LLM-Attacker standardizes privacy tests for split language models
Original title: The LLM-Attacker: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM Systems
In a GPT-2 test, returned gradients raised token recovery from 94.20% to 97.38% and exact-document recovery from 13.71% to 37.77%.
Split language models keep input text on the client but send intermediate representations that can be inverted. LLM-Attacker records attacker visibility, weights, datasets and recovery measures so evaluations can be compared and extended. A defence cannot pass unless it beats a linked undefended reference, and reports flag untested attacks. A controlled GPT-2 run, shared with a companion study, checks how the evaluation reacts when gradients are added to attacker access.
Unconfirmed: The GPT-2 numbers come from one controlled experiment shared with a companion study.
- Compatible attacks reuse recorded messages; predictions are stored for independent scoring.
- The token-recovery gain’s 95% interval sat above a preset two-point threshold.
- Further studies cover corpus choice, compression defences and a published attack.
- Implementation checks are reported separately from measured attack effectiveness.
- Products
- LLM-Attacker
- AI models
- GPT-2
From the original article
1 min read at huggingface.co
Split language models keep input text on a client but send intermediate representations to a server. Attacks can reconstruct text from these messages. Comparing privacy evaluations is difficult when attackers see different messages, know different model weights or use different datasets and recovery measures.
By Georgios Politis, Evangelos Pappas · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.