The applications of Generative Artificial Intelligence (GenAI) and their intersections with data-driven fields, such as healthcare, finance, transportation, and information security, have led to significant improvements in service efficiency and low latency. However, this synergy raises serious concerns regarding the security of large language models (LLMs) and their potential impact on the privacy of companies and users' data. Many technology companies that incorporate LLMs in their services with a certain level of command and control bear a risk of data exposure and secret divulgence caused by insecure LLM pipelines, making them vulnerable to multiple attacks such as data poisoning, prompt injection, and model theft. Although several security techniques (input/output sanitization, decentralized learning, access control management, and encryption) were implemented to reduce this risk, there is still an imminent risk of quantum computing attacks, which are expected to break existing encryption algorithms, hence, retrieving secret keys, encrypted sensitive data, and decrypting encrypted models. In this extensive work, we integrate the Post-Quantum Cryptography (PQC) based Lattice-based Homomorphic Encryption (HE) main functions in the LLM's inference pipeline to secure some of its layers against data privacy attacks. We modify the inference pipeline of the transformer architecture for the LLAMA-3 model while injecting the main homomorphic encryption operations provided by the concrete-ml library. We demonstrate high text generation accuracies (up to 98%) with reasonable latencies (237 ms) on an i9 CPU, reaching up to 80 tokens per second, which proves the feasibility and validity of our work while running a FHE-secured LLAMA-3 inference model. Further experiments and analysis are discussed to justify models' text generation latencies and behaviours.
Figures & tables
Figure 1: The Llama-3 main architecture
Figure 2: An abstract view of the developed QLlamaSingleHeadAttention implementing the main QLlamaAttention that overrides the original Llama-3 self-Attention layers. The figure shows a single homomorphically encrypted grouped multi-query attention head
Figure 3: An abstract view of the developed QLlama3MultiHeadsAttention implementing the main QLlamaAttention that overrides the original Llama-3 self-Attention layers. The figure shows a a multi-head homomorphically encrypted grouped multi-query attention heads. It is the result of concatenating multiple encrypted single attention heads.
Figure 4: Class hierarchy of the proposed FHE-enabled QLLaMA-3 models. Encrypted attention modules inherit from the original LLaMA-3 architecture while selectively replacing attention heads with quantized and FHE-compatible counterparts. The classes in darker grey represents the main executable model variants of PQC-LLAMA-3 .
Figure 5: Programmable Bootstrapping Evaluation Circuit formed of univariate and linear functions. It reduces noise per function (Evaluation + Bootstrapping)
Figure 6: An overview of the PQC-LLaMA-3 model for inference. It processes the input until the first layer locally, then sends it to the server side to homomorphically evaluate the attention mechanism. The evaluation result is sent back to the local machine to continue the inference process. This is a model describing an efficient use case of our model within a client-server model where the server has powerful hardware to run the expensive homomorphic operations on the attention mechanism.
Table 1: Hardware Specifications of both machines, running on an Ubuntu 22.04.4 LTS operating system.
Top-k
Trial
Accuracy
( M1 )
( M2 )
( M3 )
Compile Time (s) ( M1 / M2 / M3 )
1
Simulate
47.2
0.472
0.264
0.239
8.02 / 4.420 / 3.497
Execute
0.572
0.266
0.237
8.02 / 4.455 / 3.471
2
Simulate
61.0
0.490
0.261
0.241
8.01 / 4.412 / 3.574
Execute
0.474
0.261
0.241
7.60 / 4.342 / 3.565
3
Simulate
67.4
0.526
0.262
0.241
7.9 / 4.427 / 3.627
Execute
0.588
0.262
0.24
8.02 / 4.328 / 3.572
Table 2: Generation Accuracy (%) / Inference Time (s) for n_bits=2 integer quantization on Three Machines for the SingleHeadQLlamaModel running in two modes ( simulate/execute ).
Top-k
Trial
Accuracy
( M1 )
( M2 )
( M3 )
Compile Time (s) ( M1 / M2 / M3 )
1
Simulate
51.6
1.575
0.909
0.835
26.190 / 14.882 / 12.286
Execute
1.558
0.902
1.055
26.369 / 14.667 / 12.254
2
Simulate
66.4
1.625
0.893
0.948
26.138 / 14.868 / 12.737
Execute
1.618
0.886
1.142
26.295 / 14.592 / 12.391
3
Simulate
72.9
1.542
0.929
0.942
26.083 / 15.040 / 12.780
Execute
1.640
0.899
1.239
26.295 / 14.673 / 12.785
Table 3: Generation Accuracy (%) / Inference Time (s) for n_bits=2 integer quantization on Three Machines for the MultiHeadsQLlamaModel running in two modes ( simulate/execute ).
Top-k
Accuracy
M1
M2
M3
70
91.3 / 94.7
0.556 / 1.553
0.256 / 1.478
0.233 / 0.790
80
91.7 / 94.8
0.501 / 1.545
0.258 / 1.403
0.237 / 0.879
90
92.1 / 94.9
0.508 / 1.547
0.256 / 1.433
0.235 / 0.969
100
92.3 / 95.1
0.482 / 1.591
0.257 / 1.260
0.235 / 0.938
110
92.4 / 95.1
0.478 / 1.643
0.257 / 1.154
0.237 / 0.841
120
92.8 / 95.3
0.464 / 1.646
0.261 / 1.248
0.234 / 0.926
Table 4: Generation Accuracy (%) / Inference Time (s) for n_bits=2 quantization on Three Machines for SingleHeadQLlamaModel / MultiHeadsQLlamaModel models running in the FHE mode ( execute ).
M1
M3
Model
Throughput
PBS/token
Mem/token
Throughput
PBS/token
Mem/token
Single
355.30
60.51
18952.67
77.26
137.62
2019.96
Multi
16.67
9604.25
597.46
8.91
13067.62
1119.11
Table 5: Encrypted inference efficiency metrics for single-head and multi-head PQC-LLaMA-3 models on machine M3 given as averages across multiple top-k values for each PQC-LLaMA-3 model. We refer to SingleHeadQLlamaModel as Single and MultiHeadsQLlamaModel as Multi
Attack
FHE-protected
Explanation
Prompt / context leakage
Yes
If intermediate states and context remain encrypted and never decrypted, server-side leakage is prevented. Leakage can still occur via decrypted outputs or side channels.
Output reconstruction (decryption guessing)
Yes
Properly configured FHE ciphertexts do not reveal plaintext, but implementation errors, malleability, or metadata/timing side channels can leak information.
Gradient leakage (reconstruction)
Conditionally Yes
FHE protects gradients/activations in-flight (ciphertexts). If gradients or aggregated updates are revealed in plaintext, or if protocol steps require decryption, leakage remains possible. Hybrid/training protocols may introduce leakage points.
Data poisoning
Partial
Encryption does not prevent an authorized adversary from submitting poisoned data; while obscuring inputs can hinder targeted poisoning, hardening the attempts to poison data and complicates dataset auditing, however, validating inputs and queries submission authentication is required to achieve a better security.
Side-channel attacks (timing, cache, EM)
No
FHE does not inherently remove physical side-channels. Constant-time implementations, hardware isolation (TEEs), and side-channel hardening remain necessary.
Model extraction (stealing)
No
FHE hides internals from an entity that only observes ciphertexts, but black-box extraction via plaintext query outputs is still possible unless outputs are restricted (DP, clipping, rate limits).
Table 6: Assessment of FHE protections for common attacks in LLM deployment.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 7: Performance comparison of the PQC-LLaMA-3 and the plain LLaMA-3 models across multiple machines and configurations. Subfigures 7(a) and 7(b) show inference time comparisons on different machines, while [ 7(c) , 7(d) ] and [ 7(e) , 7(f) ] pairs present the averaged performance metrics [ inference times , tokens per second ] across models.
Figure 8: The cache memory’s miss rate for both encrypted SingleHeadQLlamaModel and MultiHeadsQLlamaModel models. The experiments incorporated top- k values varying from short context to a long context text generation.
Figure 9: The cache memory’s miss rate for the plain unencrypted LLaMA-3 model. The experiments incorporated top- k values varying from short context to a long context text generation.
Key Lab of High Confidence Software Technologies (Peking University), Ministry of Education, China · School of Computer Science, Peking University, Beijing, China · Tencent, Shenzhen, China +1