ADLER limits cloud LLM messages to the public view and answer
Original title: Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger
Speculative decoding sent a planted secret in rejected drafts; audited ADLER runs did not expose it beyond the answer.
The paper studies collaborative decoding in which a private document stays on the client while a cloud LLM sees only an approved public view. It reports that speculative decoding with private drafts omitted a planted secret from answers but sent the code to the cloud in rejected drafts. ADLER restricts every cloud message to the public view and the answer the user sees, and a client-side leakage ledger bounds additional disclosure. On masked GSM8K problems, unlimited-budget ADLER raised small-client accuracy while budgets of 16 nats or less stayed near the cloud-only baseline.
Unconfirmed: The secret exposure was shown in the authors’ planted-secret audit, not in a reported production incident.
- A 0.5B client rose from 0.41 to 0.83 exact-match accuracy; a 1.5B client from 0.67 to 0.85.
- Uploading the full problem reached 0.92, and a zero-leakage program baseline scored 0.69.
- ADLER beat that baseline by 0.14 and 0.16 for the two clients.
- No audited ADLER configuration exposed the planted secret beyond the answer.
From the original article
1 min read at arxiv.orgWeb assistants increasingly answer questions about a user's private documents by pairing a small on-device model with a cloud LLM behind a Web API. In collaborative decoding, the document stays on the client, and the cloud receives only a public view that the user approves, such as the question alone, but the two models exchange messages while the answer is generated.
By Liang Yuan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.