Citing kLLM

This page gives the citations for kLLM and for the research of the kLLM team. The software is cited for any use of kLLM or any measurement made with it; the papers are cited for references to their methods or results.

The research systems are separate from what kllm seal ships today. Citing SCX or STIP does not describe kLLM’s security properties, and citing kLLM does not imply the properties of either paper. See SCX: stateless KV-cache encoding, STIP: three-party privacy-preserving inference and Claims.

Cite kLLM

kLLM has no tagged release yet. Cite the repository together with the version that kllm version prints, and, where possible, the commit used.

$ kllm version
kllm 0.1.0.dev0

@software{kllm,
  title   = {{kLLM}: Sealed Models on Stock Inference Engines},
  author  = {{Agent Network}},
  year    = {2026},
  version = {0.1.0.dev0},
  url     = {https://github.com/ANetResearch/kLLM},
  license = {Apache-2.0}
}

Plain-text form:

Agent Network. kLLM: Sealed Models on Stock Inference Engines, version 0.1.0.dev0, 2026. https://github.com/ANetResearch/kLLM

Replace the version with the one used. A citation of a measurement made with kLLM states the conditions with it: the GPU, the engine and its version, the precision, the input and output lengths and the concurrency. The figures in the kLLM README, for example, were measured on one NVIDIA A40 48 GB with SGLang 0.5.21 or vLLM 0.31.0, in bf16, with 1024 input and 128 output tokens, as single runs on a GPU shared with another tenant’s light job. See Benchmarking plain and sealed serving.

Cite the research

SCX

Mu Yuan, Lan Zhang, Liekang Zeng, Siyang Jiang, Bufang Yang, Di Duan, and Guoliang Xing. “SCX: Stateless KV-Cache Encoding for Cloud-Scale Confidential Transformer Serving.” ACM SIGCOMM 2025. DOI 10.1145/3718958.3750509. Code: https://github.com/yuanmu97/scx.

@inproceedings{yuan2025scx,
  title     = {{SCX}: Stateless {KV}-Cache Encoding for Cloud-Scale Confidential
               Transformer Serving},
  author    = {Yuan, Mu and Zhang, Lan and Zeng, Liekang and Jiang, Siyang and
               Yang, Bufang and Duan, Di and Xing, Guoliang},
  booktitle = {Proceedings of the ACM SIGCOMM 2025 Conference},
  year      = {2025},
  doi       = {10.1145/3718958.3750509}
}

STIP

Mu Yuan, Lan Zhang, Yihang Cheng, Miao-Hui Song, Guoliang Xing, and Xiang-Yang Li. “STIP: Three-Party Privacy-Preserving and Lossless Inference for Large Transformers in Production.” Network and Distributed System Security (NDSS) Symposium 2026, San Diego. DOI 10.14722/ndss.2026.230035.

@inproceedings{yuan2026stip,
  title     = {{STIP}: Three-Party Privacy-Preserving and Lossless Inference for Large
               Transformers in Production},
  author    = {Yuan, Mu and Zhang, Lan and Cheng, Yihang and Song, Miao-Hui and
               Xing, Guoliang and Li, Xiang-Yang},
  booktitle = {Network and Distributed System Security (NDSS) Symposium 2026},
  address   = {San Diego, CA},
  year      = {2026},
  doi       = {10.14722/ndss.2026.230035}
}

Which work to cite

Reference to

Cite

Sealing with kllm seal and serving with kllm serve, or a measurement made with kLLM

kLLM, with the version used.

Feature-space permutation of transformer parameters with a three-party threat model

STIP.

The perm transform specifically

kLLM, and STIP for the permutation approach it extends.

Run-time encoding of the KV-cache under user-controlled keys

SCX.

How the perm transform relates to STIP is described in STIP: three-party privacy-preserving inference. How SCX differs from kLLM’s static transforms is described in SCX: stateless KV-cache encoding.

Further work is under submission and will be released after publication.

Models and code