Privacy from Symmetry: Orthogonally Equivariant Transformers for LLM Inference
For users who need to run LLM inference on sensitive text via third-party providers, this provides a practical defense against embedding inversion attacks without noise injection or heavy cryptography.
The paper proposes an orthogonal obfuscation method for privacy-preserving LLM inference, where the client multiplies embeddings by a secret orthogonal matrix, and introduces ConjFormer, an O(d)-equivariant transformer that enables correct inference under arbitrary rotations. Experiments on GPT-2 and Llama 3.2 1B show that this reduces token recovery from over 35% top-10 to at most 1.3% with only 0.4% perplexity increase after fine-tuning.
Running large language models locally is often impractical, pushing inference on sensitive text to third-party providers. Split inference partially mitigates this by keeping tokens on the client and sending only hidden representations, but these representations can still be recovered via nearest-neighbor search against the public embedding table. We propose an orthogonal obfuscation procedure in which the client multiplies embeddings by a secret orthogonal matrix before transmission. To enable correct inference under arbitrary rotations, we introduce ConjFormer, a transformer variant that is exactly $\mathrm{O}(d)$-equivariant via a lightweight normalization change (scalar RMSNorm) together with blockwise orthogonal conjugation of all linear weights. As a result, the server performs the full forward pass entirely in the rotated basis and never observes unrotated hidden states. Experiments on GPT-2 and Llama 3.2 1B models fine-tuned on PubMed show that orthogonal obfuscation eliminates direct cosine nearest-neighbor inversion and reduces token recovery from over 35% top-10 to at most 1.3%, while increasing perplexity by only 0.4% after fine-tuning. These results indicate that enforcing symmetry at the architectural level can provide a practical defense for privacy-preserving LLM inference without noise injection or heavy cryptographic machinery.