Privacy from Symmetry: Orthogonally Equivariant Transformers for LLM Inference
2026-06-15 • Machine Learning
Machine Learning
AI summaryⓘ
The authors address privacy concerns when using large language models by proposing a method that hides the text data sent to servers. They multiply the data by a secret rotation matrix before sending it, making it hard to recover the original information. To handle this, they design a new transformer model called ConjFormer that can work correctly even with these rotations. Their experiments show this approach greatly reduces the risk of data recovery while keeping the model's performance nearly unchanged, suggesting a practical way to protect user data without complex encryption.
large language modelsinferenceorthogonal matrixequivariancetransformerembeddingprivacycosine nearest-neighbor searchRMSNormtoken recovery
Authors
Alexander Yukhimchuk, Andrey Shulga, Mladen Kolar, Martin Takáč
Abstract
Running large language models locally is often impractical, pushing inference on sensitive text to third-party providers. Split inference partially mitigates this by keeping tokens on the client and sending only hidden representations, but these representations can still be recovered via nearest-neighbor search against the public embedding table. We propose an orthogonal obfuscation procedure in which the client multiplies embeddings by a secret orthogonal matrix before transmission. To enable correct inference under arbitrary rotations, we introduce ConjFormer, a transformer variant that is exactly $\mathrm{O}(d)$-equivariant via a lightweight normalization change (scalar RMSNorm) together with blockwise orthogonal conjugation of all linear weights. As a result, the server performs the full forward pass entirely in the rotated basis and never observes unrotated hidden states. Experiments on GPT-2 and Llama 3.2 1B models fine-tuned on PubMed show that orthogonal obfuscation eliminates direct cosine nearest-neighbor inversion and reduces token recovery from over 35% top-10 to at most 1.3%, while increasing perplexity by only 0.4% after fine-tuning. These results indicate that enforcing symmetry at the architectural level can provide a practical defense for privacy-preserving LLM inference without noise injection or heavy cryptographic machinery.