PaperlayerView exact revision on arXiv

Source-linked AI summary

Learning to Refer: Client-Resolved Generation for Privacy-Aware Language Models

Jeongho Yoon, Chanhee Park, Yongchan Chun, Duong Tuan Thanh, Sungbin Han, Chanjun Park, Hyeonseok Moon, Heuiseok Lim

arXiv:2609.32706v1cs.CRcs.AI

TL;DR

Cloud LLMs process sensitive user inputs in plaintext, while protecting only the input pathway can leave private content exposed when it must be repeated in outputs. CRG uses pooled, perturbed representations and client-resolved references to separate server-side generation from lexical realization. Across evaluated tasks, its advantage is greatest when exact reuse matters, including improved SealTools complete-call exact match over PPFT; the authors caution that it is not a guarantee of complete semantic confidentiality.

  • Problem

    Text-free input protection alone does not address cases where successful generation requires private input content to be reproduced verbatim.

    Source: §1 · p. 2

  • Method

    CRG predicts request-local references from pooled, perturbed representations and resolves input-derived lexical content only on the client.

    Source: §1 · p. 2

  • Results

    Across medical and document-grounded QA, identifier transfer, and tool calling, CRG is particularly effective when task success depends on exact reuse; SealTools complete-call exact match rises from 57.3% to 79.9% over PPFT.

    Source: §1 · p. 2, §5 · p. 10

  • Takeaways & Limitations

    CRG offers a practical step toward output-aware privacy by reducing plaintext exposure across input and output pathways while retaining useful grounded generation.

    Source: §5 · p. 10

    CRG is intended to reduce server-visible plaintext exposure, not provide complete semantic confidentiality or an end-to-end cryptographic privacy guarantee.

    Source: ETHICS STATEMENT · p. 10

Abstract

from arXiv · show

Cloud-based large language models (LLMs) require users to disclose plaintext data to service providers, creating privacy risks in sensitive domains. Existing privacy-preserving approaches often trade utility for protection, incur substantial computational or communication overhead, remain vulnerable to reconstruction from intermediate representations, or protect only a subset of the training and inference pipeline. We introduce Client-Resolved Generation (CRG), a genera- tion interface that separates server-side generation from the lexical realization of input-derived content. The client transmits only pooled and noise-perturbed rep- resentations, while input-derived output content is represented using request-local positional references and resolved to its original strings only on the client. This interface protects private input and input-derived output content during both train- ing and inference while allowing the service provider to keep its proprietary model parameters hidden from the client. At the same time, exact lexical reuse remains possible without directly exposing the reused content on the provider-visible gen- eration path. We evaluate CRG on medical and document-grounded QA, sensi- tive identifier transfer, and tool calling, together with reconstruction and raw-logit leakage analyses. On SealTools, CRG improves complete-call exact match from 57.3% to 79.9% over the input-privacy framework PPFT, with larger gains as more required output content can be resolved through references. Together, these results show that CRG provides a practical interface for privacy-sensitive cloud LLMs by reducing plaintext exposure across both input and output pathways while preserv- ing task utility and server-side model confidentiality.

1 INTRODUCTION

Cloud LLMs expose plaintext inputs to providers, and text-free input protection alone can still leave sensitive input-derived content visible in generated outputs. CRG separates semantic generation from lexical realization, using client-resolved references to support exact reuse while evaluating privacy across representations, outputs, and logits.

Motivation

  • Cloud LLM use in sensitive domains can expose plaintext personal information to service providers, creating provider-side risks that may hinder adoption.The cited examples include healthcare and finance, where inputs can contain medical conditions and financial records.Source: §1 · p. 1
  • Input protection alone is insufficient when successful generation requires private input content to be reproduced verbatim.Medical responses, document-grounded systems, and agents may need to repeat medications, identifiers, URLs, contact information, or account fields.Source: §1 · p. 2

CRG

  • CRG emits request-local references for input-derived content and resolves them to original strings only on the client, while other response content is generated normally.The decoder infers source positions from compressed, perturbed representations without server access to plaintext source tokens.Source: §1 · p. 2

Contributions

  • CRG extends text-free inference with client-side lexical resolution, preventing referenced input content from directly appearing as plaintext on the provider-visible input or generation path.The approach retains exact lexical reuse for referenced content.Source: §1 · p. 2, Figure 1 · p. 2
  • The evaluation examines embedding-only, joint embedding-output, output-only, and raw-logit leakage to distinguish direct non-disclosure from residual recoverability.It also evaluates medical and document-grounded QA, sensitive identifier transfer, and tool calling.Source: §1 · p. 2

2 RELATED WORK

Prior work protects cloud LLM inputs through sanitization or transformed representations, but text-free interfaces do not address private lexical content that must reappear in outputs. CRG targets this complementary problem while the literature also documents reconstruction risks in continuous representations and broader output-concealment approaches.

2.1 INPUT PRIVACY FOR CLOUD-BASED LLMS

  • Input sanitization and anonymization reduce exposure of selected content but retain a textual interface to the remote model.HaS adds local anonymization and output de-anonymization, while PrivacyRestore sends incomplete plaintext with a protected auxiliary representation for restoration.Source: §2.1 · pp. 2–3

2.3 SOURCE-GROUNDED GENERATION AND OUTPUT-SIDE PRIVACY

  • CRG addresses input-grounded lexical reuse that text-free inference leaves unresolved, inferring source references from protected representations and resolving strings on the client.PPFT establishes a text-free interface; CRG adds output-side handling of private lexical content.Source: §2.1 · p. 3, §2.3 · p. 3

2.2 EMBEDDING LEAKAGE AND RECONSTRUCTION

  • Continuous representations can retain enough lexical and semantic information for reconstruction, so the absence of plaintext transmission alone does not establish privacy.The evaluation therefore considers reconstruction from transmitted representations as well as evidence in generated outputs and raw decoder distributions.Source: §2.2 · p. 3

2.3 SOURCE-GROUNDED GENERATION AND OUTPUT-SIDE PRIVACY

  • Other output-protection approaches use noisy lattices, reversible vocabulary transformations, or client-verified confidential-computing partitions, whereas CRG targets referenced strings and generates the rest normally.Referenced strings remain client-resolved; non-referenced response content is generated by the server.Source: §2.3 · p. 3

3 METHODOLOGY

CRG keeps input-derived lexical content on the client while the server generates responses from pooled continuous representations and request-local references. Its pipeline aligns the interface on public data, adapts to private data through client-side preparation, and resolves generated references at inference.

3 METHODOLOGY

  • The client transmits continuous input representations, and input-derived output content is represented with references whose lexical values are resolved only on the client.This interface is designed to reduce plaintext exposure across both input and output pathways.Source: §3 · p. 3

3.1 SYSTEM OVERVIEW

  • CRG combines a client encoder, server projection layer, and causal decoder; input-grounded output uses request-local references, while other content uses the ordinary vocabulary.The client retains the position table and resolves references after generation; lexical positions avoid dependence on differing encoder and decoder tokenizations.Source: §3.1 · p. 3

3.2 THREAT MODEL AND PRIVACY SCOPE

  • The threat model includes the network and service provider observing server-processed information, while CRG aims to keep raw inputs and reference-covered values from appearing as server-visible plaintext.The scope also keeps proprietary decoder parameters on the server; residual leakage is evaluated empirically.Source: §3.2 · p. 4

3.3 STAGE 1 REFERENCE-AWARE ALIGNMENT

  • Stage 1 jointly aligns the encoder, projection layer, and decoder on public data, training generation from pooled representations to mix ordinary tokens with input-grounded references.The target response is converted into a reference-aware form for training.Source: §3.3 · p. 5

3.4 STAGE 2: PRIVACY-AWARE DOMAIN ADAPTATION

  • Stage 2 keeps the encoder fixed on the client, which prepares noisy pooled representations and reference-converted targets before the server adapts projection and decoder parameters.The server optimizes the projection layer and decoder parameters implemented with LoRA and reference-token parameters; the stated aim is private adaptation without exposing raw training data or proprietary decoder parameters.Source: §3.4 · p. 5

3.5 INFERENCE

  • At inference, the client sends perturbed representations, the server generates a reference-aware response, and the client replaces valid references with strings from its private position table.The same resolution procedure applies to natural-language responses and structured outputs such as tool-call arguments.Source: §3.5 · pp. 5–6

4 EXPERIMENTS

The experiments evaluate CRG’s utility across medical, document-grounded, and structured generation tasks, alongside privacy attacks. CRG’s utility advantage is strongest when outputs require exact reuse of input content, while the privacy analyses examine both direct exposure and residual recovery.

4.1 EXPERIMENTAL SETUP

  • The setup evaluates medical MCQA, QA, context-grounded QA, tool use, and exact identifier reuse against PPFT and AlienLM, using each benchmark’s primary metric.Privacy attacks examine transmitted representations, unresolved outputs, and decoder logits.Source: §4.1 · p. 6, §4 · p. 6

4.2 MAIN RESULTS ON DOMAIN UTILITY

  • 50.22 vs 46.00 for PPFT: CRG has the highest privacy-preserving medical QA macro average, though PPFT remains stronger on NLICE and OQA.Noise-free CRG reaches 58.48; the perturbed ε = 75 model improves over PPFT on IDQuAD, Flashcards, and both BioASQ tasks.Source: §4.2 · pp. 6–7
  • 67.20 vs 58.03 for PPFT: CRG achieves the highest structured and agentic utility macro average, with large gains on SealTools, PIIFORM, and DOCPII.On SealTools, CRG reaches 79.92 vs 57.32 for PPFT; PPFT remains stronger on ToolACE, PolicyQA, and MultiSpanQA.Source: §4.2 · p. 7, Table 2 · p. 7
  • CRG’s relative utility advantage grows with reference coverage on SealTools and PIIFORM, especially when substantial output content is reusable from the source.Reference coverage is the fraction of gold output tokens replaceable by CRG references.Source: §4.2 · p. 7, Figure 3 · p. 7

4.3 PRIVACY ANALYSIS UNDER RECONSTRUCTION ATTACKS

  • Across four privacy attacks, input reconstruction largely reflects recurring structure, while output recovery and inference yield limited patient-specific information, with residual recovery of common symptom terms.The strongest output-only LLM attacker recovers 16.96% of symptoms, only 3.64 points above shuffled pairing; history recovery is 1.33%.Source: Table 3 · p. 8, §4.3 · pp. 8–9

4.4 PROMPT-INJECTION STRESS TEST

  • Under patient-description prompt injection, CRG limits server-visible symptom and history recovery to 0.64% and 0.25%, versus 57.72% and 62.36% for PPFT.Additional tests disable reference tokens or force plaintext reconstruction; patient-specific symptom and medical-history recovery remains near the shuffled-record baseline.Source: §4.4 · p. 9

5 CONCLUSION

The conclusion presents CRG as an extension of text-free inference that protects input-derived content on the output path through client-resolved references. Its utility advantage is greatest when tasks depend on exact reuse, and privacy analyses cover multiple server-visible channels.

5 CONCLUSION

  • CRG extends text-free inference by representing input-derived output content with request-local references resolved only on the client.The client transmits continuous input representations.Source: §5 · p. 9
  • CRG is particularly effective when task success depends on exact reuse of source content, and its relative advantage grows with reference coverage.The conclusion cites medical and document-grounded QA, sensitive identifier transfer, and tool calling.Source: §5 · p. 10
  • Across complementary observation channels, privacy analyses find that CRG reduces plaintext exposure beyond the final server output while retaining useful grounded generation.Reconstruction and inference often recover recurring structure or plausible but incorrect lexical content; plaintext is rarely highly ranked in decoder logits.Source: §5 · p. 10

AI USE STATEMENT

The authors used generative AI for language-related manuscript assistance, not for experiments or independently determining conclusions.

AI USE STATEMENT

  • Generative AI assisted with translation, language editing, and draft refinement; authors reviewed the content and take responsibility.The tools were not used to conduct experiments, generate results, or independently determine scientific conclusions.Source: AI USE STATEMENT · p. 10

ETHICS STATEMENT

The paper evaluates privacy attacks in a controlled setting using synthetic records for privacy-specific evaluations and public benchmark datasets for other experiments.

ETHICS STATEMENT

  • Privacy evaluations involving medical attributes and personal identifiers use synthetic records describing fictitious individuals; other experiments use public benchmarks.No new data were collected from human participants.Source: ETHICS STATEMENT · p. 10
  • CRG is intended to reduce server-visible plaintext exposure, not to provide complete semantic confidentiality or an end-to-end cryptographic privacy guarantee.The reconstruction and disclosure attacks are conducted solely to evaluate the mechanism in a controlled experimental setting.Source: ETHICS STATEMENT · p. 10

A LIMITATIONS

CRG’s limitations concern reference flexibility, privacy scope, model scale, retrieval quality, and evaluation breadth. Its reference interface uses client-held positional word references that restore original strings after generation.

A LIMITATIONS

  • Word-position references are most effective for content grounded explicitly in the input; span-level or semantic references could better support variation and freer generation.The position table keeps original strings on the client, which resolves references without a server-side plaintext dictionary.Source: A LIMITATIONS · p. 12, B REFERENCE CONSTRUCTION AND RESOLUTION · p. 14
  • CRG targets direct plaintext exposure, not cryptographic or semantic confidentiality; representations, non-referenced context, reference structure, and output length may reveal auxiliary information.The privacy claims are empirical and limited to the observation channels and attacks evaluated.Source: A LIMITATIONS · pp. 12–13
  • Experiments use a compact encoder–decoder, bounded token budget, and LoRA adaptation, so scaling to larger models, longer contexts, and specialized outputs remains unestablished.The authors describe these as computational choices and leave larger-scale evaluation for future work.Source: A LIMITATIONS · p. 13
  • Grounded answer quality depends on retrieval relevance and completeness; omitted evidence cannot reliably be recovered through reference generation alone.The authors distinguish this upstream retrieval limitation from an intrinsic inability of references to represent grounded answers.Source: A LIMITATIONS · p. 13
  • Evaluation covers a fixed encoder–decoder family, English inputs, and representative tasks; broader model, language, workload, and production deployment studies remain open.Production studies should examine end-to-end latency, concurrency, network variability, memory, and client-side resolution.Source: A LIMITATIONS · p. 13

B REFERENCE CONSTRUCTION AND RESOLUTION

  • References use zero-based whitespace positions, lexical matching after punctuation removal, and a deterministic first-match rule for repeated words.The client resolves valid references from its private position table, which is not transmitted to the server.Source: B REFERENCE CONSTRUCTION AND RESOLUTION · pp. 13–14

B.1 REFERENCE ADDRESSING ABLATION

Positional and unique-word addressing show similar utility on evaluated tasks. Unique-word addressing reduces the highest observed reference address while leaving reference usage nearly unchanged.

B.1 REFERENCE ADDRESSING ABLATION

  • The positional scheme assigns an address to every whitespace position; the unique-word variant reuses first-occurrence addresses for repeated normalized words.Both variants use the same Stage 2 configuration: pooling k = 2, ϵ = 75, seed 42.Source: §B.1 · p. 14
  • Table 5 reports utility under both addressing schemes on representative tool-calling, context-grounded QA, and medical QA benchmarks.The comparison tests whether reducing the address range materially changes reference-based generation behavior.Source: Table 5 · p. 14, §B.1 · p. 14
  • 11.72 versus 11.73 references per example on CORE, while unique-word addressing reduces the highest observed reference address from 320 to 176.The two schemes show similar utility across the evaluated tasks.Source: §B.1 · p. 14, Table 5 · p. 14

C THREAT MODEL AND PRIVACY SCOPE

CRG protects private content across training and inference by keeping raw inputs and the position table client-side, transmitting perturbed representations, and resolving input-derived output references only on the client. The protocol also keeps the decoder proprietary while evaluating residual leakage through multiple server-visible signals.

C THREAT MODEL AND PRIVACY SCOPE

  • During private adaptation, input-derived lexical content is represented by reference tokens in supervision, while ordinary target tokens not replaced by references remain visible to the server.Stage 1 uses public alignment data and is not treated as a privacy-sensitive training stage.Source: C THREAT MODEL AND PRIVACY SCOPE · p. 14
  • The client retains raw inputs and the private position table; the server receives perturbed representations and unresolved outputs, with referenced plaintext restored only on the client.The decoder and its parameters remain on the provider side, so the client need not access the proprietary model.Source: C THREAT MODEL AND PRIVACY SCOPE · pp. 14–15

E.1 STAGE 1 ALIGNMENT DATA

  • The Stage 1 alignment corpus combines public instruction, QA, document-grounded reasoning, and tool-use data to establish a continuous-input interface and reference-aware generation.Stage 1 trains the general interface before domain-specific adaptation.Source: §E.1 · p. 16

E.2 DATA PREPROCESSING AND FILTERING

  • Training and evaluation inputs are serialized before filtering, and examples exceeding the 512-token encoder limit are excluded rather than truncated.Retained examples reach the encoder in full; target length is handled separately.Source: §E.2 · pp. 16–17

E.3 MEDICAL STAGE 2 TRAINING DATA

  • Medical adaptation retains complete task inputs, including clinically informative context, while reference tokens encode input-derived target content and are resolved before utility scoring.The medical training set combines seven sources, and utility is evaluated on six held-out benchmarks.Source: §E.3 · p. 17, §E.4 · p. 17

E.5 AGENTIC AND CONTEXT-GROUNDED STAGE 2 TRAINING DATA

  • Non-medical adaptation uses independently trained suites for tool use, context-grounded QA, and identifier-sensitive generation, evaluated on seven corresponding benchmarks.The suites start from the final Stage 1 checkpoint rather than from another Stage 2 model.Source: §E.5 · p. 17, §E.6 · p. 18

F BASELINE DETAILS

  • PPFT shares CRG’s client/server decomposition but generates plaintext responses, whereas CRG uses references for input-derived lexical values; AlienLM instead applies a vocabulary transformation.The compared methods use the same training data and splits.Source: §F.1 · p. 18, §F.2 · p. 18, F BASELINE DETAILS · p. 18

H PRIVACY ATTACK DETAILS

  • The privacy evaluation separates input reconstruction, joint representation-output reconstruction, output-only inference, and raw-logit leakage because these attacks observe different leakage channels.Attack B combines the perturbed query representation with reference-bearing server output to reconstruct the client-resolved response.Source: H PRIVACY ATTACK DETAILS · p. 19, §H.3 · p. 20

H.4 ROBUSTNESS TO A STAGE-1-ALIGNED RECONSTRUCTION ATTACK

A privileged Stage 1-aligned reconstructor still recovers little of the full private question, although some attribute-level leakage remains. Output-only and raw-logit analyses probe additional leakage routes, with CRG showing low plaintext retention in decoder candidates.

H.4 ROBUSTNESS TO A STAGE-1-ALIGNED RECONSTRUCTION ATTACK

  • 5.16 ROUGE-L at ϵ = 75 was achieved by the Stage 1-aligned attacker, with no exact reconstruction among 1,549 questions; removing reference tokens yielded 3.92 ROUGE-L and still no exact reconstruction.The reference-token-removed attacker recovered age at 19.24% (+14.1 percentage-point lift), while lifts for sex, symptoms, and medical history remained +2.8, +0.6, and +1.0 points.Source: §H.4 · p. 21, Table 7 · p. 21

H.5 ATTACK C OUTPUT-ONLY LLM INFERENCE

  • Output-only Attack C attempts to infer hidden values from unresolved server output without the private query, representation, gold answer, or client-side position table.It uses no attacker fine-tuning.Source: §H.5 · p. 22

H.6 ATTACK D RAW-LOGIT PLAINTEXT LEAKAGE

  • 2.14% of CRG events placed protected plaintext within Top-10 candidates and 3.94% within Top-100, versus 20.88% and 47.20% for AlienLM.For sensitive symptoms, CRG rates were 0.03% and 0.20%, compared with AlienLM’s 12.07% and 34.76%.Source: §H.6 · p. 23, Table 8 · p. 23

I REFERENCE-COVERAGE ANALYSIS

The reference-coverage analysis finds that CRG’s advantage over PPFT grows as a larger share of the output is referenceable, particularly for tasks requiring input-grounded values. Qualitative reconstruction examples show that generic clinical content may be recovered while patient-specific details remain missed or substituted.

I REFERENCE-COVERAGE ANALYSIS

  • CRG’s relative advantage increases from the 20–40% to 60–80% reference-coverage bins across eight configurations, especially on SealTools and PIIFORM.The trend also appears across pooling sizes k ∈ {2, 4} and privacy settings ϵ ∈ {75, 150}.Source: I REFERENCE-COVERAGE ANALYSIS · p. 24, Table 9 · p. 24
  • As referenceable target content grows, CRG’s advantage grows; at low reference coverage, PPFT can remain competitive or outperform CRG.Coverage is computed from the input and canonical gold output, independently of either model prediction.Source: I REFERENCE-COVERAGE ANALYSIS · pp. 23–24

J.1 ATTACK A: INPUT RECONSTRUCTION

  • In qualitative Attack A examples, reconstructions preserve generic question structure or frequent symptoms but miss patient-specific histories and symptoms, sometimes substituting unrelated details.Examples include failure to recover skin lesions, deep vein thrombosis, and alcohol addiction.Source: §J.1 · p. 25

J.2 ATTACK B: JOINT REPRESENTATION–OUTPUT RECONSTRUCTION

This section examines reconstruction and inference attacks on protected CRG inputs, including reference-suppression tests of exact recovery and semantic disclosure. It also covers raw-logit and reference-suppression analyses, along with identifier-centric evaluation suites and a prompt-injection evaluation setup.

J.2 ATTACK B: JOINT REPRESENTATION–OUTPUT RECONSTRUCTION

  • A joint representation–output attack achieved ROUGE-L 72.63 in one case despite replacing both selected private-history attributes, showing that surface overlap can overstate leakage.Another case followed generic headache context but substituted migraine for cluster headaches, omitted alcohol addiction, and produced an incomplete final answer.Source: §J.2 · p. 26
  • 15.75% of 3,563 eligible example–symptom pairs were matched across 1,501 responses, with recovery highly concentrated in common symptom labels.Only seven of 36 eligible symptom types had any matches; pain accounted for 383 matches (68.27%). Excluding the five most frequent labels left 12/1,820 matches (0.66%), versus a 0.68% shuffled-output comparison.Source: §J.2 · p. 26

J.3 ATTACK C: OUTPUT-ONLY INFERENCE

  • Output-only inference preserves fluent medical explanations but substitutes plausible, unrelated histories and symptoms instead of recovering the lexical content hidden by references.Across the cases, the attacker sometimes recovered generic pain but did not recover the specific private history or symptoms; corresponding PPFT outputs exposed input-derived terms in server-visible plaintext.Source: §J.3 · pp. 27–28

J.4 ATTACK D: RAW-LOGIT LEAKAGE

  • In three selected raw-logit cases, plaintext candidates were outside CRG’s Top-100 decoder candidates, while corresponding AlienLM inverse plaintext candidates ranked within the Top-10.These cases measured the rank of a protected lexical item’s plaintext token in the raw decoder distribution; they did not reconstruct a sequence.Source: §J.4 · pp. 28–29, Table 10 · p. 29

K CONSTRUCTION OF IDENTIFIER-CENTRIC EVALUATION SUITES

  • The PII Form Filling and Document PII QA suites test extraction of input-specific annotated values, using structured fields or document-grounded questions and 30,000/500/3,000 train/development/test splits.Form Filling maps PII spans into a fixed 20-field schema; Document PII QA targets a label with one distinct value in the document and ranks document units for context. Both validate reference encoding and client-side resolution.Source: §K.1 · p. 29, §K.2 · pp. 29–30

K.3 IDENTIFIER-AWARE TOOL CALLING

  • Identifier-aware tool calling adds a matching synthetic identifier to both a user request and its target function argument, then evaluates identifier and general examples separately.Filtering reduced 241,881 prepared examples to 99,358 eligible instances; the combined training set contained 39,932 examples after overlap filtering.Source: K CONSTRUCTION OF IDENTIFIER-CENTRIC… · p. 29, §K.3 · p. 30

L PROMPT-INJECTION STRESS TEST

  • The prompt-injection stress test compares CRG with PPFT on the same medical model and DDx-Plus population at ϵ = 75, measuring literal attribute disclosure and ROUGE-L.Disclosure rates cover Age, Sex, Symptom, and History; ROUGE-L measures sequence-level lexical reconstruction, with higher values indicating greater disclosure.Source: L PROMPT-INJECTION STRESS TEST · pp. 30–31, §L.2 · p. 32

L.1 THREAT MODEL AND EXPERIMENTAL PROTOCOL

  • The DDx-Plus test used 1,549 instances, ε = 75 Laplace noise, deterministic greedy decoding, fixed model parameters, and no attacker-side fine-tuning.The same per-example perturbation was reused across conditions so that the injected instruction was the only intervention.Source: §L.1 · p. 31
  • Attacks asked the model either to reproduce the input exactly or to restate sex, age, symptoms, and medical history, using decoder-text, clean-encoder, or noisy-encoder injection.The semantic-disclosure attack treats recovery of sensitive attributes as a privacy disclosure even without verbatim reconstruction.Source: §L.1 · p. 31

L.5 REFERENCE-SUPPRESSION ATTACK

  • After all reference-token logits were disabled, symptom and medical-history recovery remained near the deranged-record baseline, and ROUGE-L stayed at or below 1.97 across six conditions.Under the strongest clean semantic-disclosure attack, symptom and history lift were +0.07 and +0.00 percentage points, respectively.Source: §L.5 · p. 36, Table 13 · p. 36
  • Paraphrasing recovered age by +10.03 points for c4a and +6.48 points for c4b, while sex recovery was much smaller and symptoms and medical history stayed near the unrelated-record baseline.These residual signals show that reference suppression does not remove every statistical signal from the protected representation, but do not provide a general plaintext reconstruction channel.Source: §L.5 · p. 36
  • Removing reference tokens did not redirect private lexical information into ordinary plaintext; recovery of patient-specific clinical content remained minimal.Training the decoder to represent input-derived content through source addresses reduces its ability to lexicalize that content directly on the provider-visible generation path.Source: §L.5 · p. 36

L.3 RESULTS

Across tested attacks, CRG keeps server-visible recovery low even when PPFT exposes input-derived attributes as plaintext. The qualitative examples show the same contrast while cautioning that selected cases do not represent average attack success.

L.3 RESULTS

  • 95.29% of patient ages, 65.07% of sex annotations, 57.72% of symptoms, and 62.36% of medical-history attributes are recovered by PPFT under c4a.Relative to ordinary inference, the increases are +80.57, +56.48, +21.93, and +40.78 percentage points, respectively; PPFT's ROUGE-L reaches 35.57.Source: §L.3 · pp. 32–33
  • Under c4a, PPFT exposes 57.72% of symptoms and 62.36% of medical-history values, while CRG exposes 0.64% and 0.25%, respectively.Across all five injected conditions, CRG age recovery is exactly 0%, sex recovery remains below 1%, symptom recovery never exceeds 1.57%, and history recovery never exceeds 0.41%.Source: §L.3 · p. 33
  • Under c4a, CRG averages 93.8 reference tokens per response, continuing to express input-derived content through references despite an instruction to avoid them.The server identifies input-derived content, but lexical realization is deferred to the client.Source: §L.3 · p. 33
  • Input perturbation weakens some attacks but does not remove PPFT's plaintext-output vulnerability.For c4b, perturbing the malicious instruction reduces symptom recovery from 57.72% to 37.30% and history recovery from 62.36% to 26.82%; substantial baseline and attack-driven exposure remains.Source: §L.3 · pp. 32–33
  • Input perturbation controls what reaches the server, while CRG's reference-generation mechanism controls how input-derived information is rendered.PPFT can express sensitive attributes as ordinary vocabulary tokens when steered; CRG instead uses source addresses resolved client-side.Source: §L.3 · p. 33

L.4 QUALITATIVE ANALYSIS OF PROMPT-INJECTION FAILURES

  • The qualitative examples are selected to illustrate behavior, not to estimate average attack success; c2 and c3 cohort symptom recovery is slightly below c0.The authors direct readers to interpret the examples together with population-level results.Source: §L.4 · pp. 33–34
  • Other examples show PPFT verbalizing patient details while CRG uses references, including under noisy encoder-side attacks.The examples include PPFT outputs exposing symptoms and history attributes despite perturbing the injected instruction.Source: §L.4 · pp. 34–35
  • Qualitative c4a examples show PPFT restating patient attributes while CRG's server-visible output uses references instead.In one example PPFT recovers age, sex, all seven annotated symptoms, and both history attributes; none of the evaluated attributes appears literally in CRG's output.Source: §L.4 · pp. 34–35

M CLIENT-SIDE RUNTIME EVALUATION

Client-side preparation remains practical on CPU and accelerator hardware, with most measured latency attributable to encoding. More restrictive reference policies trade generation flexibility for lower plaintext exposure, while small reference windows can reduce utility and increase leakage.

M CLIENT-SIDE RUNTIME EVALUATION

M.1 ALL-REFERENCE STAGE-2 SUPERVISION

  • 67.20 to 66.40: all-reference supervision modestly lowers the structured and agentic macro average, with PIIFORM and DOCPII changing by only 1.43 and 0.13 points.The cited table covers utility under all-reference Stage 2 supervision.Source: §M.1 · p. 39, Table 17 · p. 39
  • 50.22 to 40.89: the medical macro average falls under all-reference supervision, with NLICE declining from 53.08 to 18.62.IDQuAD remains comparatively stable at 84.52 versus 82.38; the limitation arises when answers require words absent from the input.Source: Table 16 · p. 38, §M.1 · p. 39
  • All-reference training raises the medical output reference share from 47.9% to 99.7%; no literal occurrences of the evaluated sensitive fields were observed on DDx-Plus.Standard CRG had literal output exposure of 0.32% for sex, 0.40% for symptoms, and 0.60% for antecedents; the restrictive policy trades expressivity for confidentiality.Source: §M.1 · p. 39

N EFFECT OF REFERENCE VOCABULARY SIZE

  • At K = 50, ToolACE EM falls from 48.30 to 42.90 and MultiSpanQA F1 from 71.85 to 65.82, while ToolACE plaintext leakage rises from 5.97% to 22.44%.K limits which source positions are addressable by references, so smaller windows also increase the possibility of plaintext exposure.Source: N EFFECT OF REFERENCE VOCABULARY SIZE · p. 40, Table 18 · p. 40
  • At K = 25 and K = 10, SealTools EM falls from 79.50 to 47.28 and 39.33, while plaintext leakage rises from 2.09% to over 60%.An undersized reference space removes the private reference path for reusable source content, increasing exposure and reducing exact-reuse capability.Source: N EFFECT OF REFERENCE VOCABULARY SIZE · p. 40, Table 18 · p. 40

Related papers

Loading 2609.32706v1…