LOW-RANK MASKING FOR SINGLE-SERVER MATRIX MULTIPLICATION Alejandro Cohen1,2 , Rafael G. L. D’Oliveira3 , and Alex Sprintson4 1
arXiv:2609.18876v1 [cs.IT] 16 Sep 2026
2
Faculty of Electrical and Computer Engineering, Technion, Israel Department of Electronic Systems, Aalborg University, Copenhagen Campus, Denmark 3 School of Mathematical and Statistical Sciences, Clemson University, USA 4 Department of Electrical and Computer Engineering, George Mason University, USA ABSTRACT
We study the statistical privacy of outsourcing matrix multiplication over a finite field Fq to a single server using additive masks of rank at most r. For independent uniform n × n inputs, we show that uniform rank-ball masks and products of independent uniform factors give maximal-correlation secrecy of at most q −r against the complete server view, with O(n2 r) field operations for encoding and decoding. This secrecy captures how effectively the server is prevented from estimating functions of the inputs. We prove an asymptotically matching lower bound of this secrecy measure for r = o(n), showing that both sampling methods are asymptotically optimal among input-independent additive masks of rank at most r, even when secret invertible transformations are allowed. We also characterize the posterior distribution for uniform rank-ball masks under arbitrary joint input distributions and prove approximate individual security for rows and columns under independent uniform inputs. Finally, we show that every input-independent additive mask of rank at most r = o(n) requires δ → 1 in entry-level (ε, δ)-differential privacy for fixed field size q and bounded ε. Index Terms— Matrix multiplication, secure outsourcing, distributed computing, individual security. 1. INTRODUCTION We consider a user who has two matrices A ∈ Fm×n and q B ∈ Fn×p and wishes to compute A · B with the assistance q of a single server. The challenge is to limit what the server learns about A and B while keeping the user’s encoding and recovery costs substantially below the cost of computing AB locally. Homomorphic encryption and specialized cryptographic protocols can protect inputs when outsourcing to a single server, but their privacy guarantees rely on computational hardness assumptions [1, 2]. Secure distributed matrix multiplication (SDMM) achieves perfect information-theoretic privacy against computationally unbounded servers, but requires multiple servers and a bound on how many may collude [3]. The privacy guarantees of these SDMM schemes do not hold when a single server receives all the encoded inputs. This motivates the transformation-based outsourcing approach [4–6], in which the user masks the inputs before send-
ing them to the server and recovers the desired product from the returned result. For example, the user can upload P1 AP2−1 and P2 BP3−1 , where P1 , P2 , P3 are secret invertible matrices. The server then returns P1 ABP3−1 . Using permutations and scalings makes encoding and recovery inexpensive. This line of work includes sparse-matrix protocols [7], invertible transformations [8–11], and additive masks [4, 12, 13]. We focus on low-rank additive masking, which has been used for linear systems [14], matrix multiplication [12,15], and secure inference [16]. Blockwise variants use outer-product masks [13]. For n × n inputs, each mask of rank at most r can be written as the product of an n × r matrix and an r × n matrix. Using these factors, the user can encode the inputs and recover their product with O(n2 r) field operations, while the server performs one matrix multiplication. We then ask what statistical privacy these masks can provide. We first consider differential privacy (DP) [17], which limits how much the distribution of the server’s observation can change when one input entry changes. However, Proposition 1 shows that every input-independent mask of rank at most r = o(n) requires δ → 1 in entry-level (ε, δ)-differential privacy when q is fixed and ε is bounded. Thus, we study partial privacy guarantees. We consider two sampling methods: multiplying independent uniform factors and choosing a mask uniformly from all matrices of rank at most r. For each, we describe which inputs remain possible after the server sees the uploads and how likely they are. Each input must lie within rank distance r of its upload (Definition 1). For uniform rank-ball masks, the uploads rule out incompatible input pairs while preserving the relative probabilities of those that remain. Theorem 2 establishes this for arbitrary joint input distributions. For independent uniform matrices, Theorem 3 gives an approximate form of individual security [18] for rows and columns. Our main result concerns maximal-correlation secrecy [19], which quantifies how well the server can estimate functions of the inputs. For independent uniform square inputs, Theorem 4 gives maximal correlation at most q −r against the complete server view for both sampling methods, with equality for independent uniform factors. Theorem 5 gives an asymptotically matching lower bound for every input-independent additive mask of rank at most r, even when combined with secret invertible transformations. Thus, for fixed q and r = o(n), both
sampling methods achieve asymptotically optimal maximalcorrelation secrecy within this class. To our knowledge, this is the first work to establish asymptotically matching achievability and converse bounds for maximal-correlation secrecy of input-independent additive matrix masks under a rank constraint with uniform inputs. 1.1. Related Work Other single-server work considers adjustable security and efficiency [20]. The scheme in [21] combines low-rank factors with additional noise to obtain computational security and allows approximate recovery. The additional noise means that the complete masks need not satisfy the rank constraint studied here. Over the real and complex numbers, analog SDMM studies numerical stability and mutual-information leakage [22], while differentially private distributed multiplication studies privacy–accuracy tradeoffs [23, 24]. In our setting, the user recovers the finite-field product exactly, and we study the uncertainty that remains about the inputs. Individual secrecy protects each message separately while allowing information about relationships between messages. This notion has been studied in secure network coding [18], distributed storage [25], and multi-secret sharing [26]. 2. MAIN RESULTS We study privacy against a computationally unbounded honestbut-curious (semi-honest [9]) server. Correctness assumes that the server follows the prescribed computation; verifiability against malicious computation is outside the scope of this work. Proofs appear in Section 3. 2.1. Low-Rank Masking We consider a user who wishes to multiply A ∈ Fm×n and q B ∈ Fn×p with the help of a single server. The user adds a lowq rank mask to each matrix before sending it to the server. Let 1 ≤ r ≤ min{m, n, p} and R = U V and S = QW , where U ∈ Fm×r , V ∈ Fr×n , Q ∈ Fn×r , and W ∈ Fr×p . The q q q q masks are kept secret and sampled independently of the inputs and of each other, with fresh masks for each multiplication. Algorithm 1 describes the protocol. Algorithm 1 Single-server multiplication with low-rank masks Input: A, B and rank parameter r. Output: AB. 1. Precompute. Sample masks R = U V and S = QW . Store the factors, R, S, and P = RS. 2. Upload. Send X = A + R and Y = B + S. 3. Compute. The server returns Z = XY . 4. Decode. Return Z − (AQ)W − U (V B) − P . Theorem 1. Given the mask factors, Algorithm 1 computes AB using O(mnr + npr + mpr) field operations at the user in the worst case and one matrix multiplication at the server.
Example 1. For n × n inputs, decoding computes AQ, (AQ)W , V B, and U (V B), each using n2 r field multiplications. Decoding therefore requires 4n2 r multiplications, while encoding requires O(n2 ) additions. Precomputing R and S uses 2n2 r multiplications, and computing RS as U ((V Q)W ) uses another n2 r + 2nr2 . Thus, the user’s computation is quadratic in n for constant r and o(n3 ) when r = o(n). 2.2. Privacy within Rank Balls We now ask which inputs remain possible after the server sees an upload and how likely they are. Since X = A + R and rank(R) ≤ r, observing X = x tells the server that rank(x − A) ≤ r. We use the rank distance. Definition 1. The rank distance between a, x ∈ Fd×e is q rank(x − a). The rank ball of radius r centered at x is Ballr (x) = {a ∈ Fd×e : rank(x − a) ≤ r}. q We consider two ways to sample the masks. Low-Rank Ball samples R uniformly from Ballr (0) and keeps a factorization R = U V for decoding. Low-Rank Factors samples all entries of U, V independently and uniformly and sets R = U V . Both methods can produce every mask of rank at most r, but assign different probabilities to them. After observing X = x, the conditional probability of each input a is proportional to Pr[A = a] Pr[R = x − a]. For uniform rank-ball masks, the second factor is the same for every a ∈ Ballr (x), giving the following result. Theorem 2. Let A have any distribution and let R be a LowRank Ball mask independent of A. For every upload x with positive probability, Pr[A = a | X = x] =
Pr[A = a] 1{a ∈ Ballr (x)} . Pr[A ∈ Ballr (x)]
(1)
For A, B with any joint distribution and Low-Rank Ball masks sampled independently of each other and of (A, B), the posterior after uploads x, y of positive joint probability is the joint prior restricted to Ballr (x) × Ballr (y) and normalized. For uniform rank-ball masks, an upload x rules out inputs at rank distance greater than r from x and preserves the relative probabilities of those that remain. If only one of these inputs has positive prior probability, the server can identify it. Two inputs within rank distance r of the same upload can still have different upload distributions, since each produces uploads in a rank ball centered at itself. 2.3. Limits on Differential Privacy We now show that low-rank masking cannot provide useful differential privacy when r = o(n). This limitation comes from the rank bound and holds for every input-independent mask distribution. Definition 2 ( [17] ). Two inputs are neighbors if they differ in exactly one entry. For ε ≥ 0 and δ ∈ [0, 1], the upload X satisfies entry-level (ε, δ)-differential privacy if Pr[X ∈ E | A = a] ≤ eε Pr[X ∈ E | A = a′ ] + δ
for every set of uploads E and every pair of neighboring inputs a, a′ . The case δ = 0 is called pure differential privacy. The following bound holds for every input-independent mask distribution with rank at most r. Proposition 1. Let K ∈ Fn×n be independent of the input, q with rank(K) ≤ r < n almost surely. If A + K satisfies entry-level (ε, δ)-differential privacy, then δ ≥1−
(eε + q − 1) log2 q r . q−1 n
(2)
No such mask gives pure differential privacy for any finite ε. For fixed q and bounded ε, the bound forces δ → 1 when r = o(n). At δ = 1, the privacy condition places no restriction on the upload distribution. Thus, no choice of inputindependent mask distribution can give useful differential privacy in this regime. 2.4. Approximate Individual Security We next ask how much the upload reveals about each row or column separately. We take A to be uniform over Fn×n , let q 1 ≤ r < n, and write X = A + R, where R is independent of A. We regard the rows Mi = Ai,: ∈ Fnq as independent uniform messages. Definition 3 ( [18]). For T ⊆ [n], let MT = (Mi )i∈T . The messages M1 , . . . , Mn satisfy T -individual security with respect to X if MT is independent of X, that is, I(MT ; X) = 0. This protects the rows indexed by T jointly, including relationships among them. We relax independence using total variation, which measures the largest difference between the probabilities that two distributions assign to the same event. We require the joint distribution of MT and X to be close to the distribution they would have if they were independent. Definition 4 ( [27]). For T ⊆ [n] and ε ≥ 0, the messages M1 , . . . , Mn satisfy ε-approximate T -individual security with respectP to X if dTV (PMT ,X , PMT PX ) ≤ ε, where dTV (P, Q) = 12 z |P (z) − Q(z)| is the total variation distance. The case ε = 0 recovers T -individual security. For a fixed set T ⊆ [n], let AT be the matrix formed by the rows indexed by T . The following theorem bounds what the entire upload reveals about these rows jointly. Theorem 3. Fix T ⊆ [n] with |T | ≤ r. For Low-Rank Fac|T |−r tors, dTV (PAT ,X , PAT PX ) ≤ q q−1 . For Low-Rank Ball, |T |−r
dTV (PAT ,X , PAT PX ) ≤ q q−1 + βn,r , where βn,r is the probability that a Low-Rank Ball mask has rank less than r. The same bounds hold when T indexes columns. Thus, both sampling methods provide approximate T individual security for any fixed set T of at most r rows or columns. For fixed q, the error bound for Low-Rank Factors decreases exponentially with r − |T |.
2.5. Maximal-Correlation Secrecy We now ask how much the server can improve its estimates of functions of the inputs. Maximal-correlation secrecy [19] bounds this improvement for all functions, including those that depend on both matrices. Let M denote the data we wish to protect, such as A or the pair (A, B), and let T denote the server’s observation. We compare a function f (M ) of the data with a function g(T ) computed from the observation. Definition 5 ( [19]). For real-valued random variables F, G with positive variance, their correlation is E[F G] − E[F ]E[G] . Corr(F, G) = p Var(F ) Var(G) The maximal correlation ρm (M ; T ) is the supremum of | Corr(f (M ), g(T ))| over real-valued functions f, g for which f (M ) and g(T ) have positive variance. The protocol provides ρ-maximal-correlation secrecy if ρm (M ; T ) ≤ ρ when M is uniform. Maximal correlation is zero exactly when the data and the observation are independent. More generally, a bound ρm (M ; T ) ≤ ρ means that the observation can reduce the mean-square error in estimating any function of M by at most a ρ2 fraction of the error of the best estimate based only on the prior. We next bound maximal correlation for both sampling methods against the complete server view T = (X, Y, Z). Since Z = XY is determined by the uploads, it provides no additional information beyond X, Y . Theorem 4. Let A be uniform over Fn×n and let 1 ≤ r < n. q For either sampling method, with R independent of A, we have ρm (A; A+R) ≤ q −r , with equality for Low-Rank Factors. For independent uniform A, B ∈ Fn×n and independent masks q R, S sampled using the same method and rank parameter r, independently of (A, B), we have ρm ((A, B); T ) = ρm (A; X). The bound limits how much the server can improve its guesses about the inputs. For example, over F2 , a given entry of a uniform matrix A is equally likely to be zero or one. Before seeing the uploads, the server can guess its value correctly with probability 1/2. After seeing the complete view T , this probability is at most 1/2 + 2−r−1 . For r = 10 < n, it is less than 50.05%, even if the server has unlimited computational power. More generally, for any fixed binary function of (A, B), the improvement over the best guess based on the prior is at most q −r /2 [19]. The user can make the server’s improvement over the best prior guess tend to zero as the matrices grow, while keeping encoding and decoding close to quadratic. Fix c > 0, and set r = ⌈c logq n⌉. Then, the maximal correlation is at most n−c with O(n2 log n) field operations for sufficiently large n. We next show that the bound q −r is asymptotically optimal for fixed q and r = o(n). The converse holds for every input-independent additive mask of rank at most r, even when combined with secret invertible transformations. Theorem 5. Let A be uniform over Fn×n and let X = L1 (A+ q K)L2 , where (L1 , L2 , K) is independent of A, L1 , L2 are
invertible, and rank(K) ≤ r ≤ n − 2 almost surely. Then ρm (A; X) ≥
q −r q 2n−r − 2q n + 1 ≥ . (q n − 1)2 2
(3)
The server can ignore additional observations, so any view T containing X satisfies ρm ((A, B); T ) ≥ ρm (A; X). The lower bound therefore also applies to the complete server view. Together with Theorem 4, this shows that both sampling methods are within a factor of two of the optimum for r ≤ n − 2. For fixed q and r = o(n), the lower bound is (1 − o(1))q −r , proving asymptotic optimality within this class. Although Theorem 4 assumes independent uniform inputs, its guessing guarantee extends to nonuniform or correlated inputs. The bound then depends on how concentrated the joint input distribution is. For M = (A, B), define ∆ = 2 P 2 log2 q 2n m Pr[M = m] , which is zero for independent uniform inputs. For either sampling method, the improvement over the best prior guess is at most 2∆/2 q −r for any fixed function of M , and half this for a binary function [19, Thm. 1]. 3. PROOFS Proof of Theorems 1 and 2. Since Z = AB+AS+RB+RS, decoding returns AB. Computing RS = U ((V Q)W ) and using r ≤ min{m, n, p} gives the cost bound. Uniform rankball masks give a constant likelihood on compatible inputs and zero elsewhere, so Bayes’ rule gives both posterior statements. Qt−1 d j )(qe −qj ) Let Cd,e (t) = j=0 (q −qqt −q count rank-t matrices j Pr and put Vd,e (r) = t=0 Cd,e (t). To sample a Low-Rank Ball mask, choose t with probability Cd,e (t)/Vd,e (r), then multiply independent uniform full-rank factors of sizes d × t and t × e. Each rank-t matrix has equally many such factorizations, so the product is uniform. Pad the factors to width r, i.e., inserting zeros. Rejection sampling takes O((d + e)r2 ) expected field operations offline, excluding integer arithmetic for the rank probabilities. Write Cn = Cn,n and Vn = Vn,n . Proof of Proposition 1. For each entry i, let hi (K−i ) be a most likely value of Ki given the others and put pi = Pr[Ki = hi (K−i )]. Apply DP to the event xi = hi (x−i ), comparing zero with every nonzero change to entry i. Summing gives (q − 1)pi ≤ eε (1 − pi ) + (q − 1)δ. A distribution whose largest probability is p has entropy at least 2(1 − p) bits. Applying this conditionally and using the chain rule gives 2 P H(K) ≥ i H(Ki | K−i ) ≥ 2n e(q−1)(1−δ) . Counting facε +q−1 tor pairs gives H(K) ≤ 2nr log2 q, proving (2). For δ = 0, singleton events make the support invariant under every entry translation, forcing full support and contradicting r < n. Proof of Theorem 3. Put k = |T |. Since A is uniform, X and R are independent. Given X = x, we have AT = xT −RT , so the required distance equals the distance of RT from uniform. Qk−1 Write pk,d = j=0 (1 − q j−d ). For Low-Rank Factors, UT V is uniform when UT has full row rank, an event of probability pk,r . The distance is therefore at most 1−pk,r ≤ q k−r /(q−1).
For uniform rank-r masks, use full-rank factors. Then rank(RT ) = rank(UT ). Conditioning a uniform n × r matrix U on having full column rank gives Pr[rank(RT ) = k] = pk,r p p Pr[rank(UT ) = k | rank(U ) = r] = k,r pr−k,n−k = pk,n , r,n where the last equality uses pr,n = pk,n pr−k,n−k . Conditional on full row rank, RT is uniform by invariance under invertible column operations. A uniform k × n matrix has the same conditional law, with event probability pk,n . Both probabilities are at least pk,r , giving a distance of at most 1 − pk,r . Mixing lower ranks adds at most βn,r = Vn (r − 1)/Vn (r). Transposition gives the column bounds. P Proof of Theorem 4. Let χH (M ) = ψ( ij Hij Mij ), where ψ is a nontrivial additive character of Fq . These characters form an orthonormal basis, and E[χH (A) | X = x] = χH (x)E[χH (R)]. Thus, conditional expectation is diagonal, giving ρm (A; X) = maxH̸=0 |E[χH (R)]|. For Low-Rank Factors, averaging over V gives E[χH (U V )] = Pr[H T U = 0] = q −r rank(H) , with maximum q −r . For Low-Rank Ball, invariance under invertible row and column operations lets us take H = diag(1, H ′ ) for H ̸= 0. Write M = ac Db . For fixed b, c, D with rank(D) < r, either every a satisfies the rank bound or none does, so the sum over a vanishes. When rank(D) = r, the rank bound requires b, c in its row and column spaces and, after reducing D to diag(Ir , 0), fixes a = b1 c1 . Summing ψ(b1 c1 ) over = 0, so the total is q r . Hence P c1 vanishes unless b1r P ′ rank(M )≤r χH (M ) = q rank(D)=r χH (D). The absolute value is at most q r Cn−1 (r), with equality for rank-one H. Each rank-r block D has q 2r rank-r extensions, so Vn (r) ≥ q 2r Cn−1 (r). Thus ρm (A; X) = q r Cn−1 (r)/Vn (r) ≤ q −r . For independent inputs and masks, the joint coefficients are products with the same largest nonconstant magnitude. Since Z = XY , this gives ρm ((A, B); (X, Y, Z)) = ρm (A; X). Proof of Theorem 5. Let g(A) = | ker A| = q n−rank(A) and N = q n . Both A, X are uniform, and rank invariance gives g(X) = g(A + K). Counting kernel vectors gives Eg(A) = 2 − N −1 and Var(g(A)) = (q − 1)(1 − N −1 )2 . Fix K of rank t. We compute E[g(A)g(A + K)] by counting pairs (v, w) with Av = 0 and Aw = −Kw. There are (N − 1)(N − q) linearly independent pairs, each satisfying these equations with probability N −2 . For a dependent pair w = cv ̸= 0, the equations are consistent exactly when Kv = 0. This gives (q − 1)(q n−t − 1) pairs, each contributing N −1 . The pair (0, 0) contributes 1, and pairs with exactly one zero contribute 2(N − 1)/N . Averaging over K, subtracting the squared mean, and dividing by the variance gives − rank(K) ]−2N −1 +N −2 Corr(g(A), g(X)) = E[q . (1−N −1 )2 Using rank(K) ≤ r gives the first bound in (3); 2q −n ≤ q −r /2 for r ≤ n − 2 gives the second. 4. ACKNOWLEDGMENT No external funding supported this work. The authors declare no conflicts of interest. ChatGPT (OpenAI) was used as an
auxiliary tool to identify relevant literature and to check algebraic derivations. All references, mathematical statements, and proofs were independently verified by the authors. 5. COMPLIANCE WITH ETHICAL STANDARDS This work is theoretical and does not involve human or animal subjects. No ethical approval was required. 6. REFERENCES [1] Youngjin Bae, Jung Hee Cheon, Guillaume Hanrot, Jai Hyun Park, and Damien Stehlé, “Fast homomorphic linear algebra with BLAS,” Jour. of Cryp., vol. 39, no. 3, pp. 25, 2026. [2] Mark Braverman and Stephen Newman, “Practical secure delegated linear algebra with trapdoored matrices,” in Theory of Cryptography, Benny Applebaum and Huijia (Rachel) Lin, Eds., Cham, 2026, pp. 97–118, Springer Nature Switzerland. [3] Rafael G. L. D’Oliveira, Giulia Gaggero, Arturo Jaramillo Gil, Hiram H López, Cecilia Martínez-Reyes, and Divyesh Vaghasiya, “Function tables for secure distributed matrix multiplication,” arXiv preprint arXiv:2609.08154, 2026. [4] Mikhail J. Atallah, Konstantinos N. Pantazopoulos, and Eugene H. Spafford, “Secure outsourcing of some computations,” Tech. Rep. 96-074, Purdue University, 1996. [5] Mikhail J. Atallah, K.N. Pantazopoulos, John R. Rice, and Eugene E. Spafford, “Secure outsourcing of scientific computations,” in Trends in Software Engineering, Marvin V. Zelkowitz, Ed., vol. 54 of Adv. in Comp., pp. 215–272. Elsevier, 2002. [6] Mikhail J. Atallah and Keith B. Frikken, “Securely outsourcing linear algebra computations,” in Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, New York, NY, USA, 2010, ASIACCS ’10, p. 48–59, Association for Computing Machinery. [7] Khaled Khan, Mahboob Shaheen, and Yongge Wang, “Using sparse matrices to prevent information leakage in cloud computing,” in 2018 IEEE 6th International Conference on Future Internet of Things and Cloud (FiCloud), 2018, pp. 444–447. [8] Xinyu Lei, Xiaofeng Liao, Tingwen Huang, and Feno Heriniaina, “Achieving security, robust cheating resistance, and highefficiency for outsourcing large matrix multiplication computation to a malicious cloud,” Information Sciences, vol. 280, pp. 205–217, 2014. [9] Shengxia Zhang, Chengliang Tian, Hanlin Zhang, Jia Yu, and Fengjun Li, “Practical and secure outsourcing algorithms of matrix operations based on a novel matrix encryption method,” IEEE Access, vol. 7, pp. 53823–53838, 2019. [10] Chun Liu, Xuexian Hu, Xiaofeng Chen, Jianghong Wei, and Wenfen Liu, “An efficient matrix multiplication with enhanced privacy protection in cloud computing and its applications,” arXiv preprint arXiv:2105.05525, 2021. [11] Chun Liu, Xuexian Hu, Xiaofeng Chen, Jianghong Wei, and Wenfen Liu, “SDIM: A subtly designed invertible matrix for enhanced privacy-preserving outsourcing matrix multiplication and related tasks,” IEEE Trans. on Dependable and Secure Computing, vol. 21, no. 4, pp. 3469–3486, 2024. [12] Shaojing Fu, Yunpeng Yu, and Ming Xu, “A secure algorithm for outsourcing matrix multiplication computation in the cloud,”
in Proceedings of the Fifth ACM International Workshop on Security in Cloud Computing, New York, NY, USA, 2017, SCC ’17, p. 27–33, Association for Computing Machinery. [13] Malay Kumar and Manu Vardhan, “Secure and verifiable outsourcing algorithm for large-scale matrix multiplication on public cloud server,” in Engineering Vibration, Communication and Information Processing: ICoEVCI 2018, India, pp. 575–586. Springer, 2018. [14] Sergio Salinas, Changqing Luo, Xuhui Chen, and Pan Li, “Efficient secure outsourcing of large-scale linear systems of equations,” in 2015 IEEE Conference on Computer Communications (INFOCOM), 2015, pp. 1035–1043. [15] Yu Wu, Yongjian Liao, Yikuan Liang, and Yulu Liu, “Secure and efficient protocol for outsourcing large-scale matrix multiplication to the cloud,” IEEE Access, vol. 8, pp. 227556–227565, 2020. [16] Gaojian Xiong, Yu Sun, Jianhua Liu, Jian Cui, and Jianwei Liu, “LoRO: Real-time on-device secure inference for LLMs via TEE-based low rank obfuscation,” in The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [17] Cynthia Dwork and Aaron Roth, “The algorithmic foundations of differential privacy,” Foundations and trends® in theoretical computer science, vol. 9, no. 3-4, pp. 211–487, 2014. [18] Alejandro Cohen, Asaf Cohen, Muriel Médard, and Omer Gurewitz, “Secure multi-source multicast,” IEEE Trans. on Communications, vol. 67, no. 1, pp. 708–723, 2019. [19] Cheuk Ting Li and Abbas El Gamal, “Maximal correlation secrecy,” IEEE Trans. on Inf. Theory, vol. 64, no. 5, pp. 3916– 3926, 2018. [20] Wei Zhao, Jingwen Tan, Huanran Wang, Shuai Han, Mingzhu Lai, and Wu Yang, “A performance-adjustable encryption scheme for balancing security and efficiency in matrix multiplication outsourcing,” Computer Networks, p. 111828, 2025. [21] James Hsin-yu Chiang, Sheila Zingg, Kari Kostiainen, and Srdjan Capkun, “MOSAIC: Masked outsourcing of secure AI computations,” arXiv preprint arXiv:2607.29221, 2026. [22] Okko Makkonen and Camilla Hollanti, “Analog secure distributed matrix multiplication,” IEEE Trans. on Inf Theory, vol. 72, no. 7, pp. 4751–4765, 2026. [23] Ateet Devulapalli, Viveck R. Cadambe, Flavio P. Calmon, and Haewon Jeong, “Differentially private distributed matrix multiplication: Fundamental accuracy-privacy trade-off limits,” in 2022 IEEE Int. Sym. on Info Theory (ISIT), 2022, pp. 2016– 2021. [24] Viveck R. Cadambe, Haewon Jeong, and Flavio P. Calmon, “Differentially private secure multiplication: Hiding information in the rubble of noise,” in 2023 IEEE Int. Sym. on Inf. Theory (ISIT), 2023, pp. 2207–2212. [25] Swanand Kadhe and Alex Sprintson, “Weakly secure regenerating codes for distributed storage,” in 2014 Int. Sym. on Network Coding (NetCod). IEEE, 2014, pp. 1–6. [26] Cailyn Bass, Alejandro Cohen, Rafael G. L. D’Oliveira, and Muriel Médard, “A monotone circuit construction for individually-secure multi-secret sharing,” in 2024 IEEE Int. Sym. on Inf. Theory (ISIT), 2024, pp. 178–183. [27] Saar Tarnopolsky and Alejandro Cohen, “Coding-based hybrid post-quantum cryptosystem for non-uniform information,” IEEE Trans. on Inf. Theory, vol. 72, no. 3, pp. 1850–1873, 2026.