The Illusion of Local Privacy: Confidentiality Boundary Failures in Consumer LLM Serving Systems
Researchers show local LLM serving systems leak prompts via memory residue, plaintext persistence, a llama.cpp tenant-isolation flaw, and timing oracles.
A study of consumer local-LLM serving systems identifies four boundaries where prompt confidentiality fails: model loading, runtime memory, wrapper persistence, and the serving interface. Using the LLAnalyzer framework across four open-weight model families and two deployment platforms, the authors recover plaintext prompts from allocator-managed memory after inference and show wrappers extend prompt lifetime. They also uncover a previously undocumented llama.cpp authorization flaw letting one authenticated client restore another tenant's saved conversation state, succeeding in 200/200 trials, plus a remote timing oracle via shared prompt-prefix caching that works over WAN.
- LLAnalyzer framework tests model loading, runtime memory, wrapper persistence, and serving boundaries separately
- Undocumented llama.cpp flaw allows cross-tenant conversation state restoration in 200/200 controlled trials
- Plaintext prompts survive in allocator memory; sanitisation reduces residue without eliminating it
- Shared prompt-prefix caching exposes a remote timing oracle distinguishable under WAN conditions
- Authors call for explicit guarantees on prompt lifetime, storage, and tenant isolation
- Vendors
- llama.cpp
- Products
- LLAnalyzer
From the original article
1 min read at arxiv.orgRunning large language models (LLMs) locally is often considered more private than cloud-hosted inference because user prompts remain on the device. We ask whether keeping inference local is, by itself, sufficient to keep those prompts confidential. Our results show that it is not: prompt confidentiality also depends on how the surrounding serving software handles prompt data before, during, and after inference.
By Youssef Hamdi Zafan Ibrahim · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.