Search papers, labs, and topics across Lattice.
GELO (Good-Enough LLM Obfuscation) is introduced as a lightweight protocol for privacy-preserving LLM inference on shared accelerators, addressing the vulnerability of KV caches and hidden states to adversaries with memory access. It uses per-batch invertible mixing with random matrices to hide hidden states, transforming offloaded projections as U = AH and applying A^-1 on return to preserve outputs. The approach is analyzed for information leakage, with defenses including non-orthogonal mixing and orthogonal mixing with high-energy shield vectors, achieving 20-30% latency overhead on Llama-2 7B while effectively defeating ICA/BSS and anchor-based attacks.
LLM privacy on shared accelerators doesn't have to break the bank: GELO achieves strong obfuscation with only 20-30% latency overhead, defeating common attacks.
Large Language Models (LLMs) are increasingly served on shared accelerators where an adversary with read access to device memory can observe KV caches and hidden states, threatening prompt privacy for open-source models. Cryptographic protections such as MPC and FHE offer strong guarantees but remain one to two orders of magnitude too slow for interactive inference, while static obfuscation schemes break under multi-run statistical attacks once the model is known. We present GELO (Good-Enough LLM Obfuscation), a lightweight protocol for privacy-preserving inference that limits information leakage from untrusted accelerator observations by hiding hidden states with fresh, per-batch invertible mixing. For each offloaded projection, the TEE samples a random matrix A, forms $U = AH$, offloads U and weights W to the accelerator, and then applies $A^-1$ on return, so that $A^-1 ((AH)W ) = HW$ and outputs are unchanged. Because mixing is never reused across batches, the attacker faces only a single-batch blind source separation problem. We analyze information leakage and introduce two practical defenses: (i) non-orthogonal mixing to mask Gram matrices, and (ii) orthogonal mixing augmented with a small fraction of high-energy"shield"vectors that pollute higher-order statistics. On Llama-2 7B, GELO preserves float32 outputs exactly, closely matches low-precision baselines, offloads the dominant matrix multiplications with about 20-30% latency overhead, and defeats a range of ICA/BSS and anchor-based attacks.
