PaperlayerView exact revision on arXiv

Source-linked AI summary

Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent

Yanmeng Wang, Yunxuan Li, Shilong Fan, Yuhan Zheng, Tsung-Hui Chang

arXiv:2609.32642v1cs.CRcs.AIcs.DC

TL;DR

Sensitive-value protection can leave task intent exposed, and prior work does not systematically characterize the intent components or their protection. PriCon reformulates tasks into recoverable surrogates and uses local closed-loop refinement; experiments report zero operation inference under joint protection and 100% subtask success across the three local SLMs.

  • Problem

    Existing privacy frameworks can preserve recognizable task context and operation, while task-intent components and their individual and joint protection have not been systematically characterized.

    Source: §1 · p. 2

  • Method

    PriCon protects task intent by transforming tasks through recoverable mathematical reformulation and local closed-loop refinement.

    Source: §1 · p. 2

  • Results

    Operation Hit@1 is 0% under joint protection across all local SLMs, and complete PriCon achieves 100% subtask success across all three local SLMs.

    Source: §5.2 · pp. 8–9

  • Takeaways & Limitations

    Task context can act as a side channel for operation inference, supporting transformation of context whenever the operation is protected.

    Source: §5.2 · p. 9

    PriCon is less applicable to context-tied knowledge queries and complex tasks where a reliable alternative formulation and solution mapping are difficult to find.

    Source: §6 · p. 9

Abstract

from arXiv · show

As local small language models (SLMs) increasingly collaborate with more capable cloud large language models (LLMs), a natural privacy question arises: Can a local SLM obtain cloud LLM guidance while protecting user privacy? Existing privacy-preserving SLM-LLM frameworks primarily hide sensitive values while preserving task semantics, which can still expose what the user is trying to accomplish. For example, allocating scarce medical supplies across hospitals may signal an emerging public-health emergency, while rebalancing an investment portfolio may reveal a private investment strategy, even when names and numerical values are hidden. Recent decoy-based methods further obscure task intent by hiding the real request among alternatives, but stronger protection relies on more decoys or semantic abstraction, increasing overhead or risking utility loss. More fundamentally, existing work does not systematically characterize the components of private task intent or how each should be protected. We therefore introduce task-private consultation, which characterizes task intent through two components: task context and task operation. To the best of our knowledge, this is the first systematic study of these components and their individual and joint protection in local-cloud SLM-LLM consultation. To realize this setting, we propose PriCon, an end-to-end framework that transforms the task itself through recoverable mathematical reformulation rather than hiding it among alternatives. A local closed-loop refinement mechanism further maintains privacy and recoverability throughout consultation. Experiments on 100 tasks show that PriCon reduces cloud-side task-intent inference Hit@1 to nearly 0%, versus 93-99% under sensitive-value removal and 3-30% under decoy-based protection, while preserving cloud-assisted utility.

1 INTRODUCTION

Sensitive-value removal can leave private task intent visible because the task’s context and requested operation may still be inferred. PriCon protects these components by transforming the task into a recoverable surrogate and maintaining privacy and recoverability through consultation.

1 INTRODUCTION

  • Removing sensitive values still leaves task context and operation recognizable, and task intent can reveal private activities or objectives.The examples include medical-resource allocation and investment-portfolio rebalancing.Source: §1 · pp. 1–2
  • Existing privacy-aware frameworks preserve task semantics, while decoy methods leave the real request visible and may require more decoys or abstraction.Stronger obfuscation can increase inference overhead or potentially compromise utility.Source: §1 · p. 2
  • PriCon characterizes task intent as task context and task operation, whose leakage is coupled because context can reveal the operation.Its protection targets context, operation, or both over the cloud-visible transcript.Source: §1 · pp. 2–3
  • PriCon transforms tasks through recoverable mathematical reformulation rather than hiding the true request among alternatives.Local closed-loop refinement maintains privacy and recoverability throughout consultation.Source: §1 · pp. 2–3
  • The paper evaluates cloud inference from the complete consultation transcript and reports experiments on 100 tasks.The stated evaluation targets task-intent protection while preserving cloud LLM assistance utility.Source: §1 · p. 3

2 RELATED WORK

Prior local-cloud collaboration work has emphasized capability allocation and efficiency, while privacy work has focused on limiting sensitive-data exposure. Task-intent approaches use decoys, whereas PriCon sends a recoverable surrogate instead of the original task or decoys.

2 RELATED WORK

  • Local-cloud collaboration systems primarily allocate work by capability, data locality, or cost, treating collaboration as an efficiency problem.Examples include routing by query difficulty and keeping long contexts local while delegating decomposition.Source: §2 · p. 3
  • Privacy-aware frameworks keep private context local or sanitize transmitted information but preserve task semantics that can leave context and operation recognizable.The cited approaches include sketches, suppression, rewriting, placeholders, and local differential privacy.Source: §2 · p. 3
  • Decoy-based methods obscure intent through ambiguity, but the real request remains in a cloud-visible candidate set and stronger obfuscation may add overhead or risk utility.PriCon instead replaces the original task with a recoverable surrogate through mathematical reformulation, without sending the original task or decoys.Source: §2 · p. 3

3 TASK-PRIVATE CONSULTATION

Task-private consultation formalizes what a local SLM sends to a cloud LLM and which task-intent components may need protection. It assumes trusted local components and an honest-but-curious cloud that can analyze the full transcript.

3.1 CONSULTATION SETTING AND WORKFLOW

  • The setting assumes a local SLM consults a more capable cloud LLM for tasks beyond its end-to-end reasoning capability that can be reformulated recoverably.The original task, sensitive values, correspondence, and execution remain local through a rewrite, consult, and execute workflow.Source: §3.1 · pp. 3–4
  • The SLM sends a surrogate and receives a transferable blueprint, then uses a local correspondence to map and instantiate the guidance for the original task.Sensitive values are used locally, and further assistance can be requested through surrogate-level diagnostics.Source: §3.1 · p. 4
  • Task-intent privacy is defined over the complete sequence of cloud-visible surrogate requests and responses, including diagnostic rounds.The original task, sensitive values, correspondence, and task-specific execution traces remain outside that transcript.Source: §3.1 · p. 4

3.2 TASK INTENT AND PROTECTION SCOPE

  • Task intent comprises context, the application setting and entities, and operation, the requested computation or decision, including its objective and constraints.The user or policy may designate context, operation, or both as the privacy target.Source: §3.2 · p. 4
  • Context protection, operation protection, and joint protection cover concealing context, operation, or both, respectively.Either component may disclose private information depending on the scenario.Source: §3.2 · p. 4

3.3 THREAT MODEL

  • The threat model trusts the local device and components, while the cloud follows the protocol but may analyze the transcript to infer protected intent.Compromise of the local device is outside scope.Source: §3.3 · pp. 4–5

4 PRICON: REALIZING TASK-PRIVATE CONSULTATION

PriCon constructs an intent-obscuring surrogate using mathematical and semantic rewriting, with additional reformulation when operation protection is needed. Local review, debugging, and stored experience support privacy and recoverability across consultation rounds.

4.1 INTENT-OBSCURING REWRITING

  • PriCon selects a rewriting path by protection scope, retaining a local mathematical representation and correspondence while sending a semantically rewritten surrogate to the cloud.The mathematical representation also supports identifying similar tasks for experience reuse.Source: §4.1 · p. 5, §4 · p. 5

4.1.1 CONTEXT PROTECTION

  • For context protection, PriCon abstracts domain-specific entities into a domain-neutral mathematical representation, then recasts it as a semantically distant application story.The mathematical intermediate can retain recognizable structural cues, so it is not the final cloud-facing request.Source: §4.1.1 · pp. 5–6

4.1.2 OPERATION PROTECTION AND JOINT PROTECTION

  • When operation is protected, PriCon also transforms contextual cues because they may reveal the operation even when it is not explicit.Operation-only and joint protection therefore follow the same rewriting path, though their protection scopes remain distinct.Source: §4.1.2 · p. 6
  • For operation or joint protection, PriCon changes the apparent computation through an alternative formulation before semantic rewriting.The example reformulates resource allocation as shortest-path search on layered DAGs, then presents it as network routing; the solution mapping remains recoverable.Source: §4.1.2 · p. 6

4.2 LOCAL REVIEW AND CLOSED-LOOP REFINEMENT

  • PriCon reviews values, intent cues, and recoverability before transmission, revising the surrogate if checks fail.Execution failures trigger privacy-reviewed surrogate-level debugging, and successful consultations are stored locally for reuse by mathematical-structure similarity.Source: §4.2 · p. 7

5 EXPERIMENTAL RESULTS

Across 100 benchmark tasks, PriCon’s semantic rewriting sharply reduces cloud-side task-intent inference while retaining cloud-assisted utility. The results also examine overhead, context-operation leakage, and experience reuse.

5.1 EXPERIMENTAL SETUP

  • The evaluation uses 100 tasks across 10 families, compares direct consultation, value removal, decoys, and PriCon, and measures privacy and utility at the subtask level.Three local SLMs are paired with DeepSeek-V4 Pro; retained tasks are those local models cannot reliably solve end-to-end.Source: §5.1 · pp. 7–8, Table 1 · p. 8

5.2 MAIN RESULTS

  • 0% Hit@1 for all three inference targets under joint protection, while semantic rewriting also reduces context Hit@1 to 0% across all three local SLMs.Math-only leaves some inference under joint protection and yields 1–3% context Hit@1; Table 2 reports task-averaged Hit@1 / Hit@5 over 100 tasks.Source: §5.2 · p. 8, Table 2 · p. 8
  • 100% subtask success across all three local SLMs with PriCon’s semantic rewriting, matching direct cloud consultation.The reported utility is task-averaged across 100 benchmark tasks.Source: §5.2 · p. 8, Table 3 · p. 8
  • 5.6–7.2 consultation rounds and 1.96–2.52M LLM tokens for PriCon with semantic rewriting, versus 35.9–39.8 rounds and 11.4–12.7M tokens for 20 decoys.The comparison accompanies the reported result that PriCon provides stronger task-intent protection at much lower overhead than heavy decoy-based obfuscation.Source: §5.2 · pp. 8–9, Table 4 · p. 9
  • 2–3% operation Hit@1 under operation-only protection falls to 0% across all local SLMs with joint protection, consistent with context acting as a side channel.Table 5 reports Hit@1 / Hit@5 for operation-only and joint protection.Source: §5.2 · p. 9, Table 5 · p. 9
  • As experience similarity increases, token usage and consultation rounds generally decrease; below approximately 0.55 similarity, retrieved experiences may increase token usage.The authors suggest a similarity threshold around 0.6; some tasks with low original overhead show little reduction in rounds.Source: §5.2 · p. 9, Figure 5 · p. 9

6 DISCUSSION

PriCon is best suited to tasks whose context can be separated from the operation needed for cloud reasoning, but some task types and transformations remain outside its practical scope.

6 DISCUSSION

  • PriCon is less applicable when answers depend inherently on task context, such as medication-use queries, which may instead use a local knowledge base.For complex tasks, finding an alternative formulation with a reliable solution mapping can also be difficult; a richer experience bank may expand this boundary.Source: §6 · p. 9
  • As local SLMs become more capable, task-private consultation is expected to shift toward harder reasoning, planning, and decision tasks that still benefit from cloud guidance.The paper suggests advances in local and cloud models may enable more complex transformations and extend this frontier.Source: §6 · p. 9
  • The work focuses on text-based consultation; extending PriCon to images, audio, and other modalities may require modality-specific transformations that preserve reasoning-relevant information.The paper identifies multimodal local-cloud collaboration as a direction for extending task-private consultation.Source: §6 · p. 9

APPENDICES

The appendix gives detailed examples of PriCon transforming the medical-supply task into a semantic surrogate and mapping cloud guidance back to the original task.

APPENDICES

  • The appendix traces the medical-supply example through intermediate mathematical representations, semantic rewriting, representative cloud guidance, and local execution.It presents the transformation and recovery correspondences for the example.Source: A LOCAL CORRESPONDENCES FOR THE… · p. 11

A.1 CONTEXT PROTECTION

PriCon preserves solution-relevant structure in local mathematical representations, then rewrites tasks so cloud guidance can be mapped back locally. For operation protection, it changes the apparent computation before semantic rewriting.

A.1 CONTEXT PROTECTION

  • For context protection, PriCon keeps concrete values local while preserving allocation structure in an intermediate representation, then rewrites the task as GPU allocation for cloud guidance.The cloud reasons over GPU resources and training jobs; local correspondences map its guidance back to hospitals and medical supplies.Source: §A.1 · p. 11

A.2 OPERATION AND JOINT PROTECTION

  • For operation and joint protection, PriCon converts allocation into a layered-DAG shortest-path problem, rewrites it as network routing, and maps the returned route back to an allocation.Paths encode feasible allocations, and the local SLM recovers allocation values from state increments.Source: §A.2 · pp. 12–13

B ADDITIONAL CASE STUDY: FROM LOGIC-GRID REASONING TO RECIPE PLANNING

  • The additional logic-grid case study represents reasoning structure mathematically and, for operation protection, transforms it into layered state-transition planning before rewriting it as recipe planning.The example demonstrates the rewriting process for a multi-stage logic-grid task.Source: B ADDITIONAL CASE STUDY: FROM… · p. 13

B.1 ORIGINAL TASK

The case study begins with a four-stage logic-grid task, then transforms its constraint structure into a different context and, for operation protection, into layered path planning. Local mappings preserve a route back to the original solution.

B.1 ORIGINAL TASK

  • The original task asks for assignments of five people to distinct floors, pets, and occupations under six clues, followed by staged inference and a final answer.The final stage requests the five tuples, clue verification, and the engineer’s pet.Source: §B.1 · pp. 13–14

B.2 CONTEXT PROTECTION

  • For context protection, PriCon abstracts entities, ordered positions, attributes, and categories while preserving assignment and constraint relations, then rewrites the task as a group-of-friends activity.A local correspondence maps returned reasoning back to the original entities and assignments.Source: §B.2 · pp. 14–15

B.3 OPERATION PROTECTION AND JOINT PROTECTION

  • For operation protection, PriCon represents feasible partial assignments as states and valid extensions as transitions in a layered graph, then rewrites path planning as cooking-procedure planning.The local mapping recovers the original logic-grid solution from the returned procedure.Source: §B.3 · pp. 15–17

C EXPERIENCE RETRIEVAL DETAILS

PriCon retrieves prior rewriting experiences by comparing tasks through an intermediate mathematical representation, then reuses validated rewrites when a sufficiently similar experience is available.

C EXPERIENCE RETRIEVAL DETAILS

  • PriCon represents tasks with four fields—problem type, decision variables, objective, and constraints—to retrieve reusable solution structure.The intermediate representation reduces dependence on surface-level domain descriptions.Source: C EXPERIENCE RETRIEVAL DETAILS · p. 17
  • For medical-supply allocation, the representation captures constrained resource allocation, discrete allocation decisions, weighted shortage minimization, and demand and capacity constraints.The four structural fields also make formulations easier to match when their expressions differ but their optimizers are the same under the same constraints.Source: C EXPERIENCE RETRIEVAL DETAILS · p. 17
  • Overall structural similarity averages field-wise embedding cosine similarities, favoring tasks similar across all four fields.The comparison is described as simple and interpretable.Source: C EXPERIENCE RETRIEVAL DETAILS · p. 17
  • PriCon ranks prior tasks by similarity, retrieves the top-K experiences, and reuses a sufficiently similar experience’s validated rewriting trajectory and correspondence to initialize a new task.The four-field representation, embedding computation, retrieval, and storage occur locally.Source: C EXPERIENCE RETRIEVAL DETAILS · p. 17

D TASK SCREENING PROCEDURE

The screening procedure retains tasks that three local SLMs cannot complete end-to-end, yielding a 100-task benchmark with ten instances per task family.

D TASK SCREENING PROCEDURE

  • Each candidate is evaluated independently without cloud consultation, PriCon, or the local experience bank.The evaluation uses GPT-4o-mini, DeepSeek-V4-Flash, and Qwen3.5-Flash.Source: D TASK SCREENING PROCEDURE · p. 17
  • Screening counts context-length failure, timeout, reasoning failure, and execution error, with failure modes allowed to differ across local SLMs.Execution errors include failed execution or syntactically invalid output.Source: D TASK SCREENING PROCEDURE · p. 18
  • The benchmark contains 100 tasks, retaining 10 instances from each task family only when all three local SLMs fail end-to-end.The models are GPT-4o-mini, DeepSeek-V4-Flash, and Qwen3.5-Flash.Source: D TASK SCREENING PROCEDURE · pp. 17–18

E CATEGORY RESULTS

Task-family results show near-zero task-intent inference with PriCon and semantic rewriting, while direct consultation and sensitive-value removal remain near-perfect and decoys reduce inference partially.

E CATEGORY RESULTS

  • Near-zero task-intent inference under PriCon with semantic rewriting holds consistently across individual task families.The per-family trends complement the aggregated results in Table 2.Source: E CATEGORY RESULTS · p. 18
  • Across task families, direct consultation and sensitive-value removal yield near-perfect inference, while the decoy baseline produces a partial reduction.The passage reports these trends as consistent with the aggregated results in Table 2.Source: E CATEGORY RESULTS · p. 18
  • Tables 6–8 report task-family-wise task-intent inference Hit@1 and Hit@5 for GPT-4o-mini, DeepSeek-V4-Flash, and Qwen3.5-Flash as the local SLM.Source: Table 6 · p. 18, Table 7 · p. 19, Table 8 · p. 19
Loading 2609.32642v1…