inputs to the multiplicative inverse span a two-dimensional space, one can almost always recover the input differences of a quartet from only their output differences, or, in an alternative formulation, even the key applied before the outputs. We show how this can lead to new reduced-data three-round distinguishers.

Thirdly, we define the mixture-quartet switch, an event that a mixture plaintext structure of 16 texts allows a partitioning into four quartets that all produce a related difference after two rounds. While most recent advances of the analysis of AES had focused on structural properties, we can trace partially active diagonals through a Super-S-box. Thus, by combining structural and algebraic properties, we describe a new distinguisher on four AES rounds with lower data complexity. Our applications do not threaten the security of the full AES, but advance the understanding of the building blocks of the AES further, and are likely applicable to similar settings and ciphers.

In this article, we first reformulate the wedge attack within a cleaner algebraic-geometric framework and then extend it to multi-homogeneous polynomial systems for any characteristic. Building on these tools, we apply the resulting multi-homogeneous wedge attack to the security analysis of SNOVA.

We study two central problems in threshold cryptography from lattices: (1)~threshold encryption with silent setup for general thresholds $t \geq 2$, where no post-quantum constructions were previously known, and (2)~threshold fully homomorphic encryption (TFHE) with sublinear parameters, an open problem since the work of Boneh~et~al.\ (CRYPTO~2018).

We introduce \emph{$(\alpha,\beta)$-Scaled Linear Secret Sharing Schemes} (LSSS), a relaxation of standard LSSS in which each authorized set~$S$ reconstructs a scaled version of the secret, $\gamma_S \cdot k$, where both the reconstruction coefficients and the set-dependent scaling factor~$\gamma_S$ are bounded over the integers. Unlike prior approaches based on bit decomposition, this preserves the uniform distribution of unauthorized shares. Building on this, we obtain: \begin{itemize} \item \textbf{Distributed monotone-policy encryption with silent setup.} We provide the first post-quantum construction supporting: (i) DNF formulas with fully compact parameters, and (ii) threshold policies with ciphertexts growing as $\tau^6 \cdot \mathsf{poly}(\lambda, \log N)$, where $\tau = \min(t^2,N{-}t)$. Our constructions are proven secure under the decomposed LWE assumption in the random oracle model. If we additionally rely on a common reference string, then the ciphertext size for our threshold policy scheme can be reduced to $\tau^2 \cdot \mathsf{poly}(\lambda, \log N)$ under the Succinct LWE assumption. \item \textbf{Decentralized TFHE with silent setup.} We provide the first \emph{decentralized} TFHE, for DNFs and threshold policies, from the decomposed LWE assumption. Our construction supports homomorphic evaluation of arbitrary circuits, one-round distributed decryption, and silent setup. This was left as an open problem by Boneh~et~al.\ (CRYPTO~2018) and, prior to this work, we did not have any non-trivial construction for decentralized TFHE from any assumption. \item \textbf{Sublinear centralized TFHE from LWE.} We also extend our techniques to \emph{centralized} TFHE. We provide a TFHE scheme under the standard LWE assumption, where all parameters are simultaneously sublinear in $N$ for any threshold $t$ as long as $\min(t^2, N{-}t) = o(N)$. This breaks the $\omega(N)$ barrier that has persisted in the TFHE literature since 2018. \end{itemize}

We develop the radix-2 number-theoretic transform (NTT) and its butterflies, the twisting trick and why it never changes the transform, the freedom to use Cooley--Tukey butterflies in both directions, incomplete NTTs, Good's trick, and the ways all of these combine---closing with the coefficient-bound bookkeeping that motivates the whole toolkit. This note is intended to help implementers of postquantum cryptography, and is compressed from the author's lecture slides in his Postquantum Cryptography class at National Taiwan University (2020--2025). It may be otherwise trivial for FFT experts who know the DIT--DIF equivalence inside out---except that they tend not to ever encounter incomplete NTTs.

Commutative diagrams of isogenies between supersingular elliptic curves, which are called isogeny diamonds, have become fundamental to isogeny-based cryptography for both constructive and cryptanalytic purposes. In parallel, proofs of knowledge of isogenies have been widely studied and have found many applications. In this work, we combine these two directions and introduce zero-knowledge proofs of isogeny diamonds, namely, we prove knowledge of isogenies that form a commutative diagram between four curves.

We present four constructions that work in various settings. The first, Windmill-ZKP assumes that the prover knows only two parallel isogenies in the diamond. The second, Cube-ZKP assumes the prover has knowledge of four of specified degree isogenies. Finally, Kube-ZKP and Kani-ZKP prove knowledge of isogeny diamonds whose degree sum is smooth. We also provide proof-of-concept implementations of the proposed constructions and compare their performance. Our results demonstrate the trade-offs between security, efficiency and compactness in these constructions.

Running Transformer inference and retrieval-augmented generation (RAG) over confidential data forces a choice: either expose prompts and documents to a cloud operator, or keep the data on-premises, which confines the deployment to weaker self-hosted models. Existing defenses span five mechanism families: secure computation (MPC and FHE), trusted execution environments (TEEs), static obfuscation, differential privacy, and hybrid TEE-and-obfuscation splits. No prior systematization compares them on a common footing of mechanism, threat model, and deployment cost, and none covers the RAG retrieval layer. We organize the field by deployment readiness: the likelihood a scheme is adopted in practice, scored on performance, utility, and threat-model fit. The scoring spans inference and RAG retrieval, both dense and graph. We find that no family dominates: each attains at most two of the three criteria, and which one it sacrifices is fixed by its security basis, so the deployable choice is set by the constraint an application can least afford to relax. Even trusted hardware is no exception, since every surveyed scheme ignores the side channels to which it is most exposed. We further surface hidden deployment costs, such as client reliance and a custom serving path, identify private graph-RAG as the least-served setting, and find that no design yet keeps a pipeline confidential from query to answer.