{"id":"https://openalex.org/W7164841543","doi":"https://doi.org/10.48550/arxiv.2606.14210","title":"From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models","display_name":"From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models","publication_year":2026,"publication_date":"2026-06-12","ids":{"openalex":"https://openalex.org/W7164841543","doi":"https://doi.org/10.48550/arxiv.2606.14210"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.14210","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14210","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.14210","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101256946","display_name":"Zixuan Gu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gu, Zixuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101655873","display_name":"Xiaojun Ye","orcid":"https://orcid.org/0000-0002-9780-4827"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ye, Xiaojun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138683550","display_name":"Yang Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5317000150680542,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5317000150680542,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.21140000224113464,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0421999990940094,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/initialization","display_name":"Initialization","score":0.7350999712944031},{"id":"https://openalex.org/keywords/inversion","display_name":"Inversion (geology)","score":0.5813000202178955},{"id":"https://openalex.org/keywords/information-leakage","display_name":"Information leakage","score":0.4984999895095825},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4472000002861023},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.36469998955726624},{"id":"https://openalex.org/keywords/private-information-retrieval","display_name":"Private information retrieval","score":0.364300012588501},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.3197999894618988},{"id":"https://openalex.org/keywords/leakage","display_name":"Leakage (economics)","score":0.3027999997138977}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7384999990463257},{"id":"https://openalex.org/C114466953","wikidata":"https://www.wikidata.org/wiki/Q6034165","display_name":"Initialization","level":2,"score":0.7350999712944031},{"id":"https://openalex.org/C1893757","wikidata":"https://www.wikidata.org/wiki/Q3653001","display_name":"Inversion (geology)","level":3,"score":0.5813000202178955},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.4984999895095825},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4472000002861023},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4124999940395355},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.36469998955726624},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.364300012588501},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3361999988555908},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32429999113082886},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.3197999894618988},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C3020402766","wikidata":"https://www.wikidata.org/wiki/Q104376712","display_name":"Prior information","level":2,"score":0.2879999876022339},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.28220000863075256},{"id":"https://openalex.org/C160920958","wikidata":"https://www.wikidata.org/wiki/Q7662746","display_name":"Synthetic data","level":2,"score":0.2806999981403351},{"id":"https://openalex.org/C152139883","wikidata":"https://www.wikidata.org/wiki/Q252973","display_name":"Mutual information","level":2,"score":0.2782999873161316},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2689000070095062},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C2776135515","wikidata":"https://www.wikidata.org/wiki/Q17143721","display_name":"Regularization (linguistics)","level":2,"score":0.25949999690055847},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.2581000030040741}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.14210","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14210","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.14210","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.14210","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6538071036338806,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,183],"(LLMs)":[3],"are":[4],"increasingly":[5],"deployed":[6],"in":[7,115],"privacy-sensitive":[8],"domains,":[9],"where":[10],"users":[11],"must":[12],"balance":[13],"the":[14,23,71,145],"risk":[15],"of":[16,27,59,91],"data":[17],"exposure":[18],"through":[19,77],"external":[20],"APIs":[21],"against":[22,189],"high":[24],"computational":[25],"cost":[26],"local":[28,46,157],"deployment.":[29],"Split":[30],"learning":[31],"has":[32],"therefore":[33],"emerged":[34],"as":[35],"a":[36,102,123,166],"promising":[37],"paradigm":[38],"for":[39,73],"LLM":[40],"fine-tuning":[41],"and":[42,112,160,182,191],"inference":[43],"under":[44],"limited":[45],"resources.":[47],"However,":[48],"it":[49],"introduces":[50],"new":[51],"privacy":[52,169],"risks.":[53],"Prior":[54],"work":[55],"primarily":[56],"studies":[57],"leakage":[58,76],"private":[60,109],"input":[61,110],"prompts,":[62],"typically":[63],"via":[64],"inversion":[65,125,134,194],"attacks":[66],"on":[67,174],"intermediate":[68],"representations,":[69],"while":[70],"potential":[72],"sensitive":[74],"information":[75,162],"generative":[78],"response":[79],"outputs":[80],"remains":[81],"largely":[82],"unexplored.":[83],"In":[84],"this":[85],"work,":[86],"we":[87,142],"unveil":[88],"novel":[89],"vulnerabilities":[90],"Split-LLM":[92,116],"by":[93],"presenting":[94],"Patched":[95],"Model":[96],"Inversion":[97],"with":[98,122,148,171],"Dual-Sided":[99],"Initialization":[100],"(PIDI),":[101],"two-stage":[103],"attack":[104],"that":[105,185],"simultaneously":[106],"targets":[107],"both":[108,140],"prompts":[111],"output":[113],"responses":[114],"settings.":[117],"It":[118],"combines":[119],"dual-sided":[120],"initialization":[121],"patched":[124],"strategy":[126,159],"to":[127,164],"tackle":[128],"long":[129],"sequences,":[130],"substantially":[131],"outperforming":[132],"prior":[133],"methods.":[135],"To":[136],"counter":[137],"threats":[138],"from":[139],"sides,":[141],"further":[143],"propose":[144],"Adapter-based":[146],"DualGuard":[147],"Mutual":[149],"Information":[150],"Defense":[151],"(ADMI),":[152],"which":[153],"integrates":[154],"an":[155],"adapter-based":[156],"warmup":[158],"mutual":[161],"regularization":[163],"provide":[165],"strong":[167],"empirical":[168],"protection":[170],"minimal":[172],"impact":[173],"task":[175],"performance.":[176],"Extensive":[177],"experiments":[178],"across":[179],"diverse":[180],"tasks":[181],"demonstrate":[184],"ADMI":[186],"effectively":[187],"defends":[188],"PIDI":[190],"other":[192],"state-of-the-art":[193],"attacks.":[195],"Our":[196],"code":[197],"is":[198],"publicly":[199],"available":[200],"at":[201],"https://github.com/FLAIR-THU/VFLAIR-LLM.":[202]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-16T00:00:00"}