Privacy from Symmetry: Orthogonally Equivariant Transformers for LLM Inference

2026-06-15

AI Summary

This work addresses the vulnerability of hidden states in third-party LLM inference to nearest-neighbor attacks, which can reconstruct user-sensitive text. To mitigate this, the authors propose an orthogonal obfuscation mechanism: clients rotate input embeddings using a secret orthogonal matrix before uploading, and introduce ConjFormer—the first O(d)-equivariant Transformer architecture—that enables servers to perform complete forward computation in the rotated basis without accessing original representations. The approach requires neither noise injection nor cryptographic operations. Evaluated on GPT-2 and Llama 3.2 1B, it reduces token top-10 recovery rates from 35% to 1.3% under cosine nearest-neighbor attacks while increasing perplexity by only 0.4%. This represents the first architecture-level realization of strict orthogonal equivariance for practical privacy preservation in outsourced LLM inference.

Abstract

Running large language models locally is often impractical, pushing inference on sensitive text to third-party providers. Split inference partially mitigates this by keeping tokens on the client and sending only hidden representations, but these representations can still be recovered via nearest-neighbor search against the public embedding table. We propose an orthogonal obfuscation procedure in which the client multiplies embeddings by a secret orthogonal matrix before transmission. To enable correct inference under arbitrary rotations, we introduce ConjFormer, a transformer variant that is exactly $\mathrm{O}(d)$-equivariant via a lightweight normalization change (scalar RMSNorm) together with blockwise orthogonal conjugation of all linear weights. As a result, the server performs the full forward pass entirely in the rotated basis and never observes unrotated hidden states. Experiments on GPT-2 and Llama 3.2 1B models fine-tuned on PubMed show that orthogonal obfuscation eliminates direct cosine nearest-neighbor inversion and reduces token recovery from over 35% top-10 to at most 1.3%, while increasing perplexity by only 0.4% after fine-tuning. These results indicate that enforcing symmetry at the architectural level can provide a practical defense for privacy-preserving LLM inference without noise injection or heavy cryptographic machinery.

Problem

• privacy
• large language models
• split inference
• embedding inversion
• third-party inference

Innovation

• orthogonal obfuscation
• O(d)-equivariant
• ConjFormer
• privacy-preserving inference
• split inference