Pith. sign in

REVIEW 5 major objections 4 minor 65 references

The paper argues that every major efficiency optimization used to run LLMs at the edge—quantization, pruning, partitioning, and low-rank adaptation—carries a corresponding security or privacy vulnerability, making security and efficiency in

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 06:45 UTC pith:F2FLJ6BR

load-bearing objection A useful survey-style framing of the security-efficiency tradeoff in edge LLMs, undermined by a small and internally inconsistent empirical section that should not be treated as validation. the 5 major comments →

arxiv 2607.13088 v1 pith:F2FLJ6BR submitted 2026-07-13 cs.CR cs.LG

Securing LLMs in the Wild: Privacy and Security Challenges at the Edge

Ren-Yi Huang , Mingchen Li , Dumindu Samaraweera , Morris Chang This is my paper
classification cs.CR cs.LG
keywords edge AILLM deploymentquantizationpruningmodel partitioningparameter-efficient adaptationsecurity-efficiency paradoxmembership inference
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Large language models are moving to edge and on-premise devices to escape cloud privacy and latency problems, but edge hardware cannot host them without compression. The paper tries to establish that the standard compression toolkit—quantization, pruning, partitioning, and low-rank adaptation—does not just save memory and compute; it systematically erodes safety alignment, exposes intermediate activations to reconstruction attacks, and concentrates private data in extractable adapters. It names this tension the Security-Efficiency Paradox and builds a Three-Wall Constraint Model to show when risky optimizations become unavoidable, plus a Secure Operational Efficiency Score (SOES) to pick models under hardware limits. A sympathetic reader would care because if the paradox is real, security cannot be bolted on after optimization: it has to be co-designed with efficiency from the start.

Core claim

The paper claims that the efficiency optimizations required to run LLMs at the edge are not security-neutral. Each optimization family reshapes the model's internal geometry: quantization discretizes the loss landscape and makes decision boundaries into stair-step structures, pruning fragments the sparse subnetworks that carry safety alignment, partitioning turns intermediate activations into invertible carriers of user text, and parameter-efficient adapters concentrate domain-specific data into small, extractable matrices. These changes map to specific attacks—jailbreaks and bit-flip failures under quantization, safety degradation and attention over-smoothing under pruning, input reconstruc

What carries the argument

The paper's central analytic objects are: (1) the Security-Efficiency Paradox, the claim that the same optimizations that get LLMs onto edge hardware create attack surfaces; (2) the Three-Wall Constraint Model, which quantifies the Memory Wall (weights plus KV cache), the Quadratic Wall (attention cost scaling with sequence length), and the Compute Wall (autoregressive FLOPS and latency), and defines a safety-efficiency feasibility region; (3) SOES, a multiplicative metric with task accuracy, jailbreak resistance, and privacy in the numerator and energy, VRAM, and latency in the denominator, so poor performance in any single dimension drags down the total score. These pieces work together to

Load-bearing premise

The paper's predictive claim that efficiency optimizations structurally create vulnerabilities rests on small measurements: 10 hand-picked jailbreak prompts, 30 canary strings, and energy estimated from a fixed 50 W T4 power draw, so if those measurements are noisy or unrepresentative, the empirical validation of the Security-Efficiency Paradox and the SOES rankings collapse.

What would settle it

Run a broad adversarial evaluation—thousands of jailbreak prompts plus a true membership-inference audit—on the same models at FP16 and INT4 on identical hardware. If refusal rates do not fall and membership inference does not improve after quantization once prompt difficulty is controlled, the paper's central claim that compression structurally degrades security would be overturned.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Post-training quantization should be treated as a security-relevant choice rather than a neutral compression step, because it can lower jailbreak resistance and amplify small adversarial perturbations.
  • Task accuracy alone is an unreliable selector for edge deployment: in the paper's measurements, the most accurate small model also showed the lowest jailbreak resistance, while a smaller but better-aligned model ranked highest on the combined SOES metric.
  • Partitioned inference exposes intermediate activations at the split point, so the split layer and any added noise must be chosen as a privacy-utility trade-off, not just a compute trade-off.
  • Continuous PEFT or LoRA adaptation over small local datasets makes membership inference and gradient leakage easier, because low-rank adapters concentrate rare, domain-specific information into a compact and extractable form.
  • If any of the three walls (memory, attention, compute) is violated, developers will be forced into unsafe optimizations; feasibility checking should therefore precede security decisions.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper states the paradox as structural, but its own data show exceptions to the pattern—some models retain perfect jailbreak resistance after quantization. A useful extension would be to identify which training or architectural features enable compression-robust safety and deliberately breed for them.
  • The canary-loss proxy is only a stand-in for real membership inference. Running full membership-inference attacks on each adapted model would test the stronger claim that small low-rank adapters leak more than dense fine-tuning.
  • The mitigation table implies a concrete, testable design principle: safety-critical layers should be pinned at high precision and excluded from pruning criteria. Whether pinned layers actually preserve guardrails at acceptable cost is an open empirical question the paper does not resolve.
  • The multiplicative SOES form could be extended with domain-specific weights or compliance constraints (for example, medical or legal data) to map more directly onto regulatory decisions; the ranking would then expose trade-offs that a single unweighted score hides.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper argues that the optimizations required to deploy LLMs on edge hardware (quantization, pruning, model partitioning, and parameter-efficient adaptation) create or amplify security and privacy risks, a tension it calls the Security-Efficiency Paradox. It introduces a taxonomy of three architectural constraints (Memory, Quadratic, and Compute Walls), a 'unified constraint model' with feasibility criteria, a Secure Operational Efficiency Score (SOES) combining accuracy, jailbreak resistance, privacy, energy, VRAM, and latency, a four-stage deployment pipeline, and a comparative evaluation of six small LLMs under FP and INT4 quantization intended to validate the paradox. The experiments report MMLU accuracy, refusal rates on 10 curated malicious prompts, a 30-canary privacy test, and latency-derived energy estimates.

Significance. If the structural claim were established, the paper would make a useful contribution by arguing that security and efficiency must be co-designed for edge LLM deployment. The taxonomy of attack surfaces, the mitigation mapping, and the SOES proposal are reasonable starting points, and the multi-model comparison illustrates the practical need for such a metric. The paper also has the merit of being explicit about its metric and evaluation design. However, the quantitative contributions are currently at the level of restated standard formulas and a definitional score, and the empirical validation is too fragile to support the strong conclusion in Section VI. With substantially strengthened evaluation (larger prompt and privacy test sets, real power measurements, clean FP baselines, and tests of the other optimization families), the framework could be publishable; in its current form, the central empirical claim is not established.

major comments (5)
  1. [§V-A4 and Tables II–III] Energy is never measured; it is computed as inference latency × a fixed 50 W T4 power draw. This makes the Energy and Latency columns exactly proportional (e.g., Phi-3.5 FP: 83.4 ms → 4.170 J; Qwen INT4: 95.5 ms → 4.7753 J). Since SOES divides by both Energy and Latency, the same measured quantity appears twice in the denominator, effectively squaring latency. The SOES ranking is therefore an artifact of the conversion rather than an independent energy assessment. Please measure power directly or remove one of the two denominator terms.
  2. [§V-A2 and §V-A3] The security and privacy measurements are far too small to support the quantitative claims. Jailbreak resistance uses 10 hand-curated prompts: each prompt is 10 percentage points of the reported rate, and the standard error for p=80% is about 12.6 percentage points, so differences such as Phi-3.5's 20%→30% or gemma-2's 90%→80% are indistinguishable from noise. The privacy test uses 30 canary strings inserted into the context; lower loss on in-context strings is not the same as membership inference, and the normalization (ratio of canary loss to random loss) is not specified. Report confidence intervals, use a standard membership-inference evaluation with more queries, and release the prompts and canary set.
  3. [§V-B and Table II] The 'Full Precision (FP)' inference condition is contaminated. The row 'Llama-3.2-3B-Instruct-bnb-4bit' is, by the paper's own description, a 4-bit quantized model, yet it appears in Table II under 'Full Precision (FP) Inference' with VRAM 2.10 GB. Every FP-vs-INT4 comparison involving this model is invalid. Either obtain a genuinely unquantized baseline for Llama-3.2-3B or relabel the condition accurately.
  4. [§II, §V, §VI] The empirical evaluation only varies quantization; pruning, partitioning, and PEFT—three of the four optimization families that the paper's structural conclusion generalizes to—are never tested. Moreover, the quantization results do not show the claimed consistent security penalty: jailbreak resistance improves for Phi-3.5 (20→30%) and granite (90→100%), stays at 100% for Qwen, and only gemma-2 drops (90→80%). The statement in §VI that these risks are 'structural, arising from the mathematical nature of low-precision arithmetic, sparse subnetworks, and low-rank adaptation' is not supported by Table III. The paper should either test the other families or restrict the empirical claim to quantization.
  5. [§III-D and §IV-B] The 'Three-Wall Constraint Model' and SOES are presented as derived/quantitative contributions, but the feasibility criterion is just the conjunction of standard arithmetic formulas with free parameters (Ω, τ_max, 50 W) that are not validated against hardware measurements, and the formulas are restatements rather than derivations. The SOES normalization is also underspecified: no equations or min/max ranges are provided for the 'inverse-normalized' resource metrics, so the values in Tables II–III cannot be reproduced. Please specify the normalization procedure and validate or explicitly scope the model.
minor comments (4)
  1. [§III-A] Typo: 'typically typically 1.15≤Ω≤1.25'; also 'Volumetric RAM' is an unusual phrase. The runtime overhead coefficient Ω is never measured or justified.
  2. [§V-A] 'bitsandbytes [39]' cites the QLoRA paper; the reference should be to the bitsandbytes library itself. The meaning of 'FP' when quantization is performed 'via bitsandbytes' is also unclear.
  3. [§V-C5] For gemma-4-E2B-it, the energy change from FP (5.1277 J) to INT4 (8.2571 J) is +61%, not -37.9%; the latency change from 102.6 ms to 165.1 ms is also +60.9%, not -37.9%. The text says 'improves' in both places, which contradicts the table and the surrounding sentence.
  4. [§V-A3] The privacy score is described as 'the ratio of canary loss to random loss, where higher values indicate better privacy preservation.' Since lower canary loss relative to random loss indicates memorization, the direction needs to be stated with an explicit formula.

Circularity Check

0 steps flagged

No load-bearing circularity; the paper's formulas are standard identities and its self-citations are minor.

full rationale

The Three-Wall formulas are standard definitions (VRAM = weights + KV cache; attention cost = O(S^2); FLOPS ≈ 2PT) and are not tailored to force the Security-Efficiency Paradox. SOES is explicitly a proposed evaluation metric rather than a derived prediction, and its components are measured independently (MMLU, refusal rates, canary loss, VRAM, latency). The two self-citations ([10], [45]) are either rhetorical framing at the opening of Section II or a standard reference for federated learning; neither carries a load-bearing uniqueness or ansatz claim. The 'empirical validation' of the paradox is weak on the merits - the jailbreak set is only 10 prompts, energy is computed as a fixed 50 W times latency so the SOES denominator double-counts the same latency measurement, and the FP baseline includes a 4-bit quantized model - but these are measurement/statistical weaknesses, not circular reductions of the conclusion to its inputs. The central claim that quantization, pruning, partitioning, and PEFT can open attack surfaces is supported by external citations and independent mechanistic arguments, not by the paper's own metric. Thus no derivation step reduces to its own input; the score of 2 reflects only the mild self-confirmation of presenting the proposed metric's rankings as validation of the paper's own thesis.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 3 invented entities

The conceptual claims rest on standard formulas and literature-supported phenomena; the genuinely new parts (SOES, pipeline, paradox framing) are definitions and proposals with no external validation. The main unexamined assumption is that SOES rankings are meaningful despite the collinear energy/latency terms and the tiny bespoke security tests.

free parameters (5)
  • Omega runtime overhead coefficient = 1.15-1.25
    Hand-set multiplier in the VRAM_total formula (Section III-A); no empirical calibration is given, and it shifts the feasibility boundary.
  • tau_max latency threshold = 100 ms (example)
    Used in T_token and the unified feasibility criterion (Sections III-C/D); chosen as an example, not derived from requirements.
  • T4 power draw = 50 W
    Energy per token is computed as latency times an assumed 50 W (Section V-A4); if this is wrong, every SOES ranking changes.
  • Split-inference noise scale sigma = iteratively tuned
    Phase 3 of the pipeline (Section IV-C) requires calibrating Gaussian noise sigma but gives no procedure or values.
  • SOES normalization scheme = unspecified
    All six metrics are said to be normalized to [0,1] (Section IV-B) but the exact normalization method is not stated, so scores are not reproducible.
axioms (5)
  • standard math Self-attention costs O(S_l^2 * d) compute and B_s * H * S_l^2 * B/8 memory.
    Invoked in Section III-B as the Quadratic Wall; standard result from Vaswani et al. [29].
  • domain assumption Safety alignment is localized in sparse subnetworks that pruning can fragment.
    Central to the pruning claims in Section II-B; supported by lottery-ticket and safety-brittleness literature [25], [28], but not demonstrated by this paper's experiments.
  • domain assumption If any wall constraint is violated, the developer is forced into unsafe optimizations.
    Section III-D states 'the developer is forced into unsafe optimizations'; this is a behavioral assumption about deployment choices, not a mathematical necessity.
  • ad hoc to paper A 50 W T4 power draw accurately represents inference energy.
    Used in Section V-A4 to compute J/token from latency; no power measurement or variance is reported.
  • ad hoc to paper 10 curated prompts and 30 canary strings yield stable estimates of jailbreak resistance and privacy.
    Sections V-A2 and V-A3 define the only security/privacy measurements; no standard benchmark, no seeds, no confidence intervals, and the prompt/canary sets are not released.
invented entities (3)
  • Security-Efficiency Paradox no independent evidence
    purpose: Names the thesis that efficiency optimizations for edge LLMs cause security and privacy weaknesses.
    Conceptual frame only; the paper's own INT4 data show jailbreak resistance improving for Phi-3.5 (20 to 30) and Granite (90 to 100), so it is not established as a universal empirical law.
  • Three-Wall Constraint Model no independent evidence
    purpose: Quantifies Memory, Quadratic, and Compute Walls and ties them to attack surfaces.
    Restates standard VRAM/FLOPS/attention formulas; the claimed link to 'when unsafe optimizations become unavoidable' is not independently validated.
  • Secure Operational Efficiency Score (SOES) no independent evidence
    purpose: Composite metric to rank edge LLMs by accuracy, security, privacy, and efficiency.
    Defined as a normalized ratio of measured quantities; no external validation, and it double-counts latency and energy because energy is estimated from latency using a fixed power assumption.

pith-pipeline@v1.3.0-alltime-deepseek · 23109 in / 13329 out tokens · 136362 ms · 2026-08-02T06:45:17.293620+00:00 · methodology

0 comments
read the original abstract

Large Language Models (LLMs) are rapidly moving from research settings into the wild, deployed on enterprise infrastructure, personal devices, and edge platforms. While cloud deployments offer scalable compute, concerns over data sovereignty, compliance, latency, and third-party dependence are driving organizations toward edge and on-premise LLMs. This shift introduces new security and privacy challenges: limited compute and memory force aggressive optimizations, including quantization, pruning, model partitioning, and parameter-efficient adaptation, each of which can introduce vulnerabilities and reshape the threat landscape. We describe this tension as the Security-Efficiency Paradox, mechanisms that improve efficiency may weaken robustness, expose new attack surfaces, or increase privacy risks. We examine how compression can degrade safety alignment, how partitioned inference enables reconstruction attacks, and how continuous local adaptation may cause privacy leakage and model drift. To analyze these risks, we introduce a deployment-centric taxonomy organized around three architectural constraints: the Memory Wall, the Quadratic Wall, and the Compute Wall. We derive a unified constraint model that quantifies when unsafe optimizations become unavoidable, linking each wall to specific attack surfaces. Building on this model, we propose the Secure Operational Efficiency Score (SOES), a holistic metric balancing task accuracy, jailbreak resistance, and privacy against energy, memory, and latency, enabling practitioners to configure edge LLMs under real-world hardware limits. We further present a practical decision procedure and targeted mitigations for each optimization-induced vulnerability. Together, these contributions provide a co-designed framework for jointly evaluating security, privacy, and efficiency, laying a foundation for securing edge-native intelligent systems.

Figures

Figures reproduced from arXiv: 2607.13088 by Dumindu Samaraweera, Mingchen Li, Morris Chang, Ren-Yi Huang.

Figure 1
Figure 1. Figure 1: Architectural bottlenecks and security tradeoffs in edge LLM deployment. To overcome the limitations of three [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Taxonomy of decentralized LLM deployment trade-offs. The diagram contrasts how static model optimizations and [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Summary of optimization strategies and their vulnera [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Hardware-constrained, privacy-preserving LLM selec [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Current landscape of edge-deployable LLM models for on-device intelligence. Parameters (params) denote total model [PITH_FULL_IMAGE:figures/full_fig_p012_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Radar chart of normalized performance metrics for [PITH_FULL_IMAGE:figures/full_fig_p013_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Radar chart of normalized performance metrics for [PITH_FULL_IMAGE:figures/full_fig_p014_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Resource footprint of different models: VRAM and [PITH_FULL_IMAGE:figures/full_fig_p015_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: SOES vs. model size, illustrating the non-monotonic [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: The security-efficiency paradox in edge LLMs: Secu [PITH_FULL_IMAGE:figures/full_fig_p017_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

65 extracted references · 14 linked inside Pith

  1. [1]

    Security and privacy challenges of large language models: A survey.ACM Computing Surveys, 57(6):1–39, 2025

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. Security and privacy challenges of large language models: A survey.ACM Computing Surveys, 57(6):1–39, 2025

    2025

  2. [2]

    European Parliament and Council. Regulation (EU) 2016/679 of the European Parliament and of the Council on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj, 2016. Official Journal of the European Union, ...

    2016

  3. [3]

    Department of Health and Human Services

    U.S. Department of Health and Human Services. Standards for Pri- vacy of Individually Identifiable Health Information (HIPAA Privacy Rule). https://www.hhs.gov/hipaa/for-professionals/privacy/index.html,

  4. [4]

    Regulation (EU) 2024/1689 of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act)

    European Parliament and Council. Regulation (EU) 2024/1689 of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). https: //eur-lex.europa.eu/eli/reg/2024/1689/oj, 2024. Official Journal of the European Union, OJ L 1689, July 12, 2024. Entered into force August 1, 2024

    2024

  5. [5]

    Removing Barriers to American Leadership in Artificial Intelligence

    The White House. Winning the Race: America’s AI Ac- tion Plan. https://www.whitehouse.gov/wp-content/uploads/2025/07/ Americas-AI-Action-Plan.pdf, July 2025. Released July 23, 2025, pursuant to Executive Order 14179, “Removing Barriers to American Leadership in Artificial Intelligence”

    2025

  6. [6]

    Strengthening our frontier safety framework

    Four Flynn, Helen King, and Anca Dragan. Strengthening our frontier safety framework. https://deepmind.google/discover/blog/ strengthening-our-frontier-safety-framework/, July 2025. Google Deep- Mind Blog

    2025

  7. [7]

    Deploying llm transformer on edge computing devices: A survey of strategies, challenges, and future directions.AI, 7(1):15, 2026

    Endah Kristiani, Vinod Kumar Verma, and Chao-Tung Yang. Deploying llm transformer on edge computing devices: A survey of strategies, challenges, and future directions.AI, 7(1):15, 2026

    2026

  8. [8]

    Othmane Friha, Mohamed Amine Ferrag, Burak Kantarci, Burak Cak- mak, Arda Ozgun, and Nassira Ghoualmi-Zine. Llm-based edge intelli- gence: A comprehensive survey on architectures, applications, security and trustworthiness.IEEE Open Journal of the Communications Society, 5:5799–5856, 2024

    2024

  9. [9]

    Efficient memory management for large language model serving with pagedattention

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. InProceedings of the 29th symposium on operating systems principles, pages 611–626, 2023

    2023

  10. [10]

    Advancing practical homomorphic encryption for federated learning: Theoretical guarantees and efficiency optimizations.arXiv preprint arXiv:2509.20476, 2025

    Ren-Yi Huang, Dumindu Samaraweera, Prashant Shekhar, and J Morris Chang. Advancing practical homomorphic encryption for federated learning: Theoretical guarantees and efficiency optimizations.arXiv preprint arXiv:2509.20476, 2025

    arXiv 2025

  11. [11]

    Zeroquant: Efficient and affordable post- training quantization for large-scale transformers.Advances in neural information processing systems, 35:27168–27183, 2022

    Zhewei Yao, Reza Yazdani Aminabadi, Minjia Zhang, Xiaoxia Wu, Conglong Li, and Yuxiong He. Zeroquant: Efficient and affordable post- training quantization for large-scale transformers.Advances in neural information processing systems, 35:27168–27183, 2022

    2022

  12. [12]

    Exploiting llm quantization.Advances in Neural Information Processing Systems, 37:41709–41732, 2024

    Kazuki Egashira, Mark Vero, Robin Staab, Jingxuan He, and Martin Vechev. Exploiting llm quantization.Advances in Neural Information Processing Systems, 37:41709–41732, 2024

    2024

  13. [13]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  14. [14]

    Attacking binarized neural networks.arXiv preprint arXiv:1711.00449, 2017

    Angus Galloway, Graham W Taylor, and Medhat Moussa. Attacking binarized neural networks.arXiv preprint arXiv:1711.00449, 2017

    Pith/arXiv arXiv 2017

  15. [15]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. InInternational conference on machine learning, pages 284–293. PMLR, 2018

    2018

  16. [16]

    Quantization aware attack: Enhancing transferable adversarial attacks by model quantization

    Yulong Yang, Chenhao Lin, Qian Li, Zhengyu Zhao, Haoran Fan, Dawei Zhou, Nannan Wang, Tongliang Liu, and Chao Shen. Quantization aware attack: Enhancing transferable adversarial attacks by model quantization. IEEE Transactions on Information Forensics and Security, 19:3265– 3278, 2024

    2024

  17. [17]

    On jailbreaking quantized language models through fault injection attacks

    Noureldin Zahran, Ahmad Tahmasivand, Ihsen Alouani, Khaled Kha- sawneh, and Mohammed Fouda. On jailbreaking quantized language models through fault injection attacks. InProceedings of the Great Lakes Symposium on VLSI 2025, pages 554–561, 2025

    2025

  18. [18]

    Quantization-based jailbreaking vulnerability analysis: A study on performance and safety of the llama3-8b-instruct model.IEEE Access, 2025

    Jaesik Lee. Quantization-based jailbreaking vulnerability analysis: A study on performance and safety of the llama3-8b-instruct model.IEEE Access, 2025

    2025

  19. [19]

    Flipping bits in memory without accessing them: An experimental study of dram disturbance errors.ACM SIGARCH Computer Architecture News, 42(3):361–372, 2014

    Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory without accessing them: An experimental study of dram disturbance errors.ACM SIGARCH Computer Architecture News, 42(3):361–372, 2014

    2014

  20. [20]

    Bit-flip attack: Crushing neural network with progressive bit search

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 1211–1220, 2019

    2019

  21. [21]

    Deep reinforcement learning from human prefer- ences.Advances in neural information processing systems, 30, 2017

    Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human prefer- ences.Advances in neural information processing systems, 30, 2017

    2017

  22. [22]

    Learning to summarize with human feedback.Advances in neural information processing systems, 33:3008–3021, 2020

    Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea V oss, Alec Radford, Dario Amodei, and Paul F Christiano. Learning to summarize with human feedback.Advances in neural information processing systems, 33:3008–3021, 2020

    2020

  23. [23]

    Direct preference optimization: Your language model is secretly a reward model.Advances in neural information processing systems, 36:53728–53741, 2023

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model.Advances in neural information processing systems, 36:53728–53741, 2023

    2023

  24. [24]

    Safety alignment should be made more than just a few tokens deep

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. InInternational Conference on Learning Representations, volume 2025, pages 54911– 54941, 2025

    2025

  25. [25]

    The lottery ticket hypoth- esis: Finding sparse, trainable neural networks.arXiv preprint arXiv:1803.03635, 2018

    Jonathan Frankle and Michael Carbin. The lottery ticket hypoth- esis: Finding sparse, trainable neural networks.arXiv preprint arXiv:1803.03635, 2018

    Pith/arXiv arXiv 2018

  26. [26]

    A simple and effective pruning approach for large language models

    Mingjie Sun, Zhuang Liu, Anna Bair, and Zico Kolter. A simple and effective pruning approach for large language models. InInternational Conference on Learning Representations, volume 2024, pages 4942– 4964, 2024

    2024

  27. [27]

    Llm-pruner: On the structural pruning of large language models.Advances in neural information processing systems, 36:21702–21720, 2023

    Xinyin Ma, Gongfan Fang, and Xinchao Wang. Llm-pruner: On the structural pruning of large language models.Advances in neural information processing systems, 36:21702–21720, 2023

    2023

  28. [28]

    Assessing the brittleness of safety alignment via pruning and low-rank modifications.arXiv preprint arXiv:2402.05162, 2024

    Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. Assessing the brittleness of safety alignment via pruning and low-rank modifications.arXiv preprint arXiv:2402.05162, 2024

    Pith/arXiv arXiv 2024

  29. [29]

    Attention is all you need.Advances in neural information processing systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017

    2017

  30. [30]

    Are sixteen heads really better than one?Advances in neural information processing systems, 32, 2019

    Paul Michel, Omer Levy, and Graham Neubig. Are sixteen heads really better than one?Advances in neural information processing systems, 32, 2019

    2019

  31. [31]

    Palu: Compressing kv-cache with low-rank projection.arXiv preprint arXiv:2407.21118, 2024

    Chi-Chih Chang, Wei-Cheng Lin, Chien-Yu Lin, Chong-Yan Chen, Yu- Fang Hu, Pei-Shuo Wang, Ning-Chi Huang, Luis Ceze, Mohamed S Abdelfattah, and Kai-Chiang Wu. Palu: Compressing kv-cache with low-rank projection.arXiv preprint arXiv:2407.21118, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    When efficiency meets safety: A benchmark security analysis of kv cache compression in large language models

    Xiaoxiao Ma, Kuofeng Gao, Zeyi Lu, Wenxi Jiang, Hao Fang, Hao Wu, Bin Chen, and Shu-Tao Xia. When efficiency meets safety: A benchmark security analysis of kv cache compression in large language models. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 24472– 24485, 2026

    2026

  33. [33]

    Pruning for protection: Increasing jailbreak resistance in aligned llms without fine-tuning

    Adib Hasan, Ileana Rugina, and Alex Wang. Pruning for protection: Increasing jailbreak resistance in aligned llms without fine-tuning. In Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Inter- preting Neural Networks for NLP, pages 417–430, 2024

    2024

  34. [34]

    Edgeshard: Efficient llm inference via collaborative edge com- puting.IEEE Internet of Things Journal, 12(10):13119–13131, 2024

    Mingjin Zhang, Xiaoming Shen, Jiannong Cao, Zeyang Cui, and Shan Jiang. Edgeshard: Efficient llm inference via collaborative edge com- puting.IEEE Internet of Things Journal, 12(10):13119–13131, 2024

    2024

  35. [35]

    Attacking and protecting data privacy in edge–cloud collaborative inference systems.IEEE Internet of Things Journal, 8(12):9706–9716, 2020

    Zecheng He, Tianwei Zhang, and Ruby B Lee. Attacking and protecting data privacy in edge–cloud collaborative inference systems.IEEE Internet of Things Journal, 8(12):9706–9716, 2020

    2020

  36. [36]

    Prompt inference attack on distributed large language model inference frameworks

    Xinjian Luo, Ting Yu, and Xiaokui Xiao. Prompt inference attack on distributed large language model inference frameworks. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 1739–1753, 2025

    2025

  37. [37]

    Algen: Few-shot inversion attacks on textual embeddings via cross-model alignment and generation

    Yiyi Chen, Qiongkai Xu, and Johannes Bjerva. Algen: Few-shot inversion attacks on textual embeddings via cross-model alignment and generation. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 24330–24348, 2025

    2025

  38. [38]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. InTheory of cryptography conference, pages 265–284. Springer, 2006

    2006

  39. [39]

    Qlora: Efficient finetuning of quantized llms.Advances in neural information processing systems, 36:10088–10115, 2023

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: Efficient finetuning of quantized llms.Advances in neural information processing systems, 36:10088–10115, 2023. 18

    2023

  40. [40]

    Lora: Low-rank adaptation of large language models.Iclr, 1(2):3, 2022

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Liang Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models.Iclr, 1(2):3, 2022

    2022

  41. [41]

    Lora as oracle.arXiv preprint arXiv:2601.11207, 2026

    Marco Arazzi and Antonino Nocera. Lora as oracle.arXiv preprint arXiv:2601.11207, 2026

    arXiv 2026

  42. [42]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In2017 IEEE Symposium on Security and Privacy (SP), pages 3–18. IEEE, 2017

    2017

  43. [43]

    Extracting training data from large language models.USENIX Security Symposium, 2021

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models.USENIX Security Symposium, 2021

    2021

  44. [44]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. InThe Eleventh International Conference on Learning Representations, 2022

    2022

  45. [45]

    Morris Chang

    Ren-Yi Huang, Dumindu Samaraweera, and J. Morris Chang. Exploring threats, defenses, and privacy-preserving techniques in federated learn- ing: A survey.Computer, 57(4):46–56, 2024

    2024

  46. [46]

    Federated fine-tuning of large language models under heterogeneous tasks and client resources.Advances in Neural Information Processing Systems, 37:14457–14483, 2024

    Jiamu Bai, Daoyuan Chen, Bingchen Qian, Liuyi Yao, and Yaliang Li. Federated fine-tuning of large language models under heterogeneous tasks and client resources.Advances in Neural Information Processing Systems, 37:14457–14483, 2024

    2024

  47. [47]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019

    2019

  48. [48]

    Alignguard-lora: Alignment-preserving fine-tuning via fisher-guided de- composition and riemannian-geodesic collision regularization.arXiv preprint arXiv:2508.02079, 2025

    Amitava Das, Abhilekh Borah, Vinija Jain, and Aman Chadha. Alignguard-lora: Alignment-preserving fine-tuning via fisher-guided de- composition and riemannian-geodesic collision regularization.arXiv preprint arXiv:2508.02079, 2025

    Pith/arXiv arXiv 2025

  49. [49]

    Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in neural information processing systems, 33:9459–9474, 2020

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K ¨uttler, Mike Lewis, Wen-tau Yih, Tim Rockt¨aschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in neural information processing systems, 33:9459–9474, 2020

    2020

  50. [50]

    Analyzing and reducing catastrophic forgetting in parameter efficient tuning.arXiv preprint arXiv:2402.18865, 2024

    Weijieying Ren, Xinlong Li, Lei Wang, Tianxiang Zhao, and Wei Qin. Analyzing and reducing catastrophic forgetting in parameter efficient tuning.arXiv preprint arXiv:2402.18865, 2024

    Pith/arXiv arXiv 2024

  51. [51]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. Ininternational conference on machine learning, pages 1310–1320. PMLR, 2019

    2019

  52. [52]

    What disease does this patient have? a large-scale open domain question answering dataset from medical exams.Applied Sciences, 11(14):6421, 2021

    Di Jin, Eileen Pan, Nassim Oufattole, Wei-Hung Weng, Hanyi Fang, and Peter Szolovits. What disease does this patient have? a large-scale open domain question answering dataset from medical exams.Applied Sciences, 11(14):6421, 2021

    2021

  53. [53]

    Measuring massive multi- task language understanding.arXiv preprint arXiv:2009.03300, 2020

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multi- task language understanding.arXiv preprint arXiv:2009.03300, 2020

    Pith/arXiv arXiv 2009

  54. [54]

    Evaluating large language models trained on code.arXiv preprint arXiv:2107.03374, 2021

    Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evaluating large language models trained on code.arXiv preprint arXiv:2107.03374, 2021

    Pith/arXiv arXiv 2021

  55. [55]

    Edge-mpq: Layer-wise mixed-precision quantization with tightly integrated versatile inference units for edge computing

    Xiaotian Zhao, Ruge Xu, Yimin Gao, Vaibhav Verma, Mircea R Stan, and Xinfei Guo. Edge-mpq: Layer-wise mixed-precision quantization with tightly integrated versatile inference units for edge computing. IEEE Transactions on Computers, 73(11):2504–2519, 2024

    2024

  56. [56]

    Measuring massive multitask language understanding.Proceedings of the International Conference on Learning Representations (ICLR), 2021

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding.Proceedings of the International Conference on Learning Representations (ICLR), 2021

    2021

  57. [57]

    Measuring massive mul- titask language understanding (github repository)

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive mul- titask language understanding (github repository). https://github.com/ hendrycks/test, 2021. Accessed: [Insert Date Here]

    2021

  58. [58]

    Phi-3 safety post-training: Aligning language models with a” break-fix” cycle.arXiv preprint arXiv:2407.13833, 2024

    Emman Haider, Daniel Perez-Becker, Thomas Portet, Piyush Madan, Amit Garg, Atabak Ashfaq, David Majercak, Wen Wen, Dongwoo Kim, Ziyi Yang, et al. Phi-3 safety post-training: Aligning language models with a” break-fix” cycle.arXiv preprint arXiv:2407.13833, 2024

    Pith/arXiv arXiv 2024

  59. [59]

    Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, et al. Qwen2. 5-coder technical report.arXiv preprint arXiv:2409.12186, 2024

    Pith/arXiv arXiv 2024

  60. [60]

    Gemma 2: Im- proving open language models at a practical size.arXiv preprint arXiv:2408.00118, 2024

    Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, L ´eonard Hussenot, Thomas Mes- nard, Bobak Shahriari, Alexandre Ram ´e, et al. Gemma 2: Im- proving open language models at a practical size.arXiv preprint arXiv:2408.00118, 2024

    Pith/arXiv arXiv 2024

  61. [61]

    Gemma 4 technical report, 2026

    Gemma Team. Gemma 4 technical report, 2026

    2026

  62. [62]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Pith/arXiv arXiv 2024

  63. [63]

    Language models are unsupervised multitask learners.OpenAI blog, 1(8):9, 2019

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners.OpenAI blog, 1(8):9, 2019

    2019

  64. [64]

    Decoding compressed trust: Scrutinizing the trustworthiness of efficient llms under compression.arXiv preprint arXiv:2403.15447, 2024

    Junyuan Hong, Jinhao Duan, Chenhui Zhang, Zhangheng Li, Chulin Xie, Kelsey Lieberman, James Diffenderfer, Brian Bartoldson, Ajay Jaiswal, Kaidi Xu, et al. Decoding compressed trust: Scrutinizing the trustworthiness of efficient llms under compression.arXiv preprint arXiv:2403.15447, 2024. 19

    Pith/arXiv arXiv 2024

  65. [2002]

    45 CFR Parts 160 and 164