The paper introduces ADLER, a decoding protocol that limits private-context LLM assistance over Web APIs to only public views and the final answer, preventing leakage of private content through message transcripts. A client-side leakage ledger tracks how much the answer reveals relative to a public reference process, ensuring that no configuration exposes hidden secrets. Experiments on GSM8K math problems show that ADLER can significantly improve accuracy compared to zero-leakage baselines while keeping disclosure within a controlled budget.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
The paper reports a privacy breach in a two-node split‑LLM training system where the returned gradient reveals which data rows were real, despite the system passing standard privacy checks. By exploiting the fact that decoy rows produce zero gradients, an attacker can identify real rows with 100% accuracy across multiple runs. The authors demonstrate that adding gradient clipping and noise can mitigate the leak, but the system remains vulnerable to several untested attack vectors.
arXiv:2608.29111v1 Announce Type: cross Abstract: Applications such as personalized assistance and proprietary document analysis require large language models (LLMs) to generate outputs from private...
arXiv:2602. 11510v3 Announce Type: replace Abstract: Multi-agent Large Language Model (LLM) systems create privacy risks that current output-only benchmarks cannot measure.
The paper proposes a cost‑efficient privacy enforcement method for email‑generating large language model (LLM) agents that intercepts drafts, creates an information‑release contract, rewrites the draft locally with a Gemma rewriter, and then optionally calls a final PrivacyChecker. Experiments on normal and strategically malicious prompts show that the Gemma + Checker approach reduces leakage from 11.41 % to 4.03 % and improves usable output rates, while also cutting the cost amplification of checker‑only pipelines from 1.32× to 1.02×. The results demonstrate that moving repair to a cheaper local layer can significantly lower both privacy leakage and operational cost, yet still rely on a checker for high‑risk sends.
arXiv:2608. 09867v1 Announce Type: cross Abstract: Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage.
The paper investigates privacy and integrity risks in federated fine‑tuning of a pretrained MobileNetV4 model on Quick, Draw! data. It shows that a single client update can reveal private labels, that label‑count recovery degrades with more clients, and that backdoor and label‑flipping attacks can succeed under FedAvg but are mitigated by FLTrust. The study also demonstrates a live poisoning session using Indigma’s FedMaestro orchestrator.
HE‑OFT is a cryptographically secure one‑shot federated fine‑tuning protocol that protects privacy by exchanging only one encrypted contribution and never revealing the trained model. Each client fine‑tunes a low‑rank adapter and a classifier head on a frozen public backbone, keeps the adapter, and uploads an encrypted head displacement that the server combines using multiparty CKKS without decryption. On four text classification tasks and one vision task, HE‑OFT achieves 61–79 % accuracy, retaining 85–96 % of the accuracy of a disclosed model, while a test‑time query takes 443.1–1713.1 s on one core or 56.1–255.1 s on a GPU, with level restoration reducing traffic from 1.6 GiB to 13.5 MiB.
arXiv:2609.14003v1 Announce Type: cross Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
InferPriv is a new benchmark that evaluates inferential privacy leakage in large language model (LLM) assistants. It measures whether an honest-but-curious recipient can deduce a user’s sensitive attributes from an LLM’s reply during routine tasks, a type of leakage not captured by existing direct‑leakage benchmarks. Testing five frontier models, the study finds that inferential leakage rates (16.2–25.2%) far exceed direct leakage, even when direct leakage is near zero under privacy‑aware prompts.
arXiv:2610.16778v1 Announce Type: cross Abstract: Cloud graphical user interface (GUI) agents send instructions and screenshots to remote planners, exposing personally identifiable information (PII)....
arXiv:2610.15883v1 Announce Type: cross Abstract: Text wrapped in a trigger can be made behaviorally invisible to a language model: omitted from summaries and quotations, ignored in question answerin...