{"id":"0fa2033c-cad2-42d6-929e-ea0537babe5a","arxiv_id":"2606.11592","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Develops an information-theoretic defense using privacy adapters and low-dimensional bottlenecks to minimize mutual information for protecting prompts in collaborative LLM inference, with claimed theoretical bounds and up to 35% attack reduction in experiments.","lead":"This paper proposes minimizing mutual information between shared activations and user prompts to defend against reconstruction attacks in edge-cloud LLM inference. A smart generalist might read it for a theoretical approach to balancing privacy with performance in distributed AI systems.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Theoretical reconstruction bounds rest on exact MI minimization that low-dim adapters likely cannot achieve in high-dimensional LLM activations","rationale":"The identified concern is identical to the reader's weakest assumption. Because the original review was abstract-only and no machine-checked proof or parameter-free derivation is reported, the gap between claimed theory and practical low-dimensional implementation remains the single load-bearing point; full-text details on the MI estimator and bound derivation would be needed to close it.","tokens_in":1738,"tokens_out":314,"duration_ms":16642,"concrete_test":"Extract the precise reconstruction-error bound (likely in the theory section) and the MI estimator used for the adapters; recompute the bound under a standard variational MI estimator on the same activation tensors; if the empirical inversion success rate exceeds the bound by more than the approximation gap when measured MI > 0.05 nats, the guarantee fails to hold.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that explicit minimization of I(activations; prompt) via privacy adapters yields the stated reconstruction-error guarantees and token-level bounds. In practice this minimization occurs in a low-dimensional bottleneck; however, mutual-information estimation for high-dimensional continuous activations is known to require strong assumptions or variational approximations whose error is not bounded in the paper's derivation. If the adapter only approximately minimizes the relevant MI (or minimizes a surrogate that misses token-level leakage), the derived error bounds on prompt inversion no longer apply, and the claimed privacy-utility tradeoff cannot be guaranteed.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes an information-theoretic defense framework against prompt inversion attacks in collaborative edge-cloud LLM inference. It learns privacy-preserving representations by minimizing mutual information between intermediate activations and input prompts via low-dimensional privacy adapters (while preserving task utility), derives theoretical guarantees on prompt reconstruction error and token-level accuracy bounds, characterizes privacy-utility-latency tradeoffs, and reports up to 35% reduction in attack success versus baselines across experiments.","tokens_in":1839,"tokens_out":580,"duration_ms":11902,"significance":"If the central claims hold, the work supplies a principled alternative to heuristic defenses by linking explicit MI minimization to reconstruction-error bounds and empirical tradeoffs. This would be significant for secure collaborative inference deployments, as it moves beyond empirical tuning toward information-theoretic characterizations. The combination of derived bounds with adapter-based implementation is a potential strength if the approximations are rigorously controlled.","major_comments":[{"comment":"§3 (theoretical guarantees): The reconstruction-error bounds and token-level accuracy claims rest on exact minimization of I(activations; prompt). The privacy adapters implement this via a low-dimensional bottleneck, but the derivation provides no error bounds or concentration results on the variational or estimator approximation to the true MI; without this, the stated guarantees do not necessarily transfer to the implemented method.","section":"§3"},{"comment":"§5 (experiments): The reported 35% attack-success reduction and privacy-utility curves are presented as validation of the framework, yet the attack models used for evaluation are not shown to match the threat model assumed in the theoretical bounds (e.g., whether the adversary has access to the same adapter parameters or only to the transmitted activations). This gap makes it impossible to assess whether the empirical gains confirm the derived bounds or merely reflect a different operating regime.","section":"§5"}],"minor_comments":[{"comment":"Notation: The definition of the privacy adapter objective (likely Eq. (X)) should explicitly state whether the MI term is the true mutual information or a variational lower/upper bound, and how the Lagrange multiplier for the utility constraint is chosen.","section":null},{"comment":"Related work: The manuscript should cite recent results on high-dimensional MI estimation error (e.g., variational bounds and their sample complexity) to contextualize the practical achievability of the claimed minimization.","section":null}],"recommendation":"major_revision","confidential_remarks":"The abstract-only review in the stress-test note correctly flags the core soundness risk; after reading the full text the same risk remains load-bearing because the derivation does not close the gap between exact MI and the low-dimensional surrogate. The paper fits the journal scope but would benefit from a clearer statement of which results are exact versus approximate."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the insightful comments, which highlight important aspects of the connection between our theoretical analysis and practical implementation. We address each major comment below.","responses":[{"response":"We agree that the stated bounds assume exact mutual information minimization. The implemented privacy adapters rely on a variational lower bound and dimensionality reduction, introducing approximation error not quantified in the current derivation. In the revision we will add a dedicated paragraph in §3 that invokes standard concentration inequalities for MI estimators (under Lipschitz and bounded-support assumptions on the activation distributions) and derives an explicit additive error term between the variational estimate and the true MI. This will state the conditions under which the reconstruction-error and token-accuracy bounds continue to hold approximately.","revision_made":"yes","referee_comment":"[§3] §3 (theoretical guarantees): The reconstruction-error bounds and token-level accuracy claims rest on exact minimization of I(activations; prompt). The privacy adapters implement this via a low-dimensional bottleneck, but the derivation provides no error bounds or concentration results on the variational or estimator approximation to the true MI; without this, the stated guarantees do not necessarily transfer to the implemented method."},{"response":"The theoretical threat model in §3 assumes the adversary receives only the post-adapter activations and has no knowledge of the adapter weights. The experiments in §5 train inversion attacks on exactly those activations, which is consistent with the stated model. We will nevertheless revise the threat-model subsection and the experimental-setup paragraph to make this assumption explicit and to discuss the stronger adversary that also knows the adapter parameters. We will also add a short note on how the reported 35 % figure would be expected to change under that stronger model.","revision_made":"partial","referee_comment":"[§5] §5 (experiments): The reported 35% attack-success reduction and privacy-utility curves are presented as validation of the framework, yet the attack models used for evaluation are not shown to match the threat model assumed in the theoretical bounds (e.g., whether the adversary has access to the same adapter parameters or only to the transmitted activations). This gap makes it impossible to assess whether the empirical gains confirm the derived bounds or merely reflect a different operating regime."}],"tokens_in":1363,"tokens_out":480,"duration_ms":21690,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main takeaway is that this work takes an information-theoretic view of protecting user prompts when offloading LLM computation to the cloud. They train low-dimensional adapters to reduce mutual information between activations and the input while trying to preserve downstream accuracy.\n\nWhat stands out as new is the specific application to collaborative edge-cloud setups and the use of these adapters as an explicit bottleneck. The abstract also mentions deriving reconstruction error bounds and token-level accuracy limits, plus experiments showing up to 35% lower attack success than prior defenses.\n\nThe experiments are the clearest positive. They test across multiple settings and report concrete tradeoffs on privacy, utility, and latency, which moves beyond pure heuristics.\n\nThe soft spot is the theory. The reconstruction guarantees rest on being able to minimize the relevant mutual information exactly. In high-dimensional LLM activations, low-dimensional adapters can only approximate this, and mutual information estimation itself usually needs strong assumptions or variational methods whose error is not obviously bounded. If that gap is not closed, the derived bounds on prompt reconstruction no longer apply. The abstract gives no derivations, so it is impossible to check whether they address the approximation issue or simply assume exact minimization.\n\nThis paper is aimed at people working on secure distributed inference for large models. A reader already thinking about privacy adapters or information bottlenecks in LLMs could pick up the experimental setup and the adapter design. Someone looking for tight, assumption-light proofs will find the current version thin.\n\nIt deserves peer review because the problem is real and the framing is worth testing in detail. The experimental claims can be checked directly, and referees can press on whether the theory actually supports the stated guarantees.","headline":"The paper frames prompt inversion defense in collaborative LLM inference as an MI minimization problem with privacy adapters, which is a reasonable step but the claimed theoretical guarantees on reconstruction error do not appear to hold up under the low-dimensional approximations required.","tokens_in":2313,"tokens_out":422,"would_cite":false,"duration_ms":14456,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"An information-theoretic approach defends collaborative LLM inference from prompt inversion by minimizing mutual information between activations and prompts.","keywords":["prompt inversion attacks","collaborative LLM inference","information-theoretic defense","mutual information minimization","privacy adapters","information bottleneck","privacy-utility tradeoff","edge-cloud inference"],"falsifier":"An experiment in which the privacy adapters produce no reduction in attack success rate relative to heuristic defenses or in which observed prompt reconstruction error exceeds the paper's theoretical bound.","tokens_in":2636,"feed_emoji":"🛡️","tokens_out":560,"duration_ms":15931,"temperature":0.7,"pith_summary":"The paper develops a defense framework for prompt inversion attacks during collaborative edge-cloud inference with large language models. It learns privacy-preserving representations by explicitly minimizing the mutual information between intermediate activations and the original input prompt. This minimization occurs while preserving task utility and respecting computational constraints. The work derives theoretical guarantees on reconstruction error and characterizes privacy-utility tradeoffs. A practical method uses low-dimensional privacy adapters as information bottlenecks, with experiments showing improved tradeoffs over prior approaches.","feed_headline":"Mutual information minimization defends LLMs from prompt inversion","feed_subtitle":"Low-dimensional adapters achieve better privacy-utility tradeoffs in collaborative inference than existing methods","key_machinery":"Low-dimensional privacy adapters that function as information bottlenecks to minimize mutual information between activations and the input prompt.","core_discovery":"By minimizing the mutual information between intermediate activations and the input prompt via low-dimensional privacy adapters implemented as information bottlenecks, the framework produces representations that limit prompt reconstruction while maintaining downstream inference utility, yielding theoretical bounds on reconstruction error and token-level accuracy along with empirical reductions in attack success.","pith_inferences":["The same mutual-information minimization could be applied to protect against other leakage risks in distributed inference pipelines.","The adapter construction might transfer to collaborative settings that use models other than LLMs.","Deployment would require checking whether the low-dimensional adapters preserve the stated tradeoffs under real network latency and hardware limits."],"forward_implications":["Theoretical guarantees on prompt reconstruction error follow directly from the mutual information minimization.","Fundamental privacy-utility tradeoffs are characterized for collaborative inference.","Token-level accuracy bounds are established for the downstream task.","The approach yields up to 35% reduction in attack success compared with existing defenses."],"fun_headline_variants":["Info theoretic defense minimizes prompt inversion in collaborative LLMs","Mutual info minimization protects against prompt inversion using adapters","Low dimensional bottlenecks limit input prompt leakage in LLM inference","Info theoretic bounds guarantee reconstruction error in collaborative setups"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Mutual information between activations and prompts can be minimized in practice via low-dimensional privacy adapters without violating computational constraints or substantially degrading downstream task utility, and the derived theoretical guarantees hold under real model architectures.","fun_headline_variants_meta":{"raw":{"variants":["Info theoretic defense minimizes prompt inversion in collaborative LLMs","Mutual info minimization protects against prompt inversion using adapters","Low dimensional bottlenecks limit input prompt leakage in LLM inference","Info theoretic bounds guarantee reconstruction error in collaborative setups"]},"model":"grok-4.3","cost_usd":0.008055,"raw_usage":{"total_tokens":3634,"prompt_tokens":609,"num_sources_used":0,"completion_tokens":59,"cost_in_usd_ticks":80549500,"prompt_tokens_details":{"text_tokens":609,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2966,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":609,"tokens_out":59,"duration_ms":14933,"temperature":1.0,"reasoning_tokens":2966,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T09:36:32.255563+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment in which the privacy adapters produce no reduction in attack success rate relative to heuristic defenses or in which observed prompt reconstruction error exceeds the paper's theoretical bound.","supporting_citations":[],"review_version":1}