SilentFlow: TEE-Accelerated MPC for Edge

• The paper introduces SilentFlow, which uses TEE-assisted seed synchronization and offloads intensive computations to accelerate non-interactive COT generation, achieving up to 39.51x speedup.
• It decomposes the protocol into secure operations within the TEE and high-volume GGM and LPN computations in the untrusted domain, optimizing execution on low-end FPGAs.
• Hardware optimizations such as kernel fusion, Blocked On-chip eXpansion (BOX), and vectorized batch processing improve memory access and reduce latency in real-time secure inference.

Searching arXiv for the specified paper to ground the article in the cited source. tool call: arxiv_search({"query":"(Li et al., 18 Aug 2025) Silentflow Leveraging Trusted Execution for Resource-Limited MPC via Hardware-Algorithm Co-design","max_results":5,"sort_by":"relevance"}) tool result: { "results": [ { "arxiv_id": "(Li et al., 18 Aug 2025)", "title": "Silentflow: Leveraging Trusted Execution for Resource-Limited MPC via Hardware-Algorithm Co-design", "authors": [ "Anonymous" ], "abstract": "Secure Multi-Party Computation (MPC) offers a practical foundation for privacy-preserving machine learning at the edge, with MPC commonly employed to support nonlinear operations. These MPC protocols fundamentally rely on Oblivious Transfer (OT), particularly Correlated OT (COT), to generate correlated randomness essential for secure computation. Although COT generation is efficient in conventional two-party settings with resource-rich participants, it becomes a critical bottleneck in real-world inference on resource-constrained devices (e.g., IoT sensors and wearables), due to both communication latency and limited computational capacity. To enable real-time secure inference, we introduce Silentflow, a highly efficient Trusted Execution Environment (TEE)-assisted protocol that eliminates communication in COT generation. We tackle the core performance bottleneck-low computational intensity-through structured algorithmic decomposition: kernel fusion for parallelism, Blocked On-chip eXpansion (BOX) to improve memory access patterns, and vectorized batch operations to maximize memory bandwidth utilization. Through design space exploration, we balance end-to-end latency and resource demands, achieving up to 39.51x speedup over state-of-the-art protocols. By offloading COT computations to a Zynq-7000 SoC, SilentFlow accelerates PPMLaaS inference on the ImageNet dataset under resource constraints, achieving a 4.62x and 3.95x speedup over Cryptflow2 and Cheetah, respectively.", "categories": [ "cs.CR", "cs.AR" ], "published": "2025-08-18", "pdf_url": "http://arxiv.org/pdf/([2508.13357](/papers/2508.13357))v1", "abs_url": "https://arxiv.org/abs/([2508.13357](/papers/2508.13357))v1" } ] } SilentFlow is a Trusted Execution Environment (TEE)-assisted protocol for resource-limited secure multi-party computation (MPC) that targets privacy-preserving machine learning at the edge by eliminating communication in correlated oblivious transfer (COT) generation (Li et al., 18 Aug 2025). Its central premise is a hardware-algorithm co-design: TEEs handle seed synchronization and base correlations, while the bulk of GGM tree expansion and LPN extension is pushed into the untrusted domain and accelerated on a Zynq-7000 SoC. In the reported implementation, this design reduces the dominant COT bottleneck under resource constraints, achieving up to 39.51x speedup over state-of-the-art protocols and accelerating PPMLaaS inference on ImageNet workloads relative to CryptFlow2 and Cheetah.

1. Problem setting and motivation

Secure Multi-Party Computation provides a practical foundation for privacy-preserving machine learning at the edge, with MPC commonly employed to support nonlinear operations (Li et al., 18 Aug 2025). Within this setting, oblivious transfer, and in particular correlated OT, is used to generate correlated randomness essential for secure computation. The paper identifies a specific deployment gap: although COT generation is efficient in conventional two-party settings with resource-rich participants, it becomes a critical bottleneck in real-world inference on resource-constrained devices such as IoT sensors and wearables, due to both communication latency and limited computational capacity.

SilentFlow is positioned as a response to that bottleneck. The protocol is designed for real-time secure inference in environments where both the endpoint device and the network are constrained. The abstracted challenge is not only cryptographic correctness, but also the interaction between protocol structure, trust partitioning, memory traffic, and FPGA resource budgets.

A common misconception in this area is that efficient OT in conventional two-party systems directly transfers to edge deployments. SilentFlow directly contradicts that assumption: the problem is not merely asymptotic OT efficiency, but the combined effect of communication latency, low computational intensity, and limited on-device resources. This suggests that edge-oriented MPC optimization must be co-designed across cryptographic protocol structure and hardware execution.

2. System architecture and trust decomposition

SilentFlow splits COT generation into four modules, with some components executed inside the TEE and others outside it (Li et al., 18 Aug 2025). Both client and server run a small TEE, for example Intel SGX, that holds secret keys and randomness and runs all CSPRNG/PRF operations for seed synchronization and base COTs. After a one-time TEE setup, all subsequent COTs are generated locally without any network interaction. The untrusted domains on both sides perform the bulk of the GGM tree expansion and LPN extension, crossing the trust boundary only $O(h)$ times per tree rather than per OT.

Module	Placement	Role
Shared-Seed Generation	in TEE	seed synchronization
Initial Correlation Setup	in TEE	base COT-related setup
Sparse Correlation Constitution	out of TEE	GGM-based sparse correlation work
LPN-Based Local Computation	out of TEE	local extension to final COT correlation

This decomposition is notable because it does not attempt to keep the full COT pipeline inside trusted hardware. Instead, only the secret-bearing components remain in the enclave, while the high-volume computation is externalized. A plausible implication is that SilentFlow treats the TEE not as a general secure coprocessor, but as a narrowly scoped trust anchor for synchronization and secret-state retention.

The trust model is correspondingly explicit. Security for the non-interactive sparse correlation stage relies on PRG (AES) security and one-malicious-party TEE integrity, while the final extension relies on the standard LPN assumption. Communication-free COT generation therefore does not mean trust-free generation: it is conditioned on the enclave integrity assumption and the stated cryptographic assumptions.

3. TEE-assisted COT generation protocol

The protocol begins with shared-seed generation (Li et al., 18 Aug 2025). Each party’s TEE contributes randomness $r_1$ and $r_2$; the shared seed is derived as

$s = r_1 \oplus r_2$

inside SGX and never leaves the enclave. A CSPRNG seeded with $s$ yields identical pseudorandom outputs in both TEEs. This establishes synchronized local randomness without subsequent network interaction.

The second stage is initial correlation setup. Inside each TEE, the protocol samples

$$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$

The receiver’s TEE computes

$w = v \oplus u \cdot \Delta.$

The out-of-TEE exchange is asymmetric: the sender releases $(v,\Delta)$ and the receiver releases $(u,w)$. The stated cost is $O(k)$ symmetric operations, one-time and amortized over many OTs.

The third stage is non-interactive sparse correlation based on GGM. Traditionally, hiding the path requires $r_1$0 1-out-of-2 OTs per tree level. In SilentFlow, the TEEs agree on a path

$r_1$1

only $r_1$2 seeds are kept secret in the enclave, and the remaining $r_1$3 expansions occur in the untrusted domain. Boundary crossings are $r_1$4, because each “green” seed is sent out once. The stated security goal is to hide which leaf corresponds to the nonzero entry in the sparse vector $r_1$5.

The fourth stage is LPN-based local computation. The paper gives the core relation as

$r_1$6

with

$r_1$7

and $r_1$8 a Hamming-weight-$r_1$9 sparse vector. The final COT correlation is

$r_2$0

where

$r_2$1

is public. In protocol terms, the TEE establishes the shared secret state and the initial correlated values, while the untrusted domain executes the high-throughput expansion and extension machinery.

4. Hardware-algorithm co-design

SilentFlow attributes its acceleration to a structured algorithmic decomposition that targets low computational intensity, memory-access inefficiency, and sequential dependencies (Li et al., 18 Aug 2025). The first mechanism is kernel fusion for parallelism. The original latency is expressed as

$r_2$2

After fusion, the LPN stage is decoupled into VM and XOR and overlapped with GGM, producing

$r_2$3

The stated effect is to eliminate the strictly sequential dependency and balance pipeline stages.

The second mechanism is Blocked On-chip eXpansion (BOX). The GGM tree of height $r_2$4 is decomposed into subtrees of depth $r_2$5. For each subtree, the design reads the root seed from global memory using one 128-bit load, expands the entire block of $r_2$6 leaves on-chip, and reuses local RAM for intermediate nodes. The paper compares memory access per tree as follows:

Method	Global loads	Local loads
Naive	$r_2$7	$r_2$8
BOX	$r_2$9	$s = r_1 \oplus r_2$0

The total load cycles are proportional to

$s = r_1 \oplus r_2$1

Since $s = r_1 \oplus r_2$2, BOX reduces off-chip traffic by approximately $s = r_1 \oplus r_2$3.

The third mechanism is vectorized batch operations for VM and XOR reduction. In the LPN VM step, for each of $s = r_1 \oplus r_2$4 columns with weight $s = r_1 \oplus r_2$5, the design computes the XOR of $s = r_1 \oplus r_2$6 entries selected from $s = r_1 \oplus r_2$7 or $s = r_1 \oplus r_2$8. The implementation pipelines three stages: index generation, batched memory loads with 512-bit AXI bursts, and XOR reduction. Two reducer designs are reported. The pipeline-friendly design, Alg#1, uses a single accumulator and avoids per-XOR loads. The parallel tree-reducer, Alg#2, fully unrolls XORs when BRAM permits. The reported gain is $s = r_1 \oplus r_2$9–$s$0 speedup over sequential XOR on the same FPGA resources, and up to $s$1 with abundant BRAM and LUTs.

Taken together, these mechanisms indicate that SilentFlow is not primarily a new cryptographic primitive. Rather, it is a reformulation of COT generation around enclave-constrained synchronization and memory-bound acceleration.

5. Design-space exploration and implementation

The design-space exploration uses two tunable parameters: subtree depth

$s$2

and batch size

$s$3

with objective

$s$4

For small $s$5, such as $s$6, the paper reports that $s$7 balances GGM versus VM latencies with the smallest latency gap (Li et al., 18 Aug 2025). For large $s$8, such as $s$9, $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$0 yields the lowest absolute latency with a modest gap. The final hardware configuration for resource-limited IoT is $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$1, $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$2, using BOX+Alg#1, fitting within 71 BRAM and 1 DSP on Zynq-7000.

The implementation platform is XC7Z045 (Zynq-7000), using Vitis HLS, an AXI4 bus, and 512-bit data width. In the GGM module, the PRG is AES-ECB inside each subtree block, with precomputed round keys and S-boxes in on-chip BRAM. BOX with $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$3 uses 67 BRAM, 0 DSP, and 42 K LUTs, with latency of 73.99 ms for $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$4 expansions.

In the VM module, pipelined XOR using Alg#1 uses 4 BRAM and 1 DSP, with latency of 88.46 ms for $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$5 and $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$6. For end-to-end COT generation, the combined latency is 96.54 ms versus Ferret’s 985.8 ms, corresponding to 10.21x speedup and fitting within $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$7 KB local RAM. With Alg#2 and more BRAM, the latency is 83.67 ms, corresponding to 11.78x speedup; the paper also reports up to 53.29x for VM alone.

These implementation details matter because the design target is explicitly a low-end FPGA rather than a high-capacity accelerator. A plausible implication is that the reported gains depend not only on protocol non-interactivity, but also on disciplined on-chip memory use under a strict BRAM budget.

6. Performance, applications, and boundary conditions

For COT generation at the scale of $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$8 OTs, SilentFlow is fully non-interactive and therefore unaffected by network latency, including LAN, WAN, and mobile settings (Li et al., 18 Aug 2025). The reported speedups over state-of-the-art protocols range from 5.14x in LAN to 39.51x in mobile WAN. This is consistent with the architectural claim that, after setup, all subsequent COTs are generated locally without network interaction.

For end-to-end secure inference on ImageNet with ResNet-50, the evaluation uses CryptFlow2 (IKNP) and Cheetah (Ferret) as baselines under a 100 Mbps/80 ms link. SilentFlow FPGA-assisted inference is reported as 60 s, corresponding to 4.62x speedup versus CryptFlow2 and 3.95x versus Cheetah. For SqueezeNet, the reported end-to-end latency is 152 s, corresponding to 4.75x speedup over prior frameworks.

The paper’s summary states that SilentFlow’s co-design reduces COT generation to approximately 100 ms on a low-end FPGA and cuts ResNet-50 secure inference to 1 min on mobile links, making real-time PPML at the edge practical. That conclusion should be read alongside the stated assumptions: the system depends on TEE-protected secret state, one-time TEE setup, PRG (AES) security, and the standard LPN assumption. Communication-free COT generation in this context means that the online generation phase has no network interaction; it does not eliminate enclave trust, setup work, or the need for public matrix data such as $$u \in \mathbf{F}_2^k,\quad v \in \mathbf{F}_2^k,\quad \Delta \in \mathbf{F}_2^k.$$9.

In the broader MPC and PPML literature, SilentFlow is most precisely understood as a specialized edge-oriented design point: TEE-assisted, non-interactive after setup, and optimized for memory-bound FPGA execution under resource constraints. This suggests that its main significance lies in showing that the practical bottleneck in edge MPC can be shifted from online communication to local hardware throughput when protocol structure and accelerator design are co-optimized.