arXiv cs.AI· Mahendra Roopa, Srikanth Roopa·· 12 小时前AI 评分34
面向托管模型的隐私推理：为冻结的 Qwen3.8-27B 学习输入嵌入变换
Privacy-preserving inference on hosted models: a learned input-embedding transform for frozen Qwen3.8-27B
AI 导读
研究者提出一种客户端本地完成的输入嵌入变换方案，让托管方只收到变换后的向量而非文本或 token id。该变换是一个 55.6M 参数的小网络，作用于冻结的 Qwen3.8-27B，训练时以冻结模型为固定评判者，结合前向 KL 效用项与使向量偏离原方向的辅助项。
正文 · 原文
Abstract:Every prompt sent to a hosted language model is readable by whoever runs it. We study whether the prompt can remain on the client while the host receives transformed vectors that stand in for it. A language model converts text to vectors exactly once, with a public lookup table; we perform that step locally and pass the vectors through a small trained network (55.6M parameters) before they leave the perimeter. The host runs a frozen 27B model (Qwen3.8-27B) on the transformed vectors and never receives text or token ids. We train the transform against the frozen model as a fixed judge, combining a forward-KL utility term with an auxiliary term that pushes each vector away from its original direction. On 1,490 MMLU questions held out from training, the transform costs 1.5 points of accuracy (80.7% vs. 82.3%), breaking 68 of the 1,226 questions the unmodified model answers correctly (5.5%), while 30.1% of content tokens no longer decode to their original token under a nearest-neighbour lookup.
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.27817 [cs.AI] |
| (or arXiv:2610.27817v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.27817 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Mahendra Roopa [view email]
[v1]
Tue, 20 Oct 2026 08:08:46 UTC (18 KB)
来源：arXiv cs.AI · arxiv.org