PaperlayerView exact revision on arXiv

Source-linked AI summary

Auditing and Mitigating Privacy Leakage in Cloud-Edge Collaborative Decoding

Kejia Zhang, Tianyuan Zou, Zixuan GU, Yang Liu

arXiv:2608.29111v1cs.CRcs.AI

TL;DR

Cloud-edge collaborative decoding keeps private data on the edge but may expose it through signals observed by a cloud LLM. The paper evaluates this risk with DECODELEAK and proposes COVEIL, which adaptively optimizes signals during decoding. Experiments show substantial undefended leakage and improved privacy-utility trade-offs, while evaluation scope remains limited by shared tokenizers and a prompt-based inversion attacker.

  • Problem

    Cloud-edge collaborative decoding may leak private context through probability-level and token-level signals, while systematic analysis of these risks remains limited.

  • Method

    The paper introduces DECODELEAK to evaluate leakage and COVEIL to optimize each cloud-observed signal at decoding time under a utility-privacy objective.

  • Results

    Undefended cloud-side fusion reaches 56.6% Token-ER@100 and 41.1% inversion ROUGE-1 Recall, while edge-side fusion reaches 43.0% and 39.2%, respectively.

  • Takeaways & Limitations

    Per-step utility-aware signal selection reduces private evidence leakage while preserving task utility in both fusion modes.

  • Takeaways & Limitations

    The evaluation uses shared-tokenizer model pairs and a prompt-based inversion attacker; stronger inversion strategies may change measured reconstruction quality.

Abstract

from arXiv · show

Applications such as personalized assistance and proprietary document analysis require large language models (LLMs) to generate outputs from private data. Yet powerful LLMs typically cannot be deployed on the resource-constrained devices where private data resides, and uploading private data to cloud-hosted LLMs exposes sensitive information. Recent work addresses this tension with a cloud-edge collaborative decoding paradigm, where private data are kept on the edge with a small language model (SLM) producing next-token distributions, which are fused with predictions from a cloud LLM operating solely on public data. In this paper, we systematically analyze the privacy risks of such a paradigm with a novel evaluation framework using constructed QA datasets, which show that such collaboration can expose substantial private-context information. To address such privacy leakage, we propose CoVeil, a defense mechanism which dynamically optimizes transmitted signals to suppress leakage during decoding time while preserving the collaborative quality. Extensive evaluations demonstrate that CoVeil consistently improves the privacy-utility trade-off over existing baselines by reducing data leakage by up to 87.2%, with minimal accuracy loss.

1 Introduction

Cloud-edge collaborative decoding keeps private context on the edge while sharing decoding signals with a cloud LLM, but both probability- and token-level signals can leak private information. The paper introduces DECODELEAK to measure this risk and COVEIL to adaptively reduce leakage while preserving utility.

  • Cloud-edge collaborative decoding combines an edge SLM retaining private context with a cloud LLM operating on public data through fused next-token distributions.
  • Both probability-level and token-level signals present distinct privacy risks, but systematic analysis of these risks has been largely absent.
  • DECODELEAK evaluates private evidence exposure and private-context inversion using QA benchmarks with public queries, private contexts, and annotated sensitive spans.
  • COVEIL dynamically optimizes cloud-observed signals at decoding time under a utility-privacy trade-off without additional model training.
  • Per-step utility-aware signal selection reduces private evidence leakage while preserving task utility across the collaborative decoding process.

2 Problem Setup and Threat Model

Cloud-edge collaborative decoding shares information between a cloud LLM and an edge SLM while keeping private context on the edge. The fusion location determines whether the cloud observes probability-level or token-level signals, which an honest-but-curious cloud may use to infer private context.

  • Cloud-Edge Collaborative Decoding: The cloud LLM and edge SLM produce next-token distributions over a shared vocabulary, which are fused by weighted interpolation at each decoding step.
  • Fusion Modes: The cloud-observed signal is the uploaded SLM probability distribution in cloud-side fusion and the synchronized token in edge-side fusion.
  • Fusion Modes: Cloud-side fusion uploads edge SLM probabilities to the cloud, whereas edge-side fusion sends the cloud distribution to the edge and synchronizes the sampled token.
  • Threat Model: The threat model treats the cloud LLM as honest-but-curious: it follows the protocol while attempting to infer private context from its observations.

3 DECODELEAK

DECODELEAK defines annotated private evidence and evaluates cloud-observed signals in two stages: evidence recall from top-K token sets, followed by private-context inversion. Results show substantial leakage through both token exposure and text reconstruction.

  • Private Evidence and Benchmark: DECODELEAK separates public queries, private edge contexts, and annotated evidence spans needed to answer the query but absent from it.
  • Private Evidence and Benchmark: MEDPRIV and COMMPRIV each contain 1,000 multiple-choice QA instances pairing public questions with private supporting passages.
  • Private Evidence Recall: Private evidence recall measures the fraction of annotated evidence exposed by cloud-observed top-K token sets, with the exposure sequence supporting later inversion.
  • Private Evidence Recall: At K = 100, Token-ER reaches approximately 60% with uploaded SLM probabilities and 50% with synchronized tokens across both fusion modes and datasets.
  • Private Context Inversion: Private context inversion reconstructs the private context from the public query and per-step exposure sequence, evaluated with ROUGE-1 Recall.
  • Private Context Inversion: ROUGE-1 Recall reaches 41.1% under cloud-side fusion and 39.2% under edge-side fusion, demonstrating leakage at both exposure and reconstruction levels.

4 COVEIL: Privacy-Aware Fusion

COVEIL is a privacy-aware defense that optimizes cloud-observed decoding signals at each step, balancing decoding utility against privacy cost in both fusion modes. It adaptively selects uploaded probability signals or synchronized tokens while retaining the full SLM distribution on the edge.

  • Stepwise Privacy-Utility Optimization: COVEIL optimizes cloud-observed decoding signals at decoding time by balancing utility against privacy cost with a trade-off parameter.The signal, utility, and privacy-cost definitions depend on the fusion mode.
  • Cloud-Side Fusion Defense: In cloud-side fusion, COVEIL adaptively uploads selected SLM next-token probability–ID pairs instead of exposing the full distribution.Upload decisions are restricted to candidate tokens, while the full SLM distribution remains on the edge.
  • Cloud-Side Fusion Defense: The cloud-side utility function rewards upload masks that preserve the unmasked fused distribution’s top-token choice by increasing its margin over competing candidates.The per-step utility is computed as average margin gain relative to the zero-upload baseline and requires no labeled data or external supervision.
  • Cloud-Side Fusion Defense: COVEIL estimates privacy cost from edge–cloud distribution discrepancies and uses a first-order objective gradient to identify probability uploads that improve the utility–privacy objective.Under the linear approximation, negative marginal objective change indicates an improving upload, while nonnegative change indicates no improvement.
  • Edge-Side Fusion Defense: In edge-side fusion, COVEIL selects a candidate token for synchronization rather than an upload mask, then minimizes the corresponding per-step objective.Its privacy function uses signed edge–cloud support differences: positive values indicate higher leakage risk, while negative values indicate lower leakage risk.

5 Experiments

Experiments evaluate privacy leakage and utility across cloud-side and edge-side collaborative decoding, then test COVEIL’s adaptive defenses and sensitivity to privacy weighting. COVEIL reduces leakage while largely preserving accuracy, with stronger gains in cloud-side fusion.

  • Experimental Setup: The experiments use Qwen2.5-72B/1.5B and Llama-3.1-70B/Llama-3.2-3B cloud-edge settings, with MEDPRIV and COMMPRIV evaluated by leakage and answer accuracy.Leakage metrics include private evidence recall and private context inversion.
  • Main Results: 56.6% cloud-side and 43.0% edge-side Token-ER@100 show that undefended collaboration exposes private evidence through observed decoding signals.Cloud-side and edge-side inversion ROUGE-1 Recall reach 41.1% and 39.2%, respectively.
  • Cloud-Side Fusion Defense: 75.7% and 87.2% reductions in cloud-side Token-ER@100 on MEDPRIV and COMMPRIV occur with at most 0.2 percentage-point accuracy loss.At approximately 59% accuracy, COVEIL reaches 13.4% Token-ER@100 versus 28.3% for CoGenesis and 24.4% for DP-Fusion.
  • Edge-Side Fusion Defense: COVEIL reduces edge-side Token-ER@100 from 43.0% to 40.4% on MEDPRIV and from 36.6% to 35.5% on COMMPRIV.At matched leakage, COVEIL achieves 7.2% higher accuracy than InvisibleInk through utility-aware token selection.

6 Related Work

Related work establishes the utility benefits and privacy risks of cloud-edge decoding while distinguishing this paper’s per-step signal-exposure analysis from prior single-model privacy studies. Existing defenses use sparsification, noise, calibration, sanitization, or public-anchor sampling.

  • Collaborative Decoding: Cloud-edge collaborative decoding keeps private context on the edge while exposing uploaded SLM probabilities or synchronized tokens to the cloud.Earlier large-small model collaboration generally assumes both models share the same input context.
  • Privacy Attacks: Prior privacy attacks recover hidden inputs through output inversion, prompt extraction, or probability analysis, often using supervised public-data training or white-box gradients.These studies generally target single-model inference rather than public/private cloud-edge decoding.
  • This Work: DECODELEAK measures private evidence recall and private context inversion from the per-step signals observed by the cloud.This directly addresses the cloud-edge collaborative decoding setting left unexamined by prior studies.
  • Existing Defenses: Existing defenses sparsify or perturb uploaded distributions and sanitize, calibrate, or publicly anchor synchronized-token sampling.The approaches cover both probability-level and token-level exposed signals.

7 Conclusion

The conclusion frames cloud-observed decoding signals as privacy-sensitive interfaces in collaborative decoding. DECODELEAK exposes the risk, while COVEIL improves the privacy-utility trade-off through per-step decisions in both fusion modes.

  • Conclusion: Cloud-edge collaboration can expose private evidence and enable private context inversion even when private context remains on the edge.DECODELEAK supports this analysis with two QA benchmarks.
  • Conclusion: COVEIL makes per-step upload and synchronization decisions under a utility-privacy objective and improves the privacy-utility trade-off in both fusion modes.The conclusion identifies cloud-observed decoding signals as privacy-sensitive interfaces.

Limitations

The evaluation is limited to same-family cloud-edge model pairs with shared tokenizers, and private-context inversion is assessed with a simple prompt-based attacker rather than optimized or trained inversion systems.

  • The experiments use cloud-edge model pairs from the same model family with a shared tokenizer vocabulary.Extending the framework to heterogeneous tokenizers would require explicit tokenizer or probability alignment before fusion and is left for future work.
  • Private context inversion uses a prompt-based attacker supplied with the public query and accumulated signal exposure sets.The study does not systematically optimize inversion prompts or train a separate inversion model.
  • Stronger inversion strategies may affect the measured reconstruction quality.

A.1.1 Base Model Setup

The experiments use two cloud-edge model pairs from the Qwen and LLaMA families, with the smaller model conditioning on public and private inputs while the larger model uses public inputs and the shared prefix.

  • The study evaluates Qwen2.5-1.5B with Qwen2.5-72B and Llama-3.2-3B with Llama-3.1-70B-Instruct.In each pair, the smaller model is deployed on the edge and the larger model on the cloud.
  • The edge model conditions on the public query and private context, whereas the cloud model conditions on the public query and shared generated prefix.
  • Each model pair uses the same tokenizer vocabulary within its model family.

A.1.2 Collaborative Decoding Setup

The experiments evaluate collaborative decoding and COVEIL across fusion modes, model families, datasets, privacy weights, candidate sizes, and multiple privacy and utility metrics. Results show that collaboration improves accuracy but exposes private evidence, while COVEIL reduces leakage with mode-dependent utility trade-offs.

  • Utility gains: Cloud-edge collaboration improves MEDPRIV accuracy from 44.5 to 59.6, a gain of 15.1 points over the stronger single-model setting.
  • Utility gains: On COMMPRIV, collaboration increases accuracy from 55.9 to 70.8, indicating that private context contains answer-critical information.
  • Robustness and sensitivity: The results remain consistent across Token-ER, Span-ER, ROUGE1-ER, and AUC, and larger upload candidate sets are stable once K ≥50.
  • Privacy-utility trade-off: Increasing λ on MEDPRIV lowers cloud-side Token-ER@100 from 0.1374 to 0.0582 while accuracy falls from 59.4 to 51.9.For edge-side fusion, Token-ER@100 falls from 0.4301 to 0.2560 while accuracy drops from 59.3 to 20.2.
  • LLaMA results: LLaMA collaboration improves MEDPRIV accuracy from 50.1 to 66.4 and COMMPRIV accuracy from 65.9 to 85.3, while undefended fusion still exposes substantial private evidence.On MEDPRIV, cloud-side fusion reaches 68.5 Token-ER@100 and edge-side fusion reaches 58.8.
Loading 2608.29111v1…