SecretVoice1.0: Non-interactive Secure Transformer Inference

Privacy-preserving inference for Transformer models is a critical requirement for deploying Large Language Models (LLMs) in sensitive domains such as healthcare and finance. Fully Homomorphic Encryption (FHE) provides a promising non-interactive solution; however, existing FHE-based protocols suffer from substantial latency caused by costly bootstrapping operations, and are mostly constrained to Encoder-only architectures—they lack the Key-Value (KV) cache optimizations critical to generative models. To mitigate these bottlenecks, we propose SecretVoice—a non-interactive privacy-preserving scheme designed with a dense CKKS plaintext packing strategy and a customized ciphertext Transformer inference algorithm. Our framework features two key technical innovations: (1) an optimized bootstrapping scheme that fuses inference-related linear transformations directly into the bootstrapping procedure and enables batched bootstrapping for multiple sparse ciphertexts; and enables batched bootstrapping for multiple sparse ciphertexts; (2) a ciphertext KV-cache implementation that is compatible with our packing strategy, enabling efficient autoregressive decoding for generative models. We evaluate SecretVoice on a Transformer architecture with an input sequence length of 32 tokens, and experimental results on standard Transformer blocks show that SecretVoice achieves an inference speedup of approximately 10× compared to the MOAI scheme while reducing 99% of ciphertext storage requirements, thereby improving the feasibility of privacy-preserving generative tasks.