Privacy

Obfuscation and receipts

A per-request secret rotation of the hidden dimension lets untrusted nodes do their work in a scrambled basis - correct output, near-zero prompt recovery - and the result is written into a receipt.

The first honest failure

The obvious defense is boundary pinning: keep the embedding and final layers on trusted nodes. On its own, it is not enough. The input embedding persists in the residual stream, so a decrypting middle node reconstructs the prompt at essentially every depth - close to 100 percent recovery on a small model.

Named, not hidden

This is the hard truth the thesis states out loud. Pinning the boundary reduces exposure but does not remove the signal an untrusted node sees. Something has to change the basis the middle node computes in.

The obfuscation trick

For each request, the trusted head draws a secret signed permutation R of the hidden dimension - an orthogonal transform that shuffles and sign-flips the channels. It applies R to the residual stream before handing off. The untrusted middle node does not hold R; instead it holds its blocks' weights conjugated by R (W' = W R). The trusted tail undoes R at the end.

The head applies a fresh secret rotation R; the untrusted worker runs conjugated weights W' = W R and never sees R; the tail undoes R.

Why the output survives

Because RMSNorm is invariant under a signed permutation, the conjugated block computes the correct answer in the rotated basis. The whole-model output is bit-identical to the unrotated run - yet the middle node never sees, and never needs, R. To its reconstruction adversary the activations look like noise.

Without obfuscation:   untrusted recovery ~= 100%
With obfuscation:      untrusted recovery ~= 0.3%   (chance ~= 0.20%)
Output:                bit-identical greedy tokens
Receipt threshold:     10%   ->   PASS

The assumption

What must hold

The security rests on one stated assumption: an untrusted node cannot recover R from its conjugated weights versus the public weights, and R is drawn fresh for every request. We state this assumption explicitly rather than burying it, so it can be attacked and strengthened.

The privacy receipt

The privacy block of the receipt records the defenses in play, the layer-to-node assignment, and the per-node recovery scores. The load-bearing field is worst_untrusted_recovery: the maximum token recovery over every node not marked trusted. The run passes only if that worst case is below the declared threshold.

{
  "format": "noviq-receipt/v1",
  "privacy": {
    "threshold": 0.10,
    "defenses": ["boundary_pinning", "signed_permutation_obfuscation"],
    "per_node": [
      { "node": "head",   "trust_tier": "operator",  "token_recovery": 0.00 },
      { "node": "mid-A",  "trust_tier": "volunteer", "token_recovery": 0.003 },
      { "node": "tail",   "trust_tier": "operator",  "token_recovery": 0.00 }
    ],
    "worst_untrusted_recovery": 0.003,
    "pass": true
  }
}

What a pass means

A passing receipt proves that this specific run kept the prompt private to a measured degree, under the stated adversary and assumption. It is not a blanket guarantee for all runs, and NoviQ never presents it as one.