通过扰动嵌入空间实现隐私保护，兼顾效率与效果。
OSNIP: Breaking the Privacy-Utility-Efficiency Trilemma in LLM Inference via Obfuscated Semantic Null Space
- 将语义嵌入投影至混淆的零空间，实现无后处理隐私保护。
- 在12个基准上攻击成功率显著降低，模型性能基本不变。
- 适合对数据隐私要求高且需高效推理的应用场景。
我们提出一种轻量级客户端加密框架OSNIP，用于保护大语言模型推理中的隐私。将线性核的几何直觉推广到大模型的高维潜在空间，形式化定义了“混淆语义零空间”——该空间在保持语义保真度的同时，使原始嵌入近似正交。通过注入将原始嵌入投影至该空间的扰动，OSNIP在无需后处理的情况下确保隐私。此外，OSNIP采用密钥依赖的随机映射，为每位用户生成唯一扰动轨迹。在12个生成与分类基准上的评估表明，OSNIP在严格安全约束下实现当前最优性能，显著降低攻击成功率，同时保持强模型效用。
原文摘要 · Abstract (English)
We propose Obfuscated Semantic Null space Injection for Privacy (OSNIP), a lightweight client-side encryption framework for privacy-preserving LLM inference. Generalizing the geometric intuition of linear kernels to the high-dimensional latent space of LLMs, we formally define the ``Obfuscated Semantic Null Space'', a high-dimensional regime that preserves semantic fidelity while enforcing near-orthogonality to the original embedding. By injecting perturbations that project the original embedding into this space, OSNIP ensures privacy without any post-processing. Furthermore, OSNIP employs a key-dependent stochastic mapping that synthesizes individualized perturbation trajectories unique to each user. Evaluations on 12 generative and classification benchmarks show that OSNIP achieves state-of-the-art performance, sharply reducing attack success rates while maintaining strong model utility under strict security constraints.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。