Multi-party Computation (MPC)

• MPC is a cryptographic technique that enables multiple parties to jointly compute a function over private inputs while guaranteeing strict privacy.
• It employs methods such as secret sharing, oblivious transfer, and garbled circuits to ensure security against both passive and active adversaries.
• Advanced protocols leverage scalable architectures, high-level DSLs, and hybrid frameworks for secure, efficient data analytics and decentralized applications.

Secure Multi-Party Computation (MPC) is a family of cryptographic techniques enabling a group of mutually distrustful parties to jointly compute a specified function over their private inputs, while guaranteeing that nothing is revealed except the intended outputs. MPC achieves input, output, and process privacy in the presence of passive (honest-but-curious) or active (malicious) adversaries; tolerates a bounded number or fraction of corrupted parties; and is foundational for privacy-preserving data analytics, decentralized finance, collaborative machine learning, and secure outsourcing.

1. Fundamental Protocols and Adversarial Models

The central paradigm in MPC is the simulation-based ideal/real world model. Formally, $n$ parties $P_1,\ldots,P_n$ holding private inputs $(x_1,\ldots,x_n)$ wish to jointly compute $y=f(x_1,\ldots,x_n)$ so that up to $t$ corrupted parties cannot learn anything about honest parties' inputs except what is implied by $y$ (Sedraoui et al., 1 Jan 2026). Security is defined by comparing the real protocol to an ideal functionality $\mathcal{F}_f$. For every adversary in the real world, simulation in the ideal model produces an indistinguishable execution, ensuring privacy and correctness.

MPC is studied in two main adversary models:

• Semi-honest (passive): Corrupted parties follow the protocol but try to learn additional information from observed messages.
• Malicious (active): Corrupted parties may arbitrarily deviate, requiring protocols to ensure correctness (robustness) and prevent privacy breaches. Achieving malicious security typically requires zero-knowledge proofs, verifiable secret sharing, consistency checks, or MACs (Haagh et al., 2018).

Corruption thresholds ($t$) depend on model and protocol:

• Information-theoretic, synchronous: $t < n/3$ (broadcast available); asynchronous reduces threshold (e.g., $t < n/8$); perfect/UC security is possible (Dani et al., 2012).
• Computational security: $P_1,\ldots,P_n$0 is possible using threshold cryptography, under computational assumptions (e.g., DDH, LWE), and in models allowing selective abort (Bartusek et al., 2024).

Core MPC building blocks include:

• Secret Sharing: Additive and Shamir schemes for distributing secrets among $P_1,\ldots,P_n$1 parties, reconstructible only with a threshold subset. Secure linear operations and, via Beaver triples, multiplication (Sedraoui et al., 1 Jan 2026, Haagh et al., 2018).
• Oblivious Transfer: Enabling private selection of inputs; foundational for secure circuit evaluation.
• Garbled Circuits: Efficient 2-party protocols for evaluating Boolean circuits securely, with communication proportional to the gate count, leveraging oblivious transfer for input privacy (Sedraoui et al., 1 Jan 2026).
• Verifiable Secret Sharing and Zero-Knowledge Proofs: Needed for active robustness, ensuring that shares or computation steps are consistent without revealing underlying secrets (Kak, 2015).

2. Protocols for General and Large-Scale Computations

Early MPC protocols were circuit-based and required all computation to be reduced to Boolean or arithmetic circuits. This incurs substantial overhead for complex programs, recursive functions, or big data. Significant advances address these limitations:

• Synchronous and Asynchronous Large-n MPC:
  • Protocols based on quorums (groups of logarithmic size in $P_1,\ldots,P_n$2) allow scalable, UC-secure MPC for $P_1,\ldots,P_n$3 via sublinear per-party work ($P_1,\ldots,P_n$4 for $P_1,\ldots,P_n$5-gate circuits), tolerating up to $P_1,\ldots,P_n$6 (synchronous) and $P_1,\ldots,P_n$7 (asynchronous), using VSS and small CMPC subprotocols (Dani et al., 2012).
• Circuit-Free and Unlinkable Protocols:
  • MPC protocols that avoid circuitization, e.g., via co-utile outsourcing and rational reputation, can evaluate obfuscated code with arbitrary loops and recursion without circuit conversion (Domingo-Ferrer et al., 2021). These systems rely on anonymous channels, decentralized reputation for self-enforcement, and unlinkability, rather than cryptographic simulation.
• Metaprogramming and High-Level DSLs:
  • High-level languages and toolchains (e.g., HACCLE's Harpoon and IR/HIR (Bao et al., 2020), Symphony (Sweet et al., 2023)) abstract the details of cryptographic primitives, allowing developers to write MPC code as staged programs, with automated compilation, optimization, and backend selection. They support circuit generation for several backends and facilitate correct-by-construction MPC application development.
• Big Data and Hybrid MPC Protocols:
  • MPC frameworks such as Conclave (Volgushev et al., 2019) partition queries or analytics pipelines: pre- and post-process cleartext operations outside MPC, identify minimal subqueries requiring cryptographic protection, and further accelerate via hybrid protocols that selectively reveal certain key columns. These strategies enable scalable, privacy-preserving analytics on hundreds of millions to billions of records—a scale infeasible for pure-MPC approaches.

3. Communication, Computation, and Scalability

Communication, computation, and system-level scalability are central to the practicality of MPC (Sedraoui et al., 1 Jan 2026, Ni et al., 2020, Bartusek et al., 2024):

• Complexity per primitive: For additive secret sharing, local addition is free, multiplication via Beaver triples requires 1 round and $P_1,\ldots,P_n$8 communication per multiplication; garbled circuits require $P_1,\ldots,P_n$9 communication for a circuit of $(x_1,\ldots,x_n)$0 gates, with 2 rounds per evaluation (Sedraoui et al., 1 Jan 2026).
• Heterogeneous systems: In systems with varying compute or network resources, naive symmetric workload allocation (each party does the same number of gates) leads to bottlenecks and high stall time: faster nodes spend considerable time waiting for slower nodes, drastically reducing throughput (Ni et al., 2020). Adaptive workload partitioning, pipelining, and network-aware scheduling mitigate these effects.
• Communication-optimal protocols: Committee-based delegation, random committees, and threshold FHE enable near-optimal total communication ($(x_1,\ldots,x_n)$1, $(x_1,\ldots,x_n)$2 number of honest parties) with matching lower bounds—i.e., it is information-theoretically necessary for each honest party to communicate with at least $(x_1,\ldots,x_n)$3 other parties. The communication-locality Pareto front is formalized in (Bartusek et al., 2024).
• Pipelined computation: Protocols such as MPC-Pipe (Wang et al., 2022) overlap computation and communication at the protocol and systems level for both linear and non-linear ML operators, approaching the lower bound where the total wall time for a batch is the maximum of computation or communication cost, not their sum.

4. Specialized Protocols and Architectures

MPC research includes a wide range of specialized protocols for domain-specific needs and alternative security models:

• Coded MPC (CMPC): To address system and scaling bottlenecks in large matrix computations or distributed ML, coded-MPC methods combine Shamir/BGW-style MPC with polynomial/coded computation. Polynomial-sharing and adaptive-gap entangled codes minimize the number of workers, computation, and communication for matrix products subject to information-theoretic privacy constraints, outperforming classical or job-splitting BGW designs (Vedadi et al., 2022, Vedadi et al., 2023, Nodehi et al., 2019, Najarkolaei et al., 2020).
• Probabilistic and Verifiable Protocols: Specialized protocols support secure, fair, and verifiable generation of shared random numbers and mapped probability events, building on joint Diffie–Hellman exponentiation, Pedersen commitments, and zero-knowledge proofs (Kak, 2015).