A new systems-security case study examines a two-node split-LLM training architecture and finds that its privacy evaluation passed even though an observable channel remained untested. In this setup, a Trusted Local Node (TLN) sends protected activations to an Untrusted Cloud Node (UCN); the UCN returns its output, and the TLN, which holds the private loss, sends back the output gradient.
The frame the cloud node receives mixes real data rows with synthetic decoys, and the loss function ignores those decoys. Because the decoys contribute nothing to the loss, their gradients are exactly zero, and the resulting pattern of zeros reveals which rows were real. The researchers measured this with a protocol fixed in advance: a leak injected at known strength to confirm the instrument could detect one, a shuffled-label control to confirm it would not report absent leaks, and a threshold set before the runs.
Across nine seeds, the zero patterns identified the real rows on every frame — 4,096 of 4,096 per run. An attack on frame contents recovered roughly one extra token per hundred over a constant-guess baseline, an improvement of +0.65 to +1.50 percentage points, while the shuffled controls recovered nothing. A second set of runs repeated the result on a configuration that keeps model quality within budget, indicating the finding is not confined to an unrealistic deployment setting.
On both datasets, every such run passed the forward-channel privacy check and the quality check, yet failed that same privacy check once the returned gradient was included. Clipping and noising each row of the gradient closed the leak for about 0.01 nats of held-out cross-entropy.
The authors caution that the system is not thereby safe. Five classes of attack, including those that accumulate observations across training steps, were never measured. The study frames the underlying tension as a utility-privacy conflict: the security boundary is the network connection between the local and cloud nodes, and noise cannot be added indefinitely without harming the model's ability to learn.