Returned Gradient Nullifies Decoys in Split-LLM Training

The decisive result is not that decoys can be recognized in activation content; it is that a privacy evaluation which passed while keeping the loss private missed the gradient returned to the Untrusted Cloud Node. In every measured frame across nine seeds, the zero-gradient rows marked decoys and all real rows were identifiable, 4,096 of 4,096 per run, even though forward-channel privacy and quality checks passed. The study thereby shifts the threat model from the forward activation frame to the backward gradient tensor returned by the trusted node.¹

Context

In the described two-node split-LLM system, the Trusted Local Node sends protected activations to the cloud, the cloud returns its output, and the local node, holding the private loss, returns an output gradient. The cloud's view is a frame mixing real rows with decoys; the loss ignores decoys, so the returned gradients of decoy rows are exactly zero. The pattern of zeros is therefore a frame-aligned real-row indicator. The paper reports that a direct attack on the frame contents recovered only about one extra token per hundred over a constant-guess baseline, while shuffled-label controls recovered nothing, suggesting the gradient marker is the practically effective leak.¹

Assessment

The paper's protocol is unusually explicit for a systems-security case study: an injected leak at known strength demonstrates that the instrument detects a real leak, a shuffled-label control shows it does not report absent leaks, and thresholds were fixed before the runs. The second set of runs repeats the result in a configuration that keeps model quality within budget, so the failure is not confined to an impractical setting. The stated mitigation, clipping and noising each row of the gradient, closes the measured leak for roughly 0.01 nats of held-out cross-entropy; whether that cost is acceptable depends on the intended privacy guarantee, which the paper does not claim to provide.¹

Caveats

AI hypothesisThis source is an unreviewed preprint page; full model and dataset details are not present in the provided block, so independent replication remains open. The authors explicitly state that five classes of attack, including attacks that accumulate observations across training steps, were never measured. Positive evidence in those unmeasured settings, or a configuration in which the returned gradient is not decoy-aligned, would change the practical takeaway. As it stands, the reported runs establish one concrete gradient-pattern disclosure, not the broader safety or unsafety of split-LLM training.¹