arXiv Science⌕ Search

arXiv subjects

Qizhi Zhang

Publications and source records attributed to Qizhi Zhang.

16 recordsLinked to original sources
arXiv2026

From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents

Autonomous LLM agents can turn untrusted content into effectful actions such as payments and permission changes. If the same process interprets this content and controls a reusable signing credential, prompt injection can cross the judgment boundary and reach execution authority. We present KITA, a review-to-authorization architecture that keeps the user's personal secret signing key and every threshold signing-key share outside all LLM processes. Under threshold signature unforgeability and our system assumptions, compromising the proposer and fewer than t reviewer-signer domains cannot produce a valid authorization for a new action without signing contributions from t distinct domains. Thus, any such authorization includes a share from an uncompromised domain, bound to the canonical action and released only after authenticated reviewer approval. This establishes execution-bound authorization integrity. We implement the complete reviewer-to-executor path with a structured-output LLM adapter and threshold BLS. Six system tests validate quorum gating and message binding at this interface, while cryptographic microbenchmarks measure the online signing path and its scaling behavior.

cs.CR↗
arXiv2026

Towards Privacy-Preserving LLM Inference via Covariant Obfuscation (Technical Report)

The rapid development of large language models (LLMs) has driven the widespread adoption of cloud-based LLM inference services, while also bringing prominent privacy risks associated with the transmission and processing of private data in remote inference. For privacy-preserving LLM inference technologies to be practically applied in industrial scenarios, three core requirements must be satisfied simultaneously: (1) Accuracy and efficiency losses should be minimized to mitigate degradation in service experience. (2) The inference process can be run on large-scale clusters consist of heterogeneous legacy xPUs. (3) Compatibility with existing LLM infrastructures should be ensured to reuse their engineering optimizations. To the best of our knowledge, none of the existing privacy-preserving LLM inference methods satisfy all the above constraints while delivering meaningful privacy guarantees. In this paper, we propose AloePri, the first privacy-preserving LLM inference method for industrial applications. AloePri protects both the input and output data by covariant obfuscation, which jointly transforms data and model parameters to achieve better accuracy and privacy. We carefully design the transformation for each model component to ensure inference accuracy and data privacy while keeping full compatibility with existing infrastructures of Language Model as a Service. AloePri has been integrated into an industrial system for the evaluation of mainstream LLMs. The evaluation on Deepseek-V3.1-Terminus model (671B parameters) demonstrates that AloePri causes accuracy loss of 0.0%~3.5% and exhibits efficiency equivalent to that of plaintext inference. Meanwhile, AloePri successfully resists state-of-the-art attacks, with less than 5\% of tokens recovered. To the best of our knowledge, AloePri is the first method to exhibit practical applicability to large-scale models in real-world systems.

cs.CR↗
arXiv2025

Equidistribution of holomorphic cusp forms on thin sets

We find some equidistribution results connected to restriction quantum unique ergodicity problem in this paper. We shows that \begin{align*} \frac{1}{|\mathcal{B}_k|}\sum_{f\in \mathcal{B}_k} \int_{R}y^{k}|f(z)|^{2}\psi(z) d\mu_{R}(z)\to \frac{3}{\pi}\int_{R}\psi(z) d\mu_{R}(z) \end{align*} where $R$ is some subset of $\mathbb{H}$, $\psi$ is a nice function relative to $R$, $d\mu_{R}(z)$ is a suitable measure on $R$, and $\mathcal{B}_k$ is an orthonormal basis of the cusp forms for group $\Gamma$ with respect to weight $k$.

math.NT↗
arXiv2025

VIRGOS: Secure Graph Convolutional Network on Vertically Split Data from Sparse Matrix Decomposition

Securely computing graph convolutional networks (GCNs) is critical for applying their analytical capabilities to privacy-sensitive data like social/credit networks. Multiplying a sparse yet large adjacency matrix of a graph in GCN--a core operation in training/inference--poses a performance bottleneck in secure GCNs. Consider a GCN with $|V|$ nodes and $|E|$ edges; it incurs a large $O(|V|^2)$ communication overhead. Modeling bipartite graphs and leveraging the monotonicity of non-zero entry locations, we propose a co-design harmonizing secure multi-party computation (MPC) with matrix sparsity. Our sparse matrix decomposition transforms an arbitrary sparse matrix into a product of structured matrices. Specialized MPC protocols for oblivious permutation and selection multiplication are then tailored, enabling our secure sparse matrix multiplication ($(SM)^2$) protocol, optimized for secure multiplication of these structured matrices. Together, these techniques take $O(|E|)$ communication in constant rounds. Supported by $(SM)^2$, we present Virgos, a secure 2-party framework that is communication-efficient and memory-friendly on standard vertically-partitioned graph datasets. Performance of Virgos has been empirically validated across diverse network conditions.

cs.CR↗
arXiv2024

Mass Distribution for holomorphic cusp forms on the vertical geodesic

We compute the quantum variance of holomorphic cusp forms on the vertical geodesic for smooth compactly supported test functions. As an application we show that almost all holomorphic Hecke cusp forms, whose weights are in a short interval, satisfy QUE conjecture on the vertical geodesic.

math.NT↗
arXiv2021

Morse-STF: Improved Protocols for Privacy-Preserving Machine Learning

Secure multi-party computation enables multiple mutually distrusting parties to perform computations on data without revealing the data itself, and has become one of the core technologies behind privacy-preserving machine learning. In this work, we present several improved privacy-preserving protocols for both linear and non-linear layers in machine learning. For linear layers, we present an extended beaver triple protocol for bilinear maps that significantly reduces communication of convolution layer. For non-linear layers, we introduce novel protocols for computing the sigmoid and softmax function. Both functions are essential building blocks for machine learning training of classification tasks. Our protocols are both more scalable and robust than prior constructions, and improves runtime performance by 3-17x. Finally, we introduce Morse-STF, an end-to-end privacy-preserving system for machine learning training that leverages all these improved protocols. Our system achieves a 1.8x speedup on logistic regression and 3.9-4.9x speedup on convolutional neural networks compared to prior state-of-the-art systems.

cs.CR↗
arXiv2020

MPC Protocol for G-module and its Application in Secure Compare and ReLU

Secure comparison and secure selection are two fundamental MPC (secure Multi-Party Computation) protocols. One important application of these protocols is the secure ReLU and DReLU computation in privacy preserving deep learning. In this paper, we introduce G-module, a mathematics tool, to re-design such protocols. In mathematics, given a group G, a G-module is an abelian group M on which G acts compatibly with the abelian group structure on M. We design three secure protocols for three G-module operations. i.e. "G-module action", "Cross G-module action" and "G-module recover". As far as we know, this is the first work on secure G-module operations. Based on them, we design secure comparison, selection, ReLU and DReLU protocols, which improve communication efficiency by 2X to 10X compared with state of arts. Our protocols are very computation efficient too. They do not require public key operations or any other expensive operations.

cs.CR↗
arXiv2019

Matrix embedding method in match for session-based recommendation

Session based model is widely used in recommend system. It use the user click sequence as input of a Recurrent Neural Network (RNN), and get the output of the RNN network as the vector embedding of the session, and use the inner product of the vector embedding of session and the vector embedding of the next item as the score that is the metric of the interest to the next item. This method can be used for the "match" stage for the recommendation system whose item number is very big by using some index method like KD-Tree or Ball-Tree and etc.. But this method repudiate the variousness of the interest of user in a session. We generated the model to modify the vector embedding of session to a symmetric matrix embedding, that is equivalent to a quadratic form on the vector space of items. The score is builded as the value of the vector embedding of next item under the quadratic form. The eigenvectors of the symmetric matrix embedding corresponding to the positive eigenvalues are conjectured to represent the interests of user in the session. This method can be used for the "match" stage also. The experiments show that this method is better than the method of vector embedding.

cs.LG↗
arXiv2018

Large scale classification in deep neural network with Label Mapping

In recent years, deep neural network is widely used in machine learning. The multi-class classification problem is a class of important problem in machine learning. However, in order to solve those types of multi-class classification problems effectively, the required network size should have hyper-linear growth with respect to the number of classes. Therefore, it is infeasible to solve the multi-class classification problem using deep neural network when the number of classes are huge. This paper presents a method, so called Label Mapping (LM), to solve this problem by decomposing the original classification problem to several smaller sub-problems which are solvable theoretically. Our method is an ensemble method like error-correcting output codes (ECOC), but it allows base learners to be multi-class classifiers with different number of class labels. We propose two design principles for LM, one is to maximize the number of base classifier which can separate two different classes, and the other is to keep all base learners to be independent as possible in order to reduce the redundant information. Based on these principles, two different LM algorithms are derived using number theory and information theory. Since each base learner can be trained independently, it is easy to scale our method into a large scale training system. Experiments show that our proposed method outperforms the standard one-hot encoding and ECOC significantly in terms of accuracy and model complexity.

cs.LG↗
arXiv2018

Category coding with neural network application

In many applications of neural network, it is common to introduce huge amounts of input categorical features, as well as output labels. However, since the required network size should have rapid growth with respect to the dimensions of input and output space, there exists huge cost in both computation and memory resources. In this paper, we present a novel method called category coding (CC), where the design philosophy follows the principle of minimal collision to reduce the input and output dimension effectively. In addition, we introduce three types of category coding based on different Euclidean domains. Experimental results show that all three proposed methods outperform the existing state-of-the-art coding methods, such as standard cut-off and error-correct output coding (ECOC) methods.

cs.IT↗
arXiv2014

On the hopping pattern design for D2D discovery with invariant

In this paper, we focus on the hopping pattern design for device-to-device (D2D) discovery. The requirements of hopping pattern is discussed, where the impact of specific system constraints, e.g., frequency hopping, is also taken into consideration. Specifically speaking, we discover and utilize the novel feature of resource hopping, i.e., "hopping invariant" to design four new hopping patterns and analyze their performance. The hopping invariant can be used to deliver information for specific users without extra radio resources, and due to the connection between hopping invariant and resource location, receiver complexity can be significantly reduced. Furthermore, our schemes are designed to be independent of discovery frame number, which makes them more suitable to be implemented in practical systems.

cs.IT↗
arXiv2014

A class of hopping patterns with minimal collisions

In \cite{VTC} three metrics for hopping pattern performance evaluation is proposed: column period, maximal collision ratio, maximal continual collision number, a lower bound of maximal continual collision number is given also. In this paper we give a lower bound of maximal collision ratio, a class of hopping pattern whose both maximal collision ratio and maximal continual collision number fit the lower bounds is constructed also.

cs.IT↗
arXiv2014

On the hopping pattern design for D2D Discovery

The hopping pattern for D2D Discovery are investi- gated. We propose three metrics for hopping pattern performance evaluation: column period, maximal collision ratio, maximal con- tinual collision number. A class of hopping patterns is constructed based on the metrics, and through simulation the patterns show better discovery performance.

cs.NI↗
arXiv2011

An Improvement to the Number Field Sieve

We improve the "sieve" part of the number field sieve used in factoring integer and computing discrete logarithm. The runtime of our method is shorter than that of existing methods. Under some reasonable assumptions, we prove that it is less than two-thirds of the running time of the algorithm used before asymptotically with probability gr

math.NT↗
arXiv2011

On the ramification of non-abelian Galois coverings of degree $p^3$

The refined Swan conductor is defined by K.\ Kato \cite{KK2}, and generalized by T.\ Saito \cite{wild}. In this part, we consider some smooth $l$-adic \'{e}tale sheaves of rank $p$ such that we can be define the $rsw$ following T.\ Saito, on some smooth dense open subscheme $U$ of a smooth separated scheme X of finite type over a perfect fields $\kappa$ of characteristic $p>0$. We give an explicit expression of $rsw(\mathcal{F})$ in some situation. As a consequence, we show that it is integral.

math.NT↗