用每批随机混洗隐藏状态，保护大模型推理隐私。
Good-Enough LLM Obfuscation (GELO)
- 每批输入用随机矩阵混洗隐藏状态，解混后输出不变。
- 在Llama-2 7B上保持浮点输出精确，计算开销仅增加20%~30%。
- 抵抗独立成分分析等统计攻击，适合部署在共享加速器上。
大型语言模型（LLMs）越来越多地在共享加速器上运行，攻击者若能读取设备内存，可观察到键值缓存和隐藏状态，威胁开源模型的提示隐私。虽然多方计算（MPC）和全同态加密（FHE）提供强保障，但速度慢一到两个数量级，不适用于交互式推理；静态混淆方案在模型已知时易受多轮统计攻击。本文提出GELO（Good-Enough LLM Obfuscation），一种轻量级隐私保护推理协议，通过每批使用新鲜的可逆混洗来限制未授权加速器观测带来的信息泄露。对于每个卸载的投影，可信执行环境（TEE）采样随机矩阵$A$，构造$U = AH$，将$U$与权重$W$卸载至加速器，并在返回后应用$A^{-1}$，使$A^{-1}((AH)W) = HW$，输出不变。因混洗不跨批复用，攻击者只能面对单批盲源分离问题。我们分析了信息泄露并引入两项实用防御：(i) 非正交混洗以掩蔽格拉姆矩阵；(ii) 正交混洗外加少量高能量“屏蔽”向量，污染高阶统计特征。在Llama-2 7B上，GELO精确保留浮点32位输出，与低精度基线表现接近，在受控卸载微基准测试中计算开销约增加20%~30%；未经优化的远程原型受限于传输开销，提示需更深度集成服务引擎。GELO有效抵御ICA/BSS及锚定辅助攻击；基于6000万参数Transformer的去混攻击在强混洗与屏蔽下亦失败。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly served on shared accelerators where an adversary with read access to device memory can observe KV caches and hidden states, threatening prompt privacy for open-source models. Cryptographic protections such as MPC and FHE offer strong guarantees but remain one to two orders of magnitude too slow for interactive inference, while static obfuscation schemes break under multi-run statistical attacks once the model is known. We present GELO (Good-Enough LLM Obfuscation), a lightweight protocol for privacy-preserving inference that limits information leakage from untrusted accelerator observations by hiding hidden states with fresh, per-batch invertible mixing. For each offloaded projection, the TEE samples a random matrix $A$, forms $U = AH$, offloads $U$ and weights W to the accelerator, and then applies $A^{-1}$ on return, so that $A^{-1}((AH)W ) = HW$ and outputs are unchanged. Because mixing is never reused across batches, the attacker faces only a single-batch blind source separation problem. We analyse information leakage and introduce two practical defences: (i) non-orthogonal mixing to mask Gram matrices, and (ii) orthogonal mixing augmented with a small fraction of high-energy "shield" vectors that pollute higher-order statistics. On Llama-2 7B, GELO preserves float32 outputs exactly, closely matches low-precision baselines, and shows about $20$--$30\%$ compute-side overhead in a controlled offload microbenchmark; an unoptimized remote prototype is dominated by transport overhead, motivating deeper serving-engine integration. GELO resists ICA/BSS and anchor-assisted attacks; a 60M-parameter transformer-based unmixing attack also fails under strong mixing and shielding.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。