Isolation Through Orthonormal Rotation Holds

Abstract

Per-tenant orthonormal rotation applied to attention K-vectors provides cryptographic isolation between tenants sharing a single language model instance. Within a tenant, rotation is an isometry — retrieval quality is preserved exactly. Across tenants, a wrong-key query returns coherent but incorrect results, with no recovery of the target tenant's content. This paper presents a falsification-first empirical evaluation of that primitive across four model architectures (Qwen 2.5 3B, Gemma 2 2B, DeepSeek V2 Lite, Mamba 130M) and two architecture classes (attention-based and state-space). For attention models, isolation is validated layer-by-layer under pre-registered gates with a measured cost of 0.54% of revival time. For Mamba, rotation commutes with live input-dependent dynamics at machine precision — 8.88e-15 over 32 steps — placing the mechanism in the geometry rather than in any property specific to attention. The primitive ran without reformulation on Apple Silicon under MLX, on H100 bare metal, and inside an Azure confidential GPU under vLLM. A scaling ladder validates isolation through one thousand sequential tenants on one device, with six deliberately mis-keyed tenants producing no content recovery and no contamination of adjacent tenants. The methodology documents twelve metric recalibrations encountered during validation, nine evidenced by committed artifacts, as an independently useful contribution for researchers validating keyed primitives inside trained neural networks. The adversary's observable set is stated explicitly: the validated model is open-weight, rotation preserves inner products so an observer of stored state can recover the Gram matrix, and key destruction removes retrievability against a query-only adversary but does not constitute erasure against an adversary with storage access. Version 5, August 2026. Retitled from "1000 Tenants, One Model, One MacBook". Corrects the concurrent framing of tenant-scaling results, rebuilds the Gemma portability row, corrects the recalibration count, and adds attribution caveats to the portability section.