A Appendix

Same as other neural networks, Transformer-based models use floating-point arithmetic, however cryptographic protocols operate on integers. As shown in Section 4.1, the matrix multiplication Note that this is quite fast due to the small search range. As shown in Section 3.1 of [ The correctness of Theorem A.2 is directly derived from Theorem 4.1. Our security proof follows the simulation paradigm defined in Section A.1.2. In our setting, m is always less than N .