Pith. sign in

REVIEW 4 major objections 4 minor 55 references

Learning Obfuscations Of LLM Embedding Sequences: Stained Glass Transform

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a learned stochastic transform of token embeddings gives LLM prompts information-theoretic privacy while keeping benchmark answers nearly unchanged.

desk verdict The empirical obfuscation method shows real utility and attack resistance, but the headline MI-based privacy guarantee is built on an estimator that does not compute mutual information. read the letter →

arxiv 2506.09452 v1 pith:5AFGNBD6 submitted 2025-06-11 cs.LG cs.CLcs.CRcs.ITmath.IT

Jay Roberts , Kyle Mylonakis , Sidhartha Roy , Kaan Kale This is my paper
classification cs.LGcs.CLcs.CRcs.ITmath.IT
keywords StainedGlassTransformembeddingobfuscationmutualinformationPACprivacyGaussianmixturemodelpromptreconstructionattackLLMinference
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Enterprises that want to use shared or managed LLM infrastructure currently have to send their prompts as plaintext, because no one has found a way to protect the input at inference without badly hurting the model's answers. This paper argues that protection can happen at the embedding layer instead of the token layer. It introduces the Stained Glass Transform (SGT), a learned stochastic map that adds sequence-dependent Gaussian noise to each token embedding before it leaves the client, so neither the original tokens nor an invertible embedding is transmitted. The paper's central claim is that this transform information-theoretically prevents reconstruction of the input while keeping utility close to baseline, with measured benchmark degradation of about 0.3 to 2 percentage points. If the claim holds, sensitive data could be used with shared LLM infrastructure without ever appearing in plaintext.

What carries the argument

The central object is the Affine Stained Glass Transform: for an input embedding sequence $x$, the obfuscation is $\tilde{x}=x+\mu_\theta(x)+\Sigma_\theta(x)^{1/2}u$ with $u\sim N(0,I)$, where $\mu_\theta$ and a diagonal $\Sigma_\theta$ are predicted by a transformer that sees the whole sequence. Because the transform is affine, the obfuscations of a dataset are distributed as a Gaussian mixture model, which lets the authors write the mutual information as mixture entropy minus conditional Gaussian entropy and approximate it with the minibatch Monte Carlo estimator in their Algorithm 1. That estimator is simultaneously the training loss and the basis for the reported PAC-privacy bounds.

What would settle it

Train a reconstruction decoder on a large set of (original prompt, SGT obfuscation) pairs drawn from the same distribution, or run a language-aware search with the true noise model, and measure whether token- or PII-level recovery succeeds at a rate far above the paper's PAC-Adv bound. Alternatively, recompute the mutual information with a tighter estimator on a held-out set and check whether it is much larger than the training-time estimate; either result would falsify the information-theoretic privacy claim.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a parametric, sequence-conditioned obfuscation of embeddings can be trained against a frozen LLM so that the obfuscated embeddings remain useful to the model while the mutual information between clean and obfuscated inputs is driven down. The authors show that affine SGTs turn a dataset of obfuscations into a Gaussian mixture model, derive a minibatch Monte Carlo surrogate for the mixture entropy, and combine it with absolute-cosine and median-norm penalties. In their experiments the full loss keeps utility within 1.97 percentage points on a 1B model and within 0.5 percentage points on three large models, resists nearest-neighbor and language-aware reconstruction for the large majority of tokens, and yields finite PAC-style reconstruction bounds, with the smallest reported feature-level bound at 12.69%.

Load-bearing premise

The load-bearing premise is that the minibatch Monte Carlo estimate of mutual information, which is also the training objective, accurately measures how much a real attacker could reconstruct from the obfuscated embeddings; if that estimate is biased, the reported privacy bounds do not actually guarantee privacy.

Editorial extensions

If this is right

  • A client can send obfuscated embeddings to a shared or managed LLM server and receive answers without the server seeing plaintext tokens or invertible token embeddings.
  • Benchmark utility stays within a couple of percentage points of the unmodified model, and within half a point on large 70B-class models, so the obfuscation is compatible with production-scale inference.
  • Training with a mutual-information term is the only tested way to obtain finite PAC-style reconstruction bounds; purely geometric losses such as cosine penalties can defeat nearest neighbor attacks while still leaking private information.
  • The same SGT training recipe applies across model architectures and sizes without modifying the target LLM's weights.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the SGT is an affine map on a continuous vector space, the same mechanism could extend to other frozen models with continuous inputs, such as vision transformers or retrieval encoders, although the paper only tests text LLMs.
  • The training-time Monte Carlo estimate of mutual information is doing double duty as loss and as privacy certificate; a deployment-grade claim would need a held-out estimator or an adversary-aware reconstruction benchmark to confirm the reported PAC-Adv numbers.
  • The paper's own results show that a cosine-only loss can have enormous estimated mutual information yet still achieve very low PII recovery, which suggests the MI number and real text-level privacy are not measuring the same thing; practical deployments should rely on reconstruction attacks as the primary check.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes the Stained Glass Transform (SGT), a learned, stochastic, sequence-dependent transformation of LLM token embeddings designed so that a client can send obfuscated embeddings to a server while preserving the utility of a frozen target LLM. The training objective combines a utility loss on the logits of the frozen model with an obfuscation loss that includes a mutual-information term derived from a Gaussian-mixture characterization of the obfuscated distribution, an absolute cosine penalty, and a median-norm penalty. The authors report benchmark utility drops of roughly 0.3 to 2 percentage points for models such as Llama-3.3-70B and Qwen3-32B, together with reconstruction-attack failure rates and PAC-derived privacy bounds. The central claim is that the SGT 'information theoretically provides privacy' to the LLM input.

Significance. If the central claim were fully supported, the paper would make a valuable contribution to privacy-preserving LLM inference: it demonstrates that learned embedding obfuscation can preserve utility on large models, and it evaluates privacy with a broader set of attacks (NN, MRP, BeamClean, PII recovery) than many prior works. The large-scale experiments across multiple model families and the explicit negative results for constant-noise obfuscation are useful empirical contributions. However, the headline information-theoretic privacy guarantee rests on a mutual-information estimator that is not the quantity the paper claims it is, and the reported PAC-Adv bounds inherit that flaw. The empirical attack results are informative, but they do not by themselves establish the claimed information-theoretic guarantee. The paper is therefore a strong empirical proposal whose theoretical framing needs substantial correction.

major comments (4)
  1. [§5.2, Algorithm 1 and Eq. (7)] Algorithm 1 computes, for each independently drawn pair, the value -log G(\tilde x_1; x_2) and averages these values. This estimates E_{z~\tilde X} E_{X'}[-log G(z;X')], whereas Eq. (7) requires E_{z~\tilde X}[-log E_X[G(z;X)]]. Because -log is convex, E_{X'}[-log G(z;X')] >= -log E_{X'}[G(z;X')] for each z, so the computed quantity is a systematically larger functional of the distributions, namely an upper bound on the GMM entropy rather than an estimate of it. Consequently, the values labeled 'MI' in Tables 1-3 and the 'PAC-Adv' column in Section 6.4 are not estimates of the mutual information invoked in the abstract. The authors should either replace the estimator with a consistent one (e.g., average the component densities before taking the log) or explicitly prove and label the current quantity as a conservative upper bound, with appropriate confidence intervals, and state what guarantee it does and does not provide.
  2. [Proposition 5.1 and Eq. (8)] The derivation and interpretation of Eq. (8) are not correct. Since the two batches are i.i.d., the expected value of log(|\Sigma_i^{-1} \Sigma_{\ell'}|) over the batch-pair distribution is zero; this term cannot, as claimed in Section 5.2, 'encourage the covariances to be more similar to one another.' In expectation, the loss reduces to an average Mahalanobis distance between obfuscations and independent mixture components, which is not the mutual-information loss described in the text. The statement that 'terms constant in \theta have been dropped' is also incorrect: both the log-determinant terms and the quadratic terms depend on \theta. The proposition and the surrounding explanation need to be re-derived with explicit indexing and expectations.
  3. [§6.4, Table 1] The PAC-Adv column is computed by inverting Eq. (4) using the miscalibrated MI estimates from Algorithm 1, and no standard errors or confidence intervals are reported. A PAC-style privacy claim requires a rigorous upper bound that holds with high probability over the evaluation sample; the manuscript does not provide one. The table also exposes an internal inconsistency: the AbsCos row reports an enormous MI value (6 x 10^9) with PAC-Adv capped at 100%, while Table 3 shows that AbsCos has the lowest PII recovery (roughly 1.6 against both NN and BeamClean). The reported MI is therefore not tracking the operational privacy risk. This discrepancy must be resolved or explicitly explained before the information-theoretic privacy claim can be accepted.
  4. [§6.4 and abstract] The reported MI and PAC-Adv are feature-level quantities, but the abstract and introduction claim protection of the LLM's input prompt and its token embeddings. Feature-level mutual information does not upper-bound the mutual information of the full embedding vector: dependencies across features can carry information even when each marginal is well obfuscated. The authors should either present the metric explicitly as a per-feature guarantee and adjust the abstract accordingly, or compute a bound for the full token-level or prompt-level representation. As written, the feature-level PAC bound does not support the statement that the SGT 'information theoretically provides privacy to the input of the LLM.'
minor comments (4)
  1. [§5.3, Eq. (12)] Equation (12) writes L_CGE as log(-|\Sigma|^{-1}), which is undefined because |\Sigma| > 0. Presumably the intended expression is -log|\Sigma| or log|\Sigma^{-1}|; please correct this.
  2. [§3, Corollary 3.4] In Corollary 3.4, the notation introduces 'Y' without definition; it should be '\tilde X' throughout.
  3. [§5, first paragraph] The sentence 'We then use Corollary 3.4 to derive a mon' is truncated and incomplete; the derivation of the mutual-information loss needs to be restated completely.
  4. [Throughout] There are several typographical issues: 'the the' in the proof of Proposition 3.3, 'preceeding' in Section 5, 'agaisnt' in Section 7.2, and duplicate '[16], [16]' in the references. These should be cleaned up.

Circularity Check

1 steps flagged · score 5.0 of 10

The headline MI/PAC-Adv privacy numbers are restatements of the training loss; attack-based results are independent but do not rescue the information-theoretic claim.

  1. fitted input called prediction [Section 5.2 (Algorithm 1, Eq. 8), Section 5.3 (Eq. 11), Section 6.4, Table 1]
    "Additionally, we report the mutual information (MI) of our models approximated via a Monte-Carlo approximation on the testing dataset. ... By choosing an a-priori reconstruction success rate, 1−δ0, one can invert Equation (4) to obtain an explicit bound on the reconstruction probability δ. We report these bounds (PAC-Adv) in Table 1."

    The MI reported in Table 1 is computed with the same minibatch Monte Carlo estimator used as the obfuscation loss component L^MI_O (Algorithm 1 / Eq. 8), which is part of the total training loss L_O = α1 L^MI_O + α2 L^ACS_O + α3 L^MNP_O (Eq. 11). PAC-Adv is then obtained by inverting Eq. (4) using this same MI value. Therefore the headline 'information theoretic privacy' numbers are deterministic functions of the training objective: reporting a low PAC-Adv is equivalent to reporting that L^MI_O was minimized, not an independent measurement that the obfuscation conceals the prompt. The AbsCos row in Table 1 (MI ≈ 6×10^9, yet the strongest PII protection in Table 3) confirms that this MI estimate is not the operative privacy signal.

full rationale

The central circularity is that the reported mutual information and the PAC-Adv bounds derived from it are computed by the same estimator that the paper trains against. Algorithm 1's line 7, 'H += −log G(\tilde x_1; x_2)', is both the minibatch Monte Carlo 'MI' loss and the quantity reported as MI in Table 1; the PAC-Adv column is then just an algebraic inversion of Eq. (4) applied to that loss value. This makes the information-theoretic guarantee largely a restatement of the training objective rather than an external check. Independently, the Jensen gap means the estimator does not equal the mutual information in Eq. (7), further weakening the derivation, but that is a correctness issue compounding the circularity rather than a separate reduction. The attack-based evaluations (NN-FR, MRP-FR, SymTTR, PII-Ratio) are not part of the loss and do provide external empirical evidence of obfuscation strength. The BeamClean self-citation [38] is used as an attack benchmark, so it is not load-bearing for the derivation. On balance, the empirical attack results keep the paper from being entirely circular, but the headline information-theoretic privacy claim is partially self-referential, warranting a score of 5 rather than 0.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim depends on the accuracy of the MI estimate, the external PAC bound, and the hand-chosen loss weights. None of these are independently verified beyond the paper's own experiments.

free parameters (4)
  • Loss weights alpha_1, alpha_2, alpha_3 in Eq (11) = Not reported in paper
    The combined obfuscation loss is a weighted sum of MI, AbsCos, and Median Norm Penalty. The weights are chosen by hand and not specified, yet they control the privacy-utility tradeoff.
  • Target norm T in Eq (10) = Median of embedding norms in the target model's embedding table
    The median norm penalty uses T as a target; this is a fitted value from the embedding table, not derived.
  • SGT architecture hyperparameters (depth, width, attention heads) = Not reported
    The sequence-dependent mean and variance estimators are modeled as transformers; their architecture is not specified, affecting reproducibility.
  • A-priori success rate 1/N in PAC-Adv = 1/|V| where |V| is vocab size
    The inversion of Eq (4) assumes the a-priori reconstruction success is 1/N, an idealization.
assumptions (4)
  • domain assumption PAC-Privacy bound Delta_KL <= MI(X;X~) from [28]
    The privacy guarantee rests on this external theorem, applied here to a learned mechanism without verifying its conditions beyond the citation.
  • ad hoc to paper The minibatch Monte Carlo estimator in Algorithm 1 approximates the true MI of the GMM
    Used both as training loss and evaluation metric; no proof of unbiasedness or error bounds is given.
  • domain assumption Knowledge of clean token embeddings is equivalent to knowledge of text
    Stated in Section 2.1; justifies why protecting embeddings is sufficient for protecting text.
  • domain assumption Empirical dataset distribution P_X is the uniform distribution over the training examples
    Corollary 3.4 uses omega_i = P_X(x_i); in practice the empirical distribution is used.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning Obfuscations Of LLM Embedding Sequences: Stained Glass Transform." pith.science (2026). https://pith.science/paper/5AFGNBD6

@misc{pith2026250609452,
  author       = {Pith},
  title        = {Pith review of: Learning Obfuscations Of LLM Embedding Sequences: Stained Glass Transform},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5AFGNBD6}},
  note         = {Machine review of arXiv:2506.09452}
}
read the original abstract

The high cost of ownership of AI compute infrastructure and challenges of robust serving of large language models (LLMs) has led to a surge in managed Model-as-a-service deployments. Even when enterprises choose on-premises deployments, the compute infrastructure is typically shared across many teams in order to maximize the return on investment. In both scenarios the deployed models operate only on plaintext data, and so enterprise data owners must allow their data to appear in plaintext on a shared or multi-tenant compute infrastructure. This results in data owners with private or sensitive data being hesitant or restricted in what data they use with these types of deployments. In this work we introduce the Stained Glass Transform, a learned, stochastic, and sequence dependent transformation of the word embeddings of an LLM which information theoretically provides privacy to the input of the LLM while preserving the utility of model. We theoretically connect a particular class of Stained Glass Transforms to the theory of mutual information of Gaussian Mixture Models. We then calculate a-postiori privacy estimates, based on mutual information, and verify the privacy and utility of instances of transformed embeddings through token level metrics of privacy and standard LLM performance benchmarks.

Figures

Figures reproduced from arXiv: 2506.09452 by the authors.

Figure 1
Figure 1. Client input is sent as plaintext (top) and intercepted by an [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. A high-level diagram of inference, (a), and training, (b), for SGT models with sequence and learnable-parameters notation suppressed for ease of reading. Subfigure (a): During inference the input sequence, x, is used to generate a mean, µ(x), and a covariance matrix, Σ(x). These define a multivariate Gaussian, N , which is sampled from and added to the input to produce its obfuscations x˜. The obfuscation is then fe… view at source ↗
Figure 3
Figure 3. A histogram of reconstruction rank of obfuscations from an SGT [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Constant noise (Gaussian ) Utility (left, blue) and nearest [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 31 canonical work pages

  1. [1]

    Large language models for code completion: A systematic literature review,

    R. A. Husein, H. Aburajouh, and C. Catal, “Large language models for code completion: A systematic literature review,” Computer Standards & Interfaces, vol. 92, p. 103917, 2025. [Online]. Available: https://www.sciencedirect.com/science/article/ pii/S0920548924000862

    work page 2025

  2. [2]

    Retrieval-augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschel, S. Riedel, and D. Kiela, “Retrieval-augmented generation for knowledge-intensive nlp tasks,” inProceedings of the 34th International Conference on Neural Information Processing Systems, ser. NIPS ’20. Red Hook, NY , USA: Curran Associat...

    work page 2020

  3. [3]

    Privacy regularization: Joint privacy-utility optimization in language models,

    F. Mireshghallah, H. A. Inan, M. Hasegawa, V . R ¨uhle, T. Berg- Kirkpatrick, and R. Sim, “Privacy regularization: Joint privacy-utility optimization in language models,” 2021. [Online]. Available: https://arxiv.org/abs/2103.07567

    arXiv 2021

  4. [5]

    Privacy protection of textual attributes through a semantic-based masking method,

    S. Mart ´ınez, D. S ´anchez, A. Valls, and M. Batet, “Privacy protection of textual attributes through a semantic-based masking method,” Information Fusion, vol. 13, no. 4, pp. 304–314, 2012, information Fusion in the Context of Data Privacy. [Online]. Available: https: //www.sciencedirect.com/science/article/pii/S1566253511000157

    work page 2012

  5. [6]

    Recovering from privacy-preserving masking with large language models,

    A. Vats, Z. Liu, P. Su, D. Paul, Y . Ma, Y . Pang, Z. Ahmed, and O. Kalinli, “Recovering from privacy-preserving masking with large language models,” inICASSP 2024 - 2024 IEEE International Con- ference on Acoustics, Speech and Signal Processing (ICASSP), 2024, pp. 10 771–10 775

    work page 2024

  6. [7]

    How to keep text private? a systematic review of deep learning methods for privacy-preserving natural language processing,

    S. Sousa and R. Kern, “How to keep text private? a systematic review of deep learning methods for privacy-preserving natural language processing,”Artif. Intell. Rev., vol. 56, no. 2, p. 1427–1492, May 2022. [Online]. Available: https://doi.org/10.1007/ s10462-022-10204-6

    work page 2022

  7. [8]

    Text embeddings reveal (almost) as much as text,

    J. X. Morris, V . Kuleshov, V . Shmatikov, and A. M. Rush, “Text embeddings reveal (almost) as much as text,” 2023. [Online]. Available: https://arxiv.org/abs/2310.06816

    arXiv 2023

  8. [9]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” in Proceedings of the 31st International Conference on Neural Informa- tion Processing Systems, ser. NIPS’17. Red Hook, NY , USA: Curran Associates Inc., 2017, p. 6000–6010

    2017

Show all 55 references
  1. [10]

    Improving language understanding by generative pre-training,

    A. Radford and K. Narasimhan, “Improving language understanding by generative pre-training,” 2018. [Online]. Available: https: //api.semanticscholar.org/CorpusID:49313245

    2018

  2. [11]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised multitask learners,”

  3. [12]

    Pri- vacy agents: Utilizing large language models to safeguard contextual integrity in elderly care,

    R. Grabler, M. Hirschmanner, H. A. Frijns, and S. T. Koeszegi, “Pri- vacy agents: Utilizing large language models to safeguard contextual integrity in elderly care,”parameters, vol. 4, no. 28, p. 37, 2024

    2024

  4. [13]

    On protecting the data privacy of large language models (llms) and llm agents: A literature review,

    B. Yan, K. Li, M. Xu, Y . Dong, Y . Zhang, Z. Ren, and X. Cheng, “On protecting the data privacy of large language models (llms) and llm agents: A literature review,”High- Confidence Computing, p. 100300, 2025. [Online]. Available: https: //www.sciencedirect.com/science/articl...

    2025

  5. [14]

    Reducing privacy risks in online self-disclosures with language models,

    Y . Dou, I. Krsek, T. Naous, A. Kabra, S. Das, A. Ritter, and W. Xu, “Reducing privacy risks in online self-disclosures with language models,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L.-W. Ku, A. Martin...

    2024

  6. [15]

    BottleSum: Unsupervised and self-supervised sentence summarization using the information bottleneck principle,

    P. West, A. Holtzman, J. Buys, and Y . Choi, “BottleSum: Unsupervised and self-supervised sentence summarization using the information bottleneck principle,” inProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Join...

    2019

  7. [16]

    Split-and-denoise: protect large language model inference with local differential privacy,

    P. Mai, R. Yan, Z. Huang, Y . Yang, and Y . Pang, “Split-and-denoise: protect large language model inference with local differential privacy,” inProceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024

    2024

  8. [17]

    SCIPER: Secure Collaborative Inference via Privacy-Enhancing Regularization ,

    V . Prodomo, R. Gonzalez, and M. Gramaglia, “ SCIPER: Secure Collaborative Inference via Privacy-Enhancing Regularization ,” IEEE Transactions on Privacy, vol. 1, no. 01, pp. 57–68, Jan. 2024. [Online]. Available: https://doi.ieeecomputersociety.org/10.1109/TP. 2024.3513254

    2024

  9. [18]

    A split-and-privatize framework for large language model fine-tuning,

    X. Shen, Y . Liu, H. Liu, J. Hong, B. Duan, Z. Huang, Y . Mao, Y . Wu, and D. Wu, “A split-and-privatize framework for large language model fine-tuning,” 2023. [Online]. Available: https://arxiv.org/abs/2312.15603

    2023 arXiv

  10. [19]

    Split learning for health: Distributed deep learning without sharing raw patient data,

    P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,” 2018. [Online]. Available: https://arxiv.org/abs/1812.00564

    2018 arXiv

  11. [20]

    Split learning in computer vision for semantic segmentation delay minimization,

    N. G. Evgenidis, N. A. Mitsiou, S. A. Tegos, P. D. Diamantoulakis, and G. K. Karagiannidis, “Split learning in computer vision for semantic segmentation delay minimization,” 2024. [Online]. Available: https://arxiv.org/abs/2412.14272

    2024 arXiv

  12. [21]

    Privacy-preserving split learning for large-scaled vision pre-training,

    Z. Wang, G. Yang, H. Dai, and C. Rong, “Privacy-preserving split learning for large-scaled vision pre-training,”IEEE Transactions on Information Forensics and Security, vol. 18, pp. 1539–1553, 2023

    2023

  13. [22]

    Not all features are equal: Discovering essential features for preserving prediction privacy,

    F. Mireshghallah, M. Taram, A. Jalali, A. T. T. Elthakeb, D. Tullsen, and H. Esmaeilzadeh, “Not all features are equal: Discovering essential features for preserving prediction privacy,” inProceedings of the Web Conference 2021, ser. WWW ’21. New York, NY , USA: Association fo...

    2021

  14. [23]

    NoPeek: Information leakage reduction to share activations in distributed deep learning ,

    P. Vepakomma, A. Singh, O. Gupta, and R. Raskar, “ NoPeek: Information leakage reduction to share activations in distributed deep learning ,” in2020 International Conference on Data Mining Workshops (ICDMW). Los Alamitos, CA, USA: IEEE Computer Society, Nov. 2020, pp. 933–942....

    2020

  15. [24]

    Reimagining mutual information for enhanced defense against data leakage in collaborative inference,

    L. Duan, J. Sun, J. Jia, Y . Chen, and M. Gorlatova, “Reimagining mutual information for enhanced defense against data leakage in collaborative inference,”Advances in Neural Information Processing Systems, vol. 37, pp. 44 479–44 500, 2024

    2024

  16. [25]

    Split-and-denoise: Protect large language model inference with local differential pri- vacy,

    P. Mai, R. Yan, Z. Huang, Y . Yang, and Y . Pang, “Split-and-denoise: Protect large language model inference with local differential pri- vacy,”arXiv preprint arXiv:2310.09130, 2023

    2023 arXiv

  17. [26]

    From the information bottleneck to the privacy funnel,

    A. Makhdoumi, S. Salamatian, N. Fawaz, and M. M ´edard, “From the information bottleneck to the privacy funnel,” in2014 IEEE Information Theory Workshop (ITW 2014), 2014, pp. 501–505

    2014

  18. [28]

    Formal privacy proof of data encoding: The possibility and impossibility of learnable encryption,

    H. Xiao, G. E. Suh, and S. Devadas, “Formal privacy proof of data encoding: The possibility and impossibility of learnable encryption,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1834–1848

    2024

  19. [29]

    PAC-private algorithms,

    M. Sridhar, H. Xiao, and S. Devadas, “PAC-private algorithms,”

  20. [30]

    On entropy approximation for gaussian mixture random vectors,

    M. F. Huber, T. Bailey, H. Durrant-Whyte, and U. D. Hanebeck, “On entropy approximation for gaussian mixture random vectors,” in2008 IEEE International Conference on Multisensor Fusion and Integration for Intelligent Systems. IEEE, 2008, pp. 181–188

    2008

  21. [31]

    Gaussian mixtures: entropy and geometric inequalities,

    A. Eskenazis, P. Nayar, and T. Tkocz, “Gaussian mixtures: entropy and geometric inequalities,”The Annals of Probability, vol. 46, no. 5, pp. 2908–2945, 2018

    2018

  22. [32]

    Estimating mixture entropy with pairwise distances,

    A. Kolchinsky and B. D. Tracey, “Estimating mixture entropy with pairwise distances,”Entropy, vol. 19, no. 7, p. 361, 2017

    2017

  23. [33]

    Gradient-based manipulation of nonparametric en- tropy estimates,

    N. Schraudolph, “Gradient-based manipulation of nonparametric en- tropy estimates,” pp. 828–837, 2004

    2004

  24. [34]

    Fast kernel entropy estimation and optimization,

    S. Shwartz, M. Zibulevsky, and Y . Y . Schechner, “Fast kernel entropy estimation and optimization,”Signal Processing, vol. 85, no. 5, pp. 1045–1058, 2005, information Theoretic Signal Processing. [Online]. Available: https://www.sciencedirect.com/science/article/ pii/S0165168...

    2005

  25. [35]

    Empirical entropy manipulation for real-world problems,

    P. Viola, N. Schraudolph, and T. Sejnowski, “Empirical entropy manipulation for real-world problems,” vol. 8, 03 1998

    1998

  26. [36]

    No free lunch theorem for privacy-preserving llm inference,

    X. Zhang, Y . Pang, Y . Kang, W. Chen, L. Fan, H. Jin, and Q. Yang, “No free lunch theorem for privacy-preserving llm inference,”Artificial Intelligence, vol. 341, p. 104293, 2025. [Online]. Available: https://www.sciencedirect.com/science/article/ pii/S0004370225000128

    2025

  27. [37]

    Privacy-preserving prompt tuning for large language model services,

    Y . Li, Z. Tan, and Y . Liu, “Privacy-preserving prompt tuning for large language model services,”arXiv preprint arXiv:2305.06212, 2023

    2023

  28. [38]

    Beamclean: Language aware embedding reconstruction,

    K. Kale, K. Mylonakis, J. Roberts, and S. Roy, “Beamclean: Language aware embedding reconstruction,” 2025. [Online]. Available: https://arxiv.org/abs/2505.13758

    2025 arXiv

  29. [39]

    The llama 3 herd of models,

    Z. M. Aaron Grattafiori, “The llama 3 herd of models,” 2024. [Online]. Available: https://arxiv.org/abs/2407.21783

    2024 arXiv

  30. [40]

    Openorca: An open dataset of gpt augmented flan reasoning traces,

    W. Lian, B. Goodson, E. Pentland, A. Cook, C. V ong, and ”Teknium”, “Openorca: An open dataset of gpt augmented flan reasoning traces,” https://https://huggingface.co/datasets/Open-Orca/OpenOrca, 2023

    2023

  31. [41]

    Orca: Progressive learning from complex explanation traces of gpt-4,

    S. Mukherjee, A. Mitra, G. Jawahar, S. Agarwal, H. Palangi, and A. Awadallah, “Orca: Progressive learning from complex explanation traces of gpt-4,” 2023. [Online]. Available: https: //arxiv.org/abs/2306.02707

    2023 arXiv

  32. [42]

    Stanford alpaca: An instruction- following llama model,

    R. Taori, I. Gulrajani, T. Zhang, Y . Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto, “Stanford alpaca: An instruction- following llama model,” https://github.com/tatsu-lab/stanford alpaca, 2023

    2023

  33. [43]

    Think you have solved question answering? try arc, the AI2 reasoning challenge,

    P. Clark, I. Cowhey, O. Etzioni, T. Khot, A. Sabharwal, C. Schoenick, and O. Tafjord, “Think you have solved question answering? try arc, the AI2 reasoning challenge,”CoRR, vol. abs/1803.05457, 2018. [Online]. Available: http://arxiv.org/abs/1803.05457

    2018 arXiv

  34. [44]

    Can a suit of armor conduct electricity? a new dataset for open book question answering,

    T. Mihaylov, P. Clark, T. Khot, and A. Sabharwal, “Can a suit of armor conduct electricity? a new dataset for open book question answering,” inEMNLP, 2018

    2018

  35. [45]

    Phrase-indexed question answering: A new challenge for scalable document comprehension,

    M. Seo, T. Kwiatkowski, A. P. Parikh, A. Farhadi, and H. Hajishirzi, “Phrase-indexed question answering: A new challenge for scalable document comprehension,” inEMNLP, 2018

    2018

  36. [47]

    Measuring massive multitask language understanding,

    D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt, “Measuring massive multitask language understanding,” CoRR, vol. abs/2009.03300, 2020. [Online]. Available: https: //arxiv.org/abs/2009.03300

    2009 arXiv

  37. [48]

    Hel- laswag: Can a machine really finish your sentence?

    R. Zellers, A. Holtzman, Y . Bisk, A. Farhadi, and Y . Choi, “Hel- laswag: Can a machine really finish your sentence?” inProceedings of the 57th Annual Meeting of the Association for Computational Linguistics, 2019

    2019

  38. [49]

    Pa- pillon: Privacy preservation from internet-based and local language model ensembles,

    L. Siyan, V . C. Raghuram, O. Khattab, J. Hirschberg, and Z. Yu, “Pa- pillon: Privacy preservation from internet-based and local language model ensembles,”arXiv preprint arXiv:2410.17127, 2024

    2024 arXiv

  39. [50]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” inTheory of Cryptography, S. Halevi and T. Rabin, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 265–284

    2006

  40. [51]

    The algorithmic foundations of differential privacy,

    C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,”Found. Trends Theor. Comput. Sci., vol. 9, no. 3–4, p. 211–407, Aug. 2014. [Online]. Available: https://doi.org/10.1561/ 0400000042

    2014

  41. [52]

    Qwen3 technical report,

    Q. Team, “Qwen3 technical report,” 2025. [Online]. Available: https://arxiv.org/abs/2505.09388

    2025 arXiv

  42. [53]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,

    DeepSeek-AI, “Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,” 2025. [Online]. Available: https://arxiv.org/abs/2501.12948

    2025 arXiv

  43. [54]

    Torchtitan: One-stop pytorch native solution for production ready LLM pretraining,

    W. Liang, T. Liu, L. Wright, W. Constable, A. Gu, C.-C. Huang, I. Zhang, W. Feng, H. Huang, J. Wang, S. Purandare, G. Nadathur, and S. Idreos, “Torchtitan: One-stop pytorch native solution for production ready LLM pretraining,” inThe Thirteenth International Conference on Lear...

    2025

  44. [2016]

    Available: http://arxiv.org/abs/1612.00410

    [Online]. Available: http://arxiv.org/abs/1612.00410

    arXiv

  45. [2019]

    Available: https://api.semanticscholar.org/CorpusID: 160025533

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 160025533

  46. [2021]

    Available: https://arxiv.org/abs/2109.07958

    [Online]. Available: https://arxiv.org/abs/2109.07958

    arXiv

  47. [2024]

    Available: https://eprint.iacr.org/2024/718

    [Online]. Available: https://eprint.iacr.org/2024/718

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.