Search papers, labs, and topics across Lattice.
This paper introduces an orthogonal obfuscation method for large language model (LLM) inference that enhances privacy by preventing the recovery of sensitive text from hidden representations. By employing a transformer variant called ConjFormer, which maintains equivariance through a novel normalization technique and orthogonal conjugation of weights, the authors demonstrate that the server can perform inference without ever accessing unrotated hidden states. Experimental results show a significant reduction in token recovery rates from over 35% to just 1.3%, while only minimally impacting model performance, highlighting the effectiveness of architectural symmetry in privacy preservation.
Orthogonal obfuscation slashes token recovery rates from LLM inference to just 1.3%, safeguarding sensitive data without compromising performance.
Running large language models locally is often impractical, pushing inference on sensitive text to third-party providers. Split inference partially mitigates this by keeping tokens on the client and sending only hidden representations, but these representations can still be recovered via nearest-neighbor search against the public embedding table. We propose an orthogonal obfuscation procedure in which the client multiplies embeddings by a secret orthogonal matrix before transmission. To enable correct inference under arbitrary rotations, we introduce ConjFormer, a transformer variant that is exactly $\mathrm{O}(d)$-equivariant via a lightweight normalization change (scalar RMSNorm) together with blockwise orthogonal conjugation of all linear weights. As a result, the server performs the full forward pass entirely in the rotated basis and never observes unrotated hidden states. Experiments on GPT-2 and Llama 3.2 1B models fine-tuned on PubMed show that orthogonal obfuscation eliminates direct cosine nearest-neighbor inversion and reduces token recovery from over 35% top-10 to at most 1.3%, while increasing perplexity by only 0.4% after fine-tuning. These results indicate that enforcing symmetry at the architectural level can provide a practical defense for privacy-preserving LLM inference without noise injection or heavy cryptographic machinery.
