The Illusion of Local Privacy: Confidentiality Boundary Failures in Consumer LLM Serving Systems
Researchers show local LLM serving systems leak prompts via memory residue, plaintext persistence, a llama.cpp tenant-isolation flaw, and timing oracles.
A study of consumer local-LLM serving systems identifies four boundaries where prompt confidentiality fails: model loading, runtime memory, wrapper persistence, and the serving interface. Using the LLAnalyzer framework across four open-weight model families and two deployment platforms, the authors recover plaintext prompts from allocator-managed memory after inference and show wrappers extend prompt lifetime. They also uncover a previously undocumented llama.cpp authorization flaw letting one authenticated client restore another tenant's saved conversation state, succeeding in 200/200 trials, plus a remote timing oracle via shared prompt-prefix caching that works over WAN.