Privacy

The reconstruction adversary

You cannot claim privacy without naming the attacker you are private against. NoviQ makes the attacker a first-class object and publishes exactly how much it recovers.

Why an adversary

"Private" with no adversary is a marketing word. The only honest way to talk about privacy is to define a concrete attacker, give it the strongest realistic access, measure what it recovers, and report that number - even when it is embarrassing.

The adversary, defined

Reconstruction adversary

Given exactly the activations a given node processes for a request - its block's inputs and outputs - how much of the user's input can it recover?

This models the real threat in a decentralized network: a node you do not control runs one of your layers, and to do so it must decrypt the activations it receives. It is honest-but-curious at minimum, and possibly malicious. The question is not "could someone tap the wire" (the wire is sealed) but "what can the machine at the end of the wire learn."

The metric

The load-bearing number is the fraction of input tokens reconstructed, with a distributional variant (top-k token recovery) for partial leaks. It is computed per node, and the receipt reports the worst case across all untrusted nodes.

Token recovery on an untrusted node: the inherited baseline, the receipt pass line, and the result once per-request obfuscation is applied.

The baseline we inherit

Prior work established the counter-fact that motivates the whole project: a node running your layer can reconstruct roughly 35 to 59 percent of your tokens from the intermediate activations it legitimately sees. Sealing the wire does not touch this number at all. That baseline is the thing NoviQ exists to drive down.

Weak and strong attackers

Cheap attacker - map each activation to its nearest public token embedding. Fast, no training, surprisingly effective.
Strong attacker - a trained probe (for example a linear or small neural model) that learns to invert activations back to tokens.

We report the worst case

A defense only counts if it holds against the stronger attacker. The privacy receipt records the highest recovery any untrusted node achieved, not an average and not the friendliest attacker. Next, see how obfuscation collapses that number on Obfuscation and receipts.