Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposed MPCFORMER to enable fast inference under the privacy constraint of mutlit-party computation for transformer based models. Some speed-up is achieved as a result of the relaxation of the proposed method in the experiments. 
strength_and_weaknesses: Strength:

+ This paper proposes an interesting question for privacy-preserve inference of transformer models.


Weaknesses:

- This is a lack of theoretical analysis on the relaxation of the computation. 

- The performance breakdown is unclear without concrete Flops analysis under the original computation of transformers and the computation of the MPC setting.  

clarity,_quality,_novelty_and_reproducibility: Some of the technique details are not clearly, for example, in Figure 1, what is the communication volume of each step and the computation load on the two sides. In Figure 2, the run-time breakdown is interweaving, clearly the excution is not proportional to the FLOP operation of each step in the original transformer computation, where at least more than 90\% of computation is for MatMul, why does the breakdown look so different under MPC? What is the communication paradigm and overhead introduced by MPC? Without these details, it is hard to understand this results. 

There is a lack of theoretical analysis of the approximating GeLU and softmax, essentially, is there any guarantee for these relaxations? Or is this just based on some empirical observation?  

The source code is attached to provide good Reproducibility.
summary_of_the_review: This paper proposes an interesting problem about privacy preserving inference of transformer based models, however, the technique section is not clearly stated and there is a lack of theoretical analysis of the approximation of the computation.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper proposes MPCFormer, a novel two-stage approach for private transformer inference with MPC. The first stage replaces bottleneck functions in the pre-trained transformer (ie, functions with high computational/communication complexity under MPC), with MPC-friendly approximations. The second stage uses knowledge distillation to map the outputs of multiple layers of the MPC-friendly model to those of the original transformer. Additionally, a novel MPC-friendly Softmax approximation, dubbed "2Quad" is proposed, which provides a significant speed advantage compared to the existing "2Relu" Softmax approximation. Experimental evaluations on a range of language tasks with a range of transformer architectures validate the efficacy of the proposed approach relative to existing methods, both in terms of speed and performance. 
strength_and_weaknesses: # Strengths

* The proposed approach is highly practical, as it can be easily adapted to fit a range of transformer architectures and tasks. 

* The paper is the first to tackle private transformer inference with MPC. 

* A novel MPC-friendly Softmax approximation, dubbed "2Quad" is proposed, which provides a significant speed advantage compared to the existing "2Relu" Softmax approximation.

* Through evaluation and strong results. Experimental evaluations across a range of language tasks and a range of transformer architectures validate the efficacy of the proposed approach relative to existing methods, both in terms of speed and performance. Ablation study demonstrates the importance of the proposed knowledge distillation step, model initialization protocol, and Softmax approximation.

# Weaknesses

* Limited algorithmic and theoretical contributions.


clarity,_quality,_novelty_and_reproducibility: **Clarity.** The writing, figures, and tables are exceptionally clear. 

**Quality.** Good. The paper appears to be technically sound and evaluations are thorough.

**Novelty.** This is a systems paper. Algorithmic and theoretical contributions are limited.

**Reproducibility.** Key details are comprehensively described such that competent researchers will be able to easily reproduce the main results.
summary_of_the_review: Strong systems paper with limited algorithmic/theoretical novelty.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper provides a procedure for building better surrogate networks for transformer models fine-tuned to a specific downstream task that allows for faster MPC for private sharing with clients while preserving the model's performance (defined by model accuracy). To build a better surrogate, the authors propose a two-stage pipeline, $\text{MPCFORMER}$: 1) Replace bottleneck layers (GeLU, Softmax) in the transformer model with their faster MPC-friendly counterparts (Quad, 2Quad) to form an intermediate model $\mathcal{S}'$ 2) Retrain $\mathcal{S}'$ on the downstream dataset using Knowledge Distillation from the original transformer model. Finally, the authors provide experimental evidence to show the procedure's benefit for various Bert-based transformer models.
strength_and_weaknesses: Strengths
- Strong empirical performance in terms of accuracy of the final model. For most of the models trained by $\text{MPCFORMER}$, the downstream accuracy is close to the accuracy of the original model. $\textbf{Question:}$ Under this model, would it be possible to have a continual training framework where the model provider could continue the distillation procedure on the partial computations of the teacher model vs. those of the distilled model for randomly chosen client inputs?
- The current models provide a 2x speed up while using a student model of the same size as the teacher. Smaller student models could give even better speedups.
- This is a very general framework that would support various approximations that might be used in the future.

Weakness
- As the activation functions are quadratic, it is possible for the local Lipschitz constants to increase, which would decrease robustness. Current performance measures do not consider other aspects of the model. It would be better to have a more holistic view of model performance for the comparisons.
clarity,_quality,_novelty_and_reproducibility: The idea of using Knowledge distillation to retrain an MPC-friendly surrogate model for the transformer is novel and interesting, and the paper does an excellent job of motivating and presenting it. The authors also provide enough details to reproduce the findings. They also highlight the current work's limitations and offer research directions for future work.
summary_of_the_review: The paper addresses an important issue of improving the computation time of MPC for transformer models while preserving the model's performance. To this end, the authors propose a simple and elegant framework that they show to be useful in practice. I think this paper would be of great interest to the ML community.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper presents a method to transfer a transformer model to a slightly different one that is cheaper to compute in multi-party computation.

strength_and_weaknesses: The paper works out very well how the different parts of their approach contribute to their solution. I'm not aware of these techniques being used in the context of MPC optimization before. I'm positive about the achieved speedups with only a minor loss in accuracy.

clarity,_quality,_novelty_and_reproducibility: The paper is largely written well.

Section 2.2 mentions comparison as an MPC primitive. What is the source of this? My understanding is that comparisons have to be reduced to more primitive operations.

There are a number of space errors: missing space before opening bracket (page 4 twice, pages 5 and 7 once) and unnecessary space before all footnote markers.

I don't think putting quotes around established concepts such as secret sharing and encryption is justified (Figure 1).

The paper should clarify that CrypTen uses two parties plus a helper party because it makes the figures incomparable to pure two-party computation.

summary_of_the_review: Interesting technique applied to multi-party computation
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper studies how to speed up private Transformer inference under the multi-party computation (MPC) setting. It proposes a two-stage approach, replaces bottleneck functions in the original model with MPC-friendly approximations in the first stage, and run knowledge distillation to improve the approximation to the orignal network in the second stage. It introduces "2Quad" operator to approximate the communication-expensive softmax operator.

Strengths:
- It's a simple and practical method that can be applied to various Transformer models and easy to be adopted.
- Experiments on multiple Transformer architectures and benchmarks show good speed up with only a slight drop in accuracy.
- Authors provide additional experiments to compare the proposed layer-wise knowledge distillation with logit-based KD in prior work during reviewing discussion. It would be nice to include the results in the final revision.

Weaknesses:
- Lack of theoretical analysis on the approximation or save of computation time. As commented by a reviewer, this paper is more of a system paper and it focuses on the system-level pattern. Nonetheless, quantifying the effect of approximation error for large-scale transformer model is difficult given existing theoretical analysis tools. Therefore, this weakness should not be held as a critical weakness against acceptance.

justification_for_why_not_higher_score: As commented by the multiple reviewers, the property of the introduced approximation is not thoroughly analysed theoretically. The introduced MPC-friendly approximation has moderate novelty.
justification_for_why_not_lower_score: The proposed method for private inference under MPC has a general and practical value. Experiments show good accuracy and speed improvement compared to the original model and prior works.
Decision: Accept: notable-top-25%