1
Breaking Euston: Recovering Private Inputs from Secure Inference by Exploiting Subspace Leakage
arXiv:2604.17238v1 [cs.CR] 19 Apr 2026
Jiaqi Zhao and Fengwei Wang
Abstract—In the 47th IEEE Symposium on Security and Privacy (IEEE S&P 2026), Gao et al. proposed an efficient and user-friendly secure transformer inference framework, namely Euston. In Euston, a singular value decomposition-based matrix transmission protocol is designed to efficiently transmit input matrices, reducing communication bandwidth by approximately 2.8×. In this manuscript, we show that this transmission protocol introduces subspace leakage of random masks, enabling the model owner to recover private samples easily. We further validate the effectiveness of the recovery attack through simple experiments on image and language datasets, highlighting a fundamental privacy risk of the protocol design.
value vector is encrypted, the two orthogonal matrices still reveal the subspace of random masks. In this manuscript, we design a data recovery attack against Euston by exploiting the subspace leakage. Specifically, we first revisit the matrix transmission protocol in Euston and identify its privacy vulnerabilities. Then, we present our attack and provide a theoretical analysis of its effectiveness. Finally, we empirically validate the attack on both image and language datasets.
Index Terms—Secure inference, singular value decomposition, data privacy.
I. I NTRODUCTION Secure inference [1] has emerged as a critical paradigm in privacy-preserving machine learning, which enables model inference on sensitive user data without exposing the raw inputs. In this paradigm, a user typically encrypts the private input, based on fully homomorphic encryption (FHE) or secure multi-party computation (MPC) techniques, and sends it to an untrusted model owner. The model owner performs inference over the protected representation and returns the corresponding prediction results. In recent years, with the rapid development of large language models, secure inference has been extended from traditional neural networks to transformer models. Secure transformer inference faces additional challenges due to the highdimensional attention mechanisms and the substantial communication and computation overhead introduced by privacypreserving techniques. To tackle these challenges, Gao et al. [2] proposed Euston, an efficient and user-friendly secure transformer inference framework, in the 47th IEEE Symposium on Security and Privacy (IEEE S&P 2026), in which they designed an efficient matrix transmission protocol based on singular value decomposition (SVD) to submit input matrices. Specifically, the user masks the input matrices, where the masks are decomposed via SVD into two orthogonal matrices and a singular value vector. Only the singular value vector is encrypted via FHE and uploaded to the model owner, while the remaining components are transmitted in plaintext. Then, the model owner utilizes them to recover the original inputs over ciphertexts and performs model inference. However, although the singular Jiaqi Zhao and Fengwei Wang are with the School of Cyber Engineering, Xidian University, Xi’an 710126, Shaanxi, China (e-mail: [email protected], and [email protected]).
II. R EVISITING E USTON Euston is a two-party and non-interactive secure transformer inference framework, which consists of a user (U) and a model owner (MO). U submits the input matrix A ∈ Rm×n to MO, and MO computes the inference result M(A) with its model M and returns it to U. Based on FHE and SVD, the matrix transmission protocol is used to securely and efficiently transmit the input matrix A, which is executed via offline and online phases.
A. Offline Phase In this phase, U first generates a random matrix R ∈ Rm×n with the same size as A. Then, it decomposes the matrix R through the SVD algorithm to obtain two orthogonal matrices U ∈ Rm×m , H ∈ Rm×n , and a diagonal matrix D ∈ Rm×m , which satisfies R = U DH. The diagonal values of D can also be represented as the singular value vector d = {d1 , d2 , · · · , dm }. Finally, d is encrypted to JdK by FHE, and U sends JdK, U, H to MO. For MO, it extends JdK to JDK, and computes JRW K = U ⊗ JDK ⊗ HW, where ⊗ denotes the homomorphic multiplication, and W is the weight matrix of the model M. Note that the vector d is packed before the encryption in Euston, and all subsequent computations are performed over the packed ciphertexts. However, our attack is not related to the packing method, so we omit its detailed description for clarity. Similarly, the specific FHE scheme used in Euston is also independent of our attack and is not discussed in this manuscript.
2
Therefore,
B. Online Phase In the online phase, U uses the random matrix R to mask the private input A via X = A − R ∈ Rm×n ,
D̃ = diag(D̂) = diag(U T AH T ) − D. Thus, R̃ = −U D̃H = R − U diag(U T AH T )H.
and sends X to MO. After that, MO computes JAW K = JRW K ⊕ XW,
where ⊕ is the homomorphic addition. Then, a series of secure and efficient protocols, including matrix multiplication and layer normalization, are applied to the subsequent inference process to produce the final result. Since this manuscript focuses on the security of the matrix transmission protocol, we do not provide detailed descriptions of the subsequent protocols in Euston. Originally, m × n values are required to be encrypted and transmitted. With the above secure transmission protocol, this requirement is reduced to m values, thereby significantly decreasing the communication overhead incurred when initiating an inference request. However, in the above protocol, the orthogonal matrices U and H are leaked to MO, which denotes the row and column subspaces of the masking matrix R. Therefore, it is possible for MO to recover R from U and H, thereby enabling the reconstruction of the original input A. III. DATA R ECOVERY ATTACK In this section, we present our attack method to recover the original input in Euston. First, after receiving the masked input X, MO computes D̂ = U T XH T ∈ Rm×n . Then, it extracts the diagonal matrix D̃ = diag(D̂) as an approximation of matrix D. After that, the random matrix R̃ is recovered approximately through R̃ = −U D̃H, and the recovered input is à = X + R̃. To demonstrate the effectiveness of the attack, we first theoretically analyze the relative recovery error (RRE), which quantifies the discrepancy between the recovered sample à and the original sample A. It is defined as: RRE =
∥Ã − A∥F , ∥A∥F
where ∥ · ∥F denotes the Frobenius norm. Theorem 1. The expected relative recovery error satisfies E[
1 ∥Ã − A∥F ]≤ √ . ∥A∥F n
Proof. Since X = A − R = A − U DH, we have D̂ = U T XH T = U T AH T − U T U DHH T . Using U T U = Im and HH T = Im , it follows that D̂ = U T AH T − D.
Substituting into à = X + R̃, we obtain à = (A − R) + R̃ = A − U diag(U T AH T )H. Hence, à − A = −U diag(U T AH T )H. By the unitary invariance of the Frobenius norm, ∥à − A∥F = diag(U T AH T ) F . In Euston, since U and H are random orthogonal factors, the diagonal energy of a matrix is no larger than its total Frobenius energy, ∥à − A∥F ≤ ∥U T AH T ∥F = ∥A∥F . For the expectation bound, since U and H are random orthogonal factors independent of A, the energy of U T AH T is uniformly distributed over its mn entries in expectation. ∥A∥2 Therefore, each entry has expected squared magnitude mnF . Since there are m diagonal entries, E[∥à − A∥2F ] = m ·
1 ∥A∥2F = ∥A∥2F . mn n
Therefore, E[
1 ∥Ã − A∥F ]≤ √ . ∥A∥F n
The proof is complete. Therefore, the expected relative recovery error vanishes as n increases, which means that the reconstructed input à becomes increasingly close to the original input A. For common highdimensional inputs such as those in Transformers or images, the error is small, indicating that MO can effectively reconstruct the user’s input. IV. ATTACK E VALUATION In this section, we evaluate the effectiveness of the proposed data recovery attack. Following Euston, we adopt the GLUE benchmark, including RTE, SST-2, and QNLI, and use the BERT-base model for evaluation. The effectiveness of the attack is also measured by RRE. Moreover, we also evaluate the attack on the CIFAR-100 image dataset to provide a more intuitive demonstration of its effectiveness. From TABLE I, we observe that the REE remains consistently low across all four datasets. It indicates that our attack can be executed successfully regardless of the masking scale η, because the recovery mainly depends on the leaked singular subspaces rather than the scale of the mask. Moreover, since the input matrices of the three language datasets share the same dimensionality, their RRE values are also very close. In contrast, CIFAR-100 exhibits a relatively larger RRE due to its smaller input size, which is consistent with our theoretical
3
Original
Original
Masked
Masked
Recovered
Recovered
(a) η = 0.5
(b) η = 1
Original
Original
Masked
Masked
Recovered
Recovered
(c) η = 10
(d) η = 100
Fig. 1. The original, masked, and recovered samples with different masking scales on the CIFAR-100 dataset.
TABLE I T HE RELATIVE RECOVERY ERRORS UNDER DIFFERENT MASKING SCALES η
protection, and such design choices require rigorous security scrutiny.
Datasets
η = 0.5
η=1
η = 10
η = 100
R EFERENCES
RTE SST-2 QNLI CIFAR-100
0.036 0.036 0.036 0.178
0.036 0.036 0.036 0.180
0.036 0.035 0.037 0.174
0.036 0.037 0.036 0.178
[1] L. K. L. Ng and S. S. M. Chow, “Sok: Cryptographic neural-network computation,” in 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023. IEEE, 2023, pp. 497–514. [Online]. Available: https://doi.org/10.1109/SP46215.2023.10179483 [2] X. Gao, S. Fu, L. Liu, Z. Liu, Y. Luo, and Y. Wang, “Euston: Efficient and user-friendly secure transformer inference with non-interactivity,” IACR Cryptol. ePrint Arch., vol. 2026, p. 46, 2026.
analysis in Section III, indicating that the attack becomes more effective as the input dimensionality increases. In Fig. 1, we present the original, masked, and recovered samples under different masking scales on the CIFAR-100 dataset. First, we observe that small masking scales fail to fully obscure the original images. Moreover, regardless of the masking scale, our attack consistently recovers the original images with high fidelity, demonstrating its effectiveness. V. C ONCLUSION In this manuscript, we have proposed a data recovery attack against the subspace leakage in Euston. Through theoretical analysis and extensive experimental evaluation, we demonstrate the effectiveness of the proposed attack. Our results indicate that, in the secure inference framework, encrypting only the low-rank representations of the original data or intermediate matrices is often insufficient to fully ensure privacy