Pith. sign in

REVIEW 2 major objections 2 minor 173 references

Defense Against Prompt Inversion Attacks: An Information-Theoretic Approach for LLM Collaborative Inference

T0 review · 2 major / 2 minor · reviewed 2026-06-27 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An information-theoretic approach defends collaborative LLM inference from prompt inversion by minimizing mutual information between activations and prompts.

desk verdict The paper frames prompt inversion defense in collaborative LLM inference as an MI minimization problem with privacy adapters, which is a reasonable step but the claimed theoretical guarantees on reconstruction error do not appear to hold up under the low-dimensional approximations required. read the letter →

arxiv 2606.11592 v1 pith:P24YTHCO submitted 2026-06-10 cs.CR

Sayedeh Leila Noorbakhsh , Hossein Khalili , Nader Sehatbakhsh This is my paper · ORCID
classification cs.CR
keywords promptinversionattackscollaborativeLLMinferenceinformation-theoreticdefensemutualinformationminimizationprivacyadaptersbottleneckprivacy-utilitytradeoffedge-cloud
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper develops a defense framework for prompt inversion attacks during collaborative edge-cloud inference with large language models. It learns privacy-preserving representations by explicitly minimizing the mutual information between intermediate activations and the original input prompt. This minimization occurs while preserving task utility and respecting computational constraints. The work derives theoretical guarantees on reconstruction error and characterizes privacy-utility tradeoffs. A practical method uses low-dimensional privacy adapters as information bottlenecks, with experiments showing improved tradeoffs over prior approaches.

What carries the argument

Low-dimensional privacy adapters that function as information bottlenecks to minimize mutual information between activations and the input prompt.

What would settle it

An experiment in which the privacy adapters produce no reduction in attack success rate relative to heuristic defenses or in which observed prompt reconstruction error exceeds the paper's theoretical bound.

Watch

Extended reading notes

Core claim

By minimizing the mutual information between intermediate activations and the input prompt via low-dimensional privacy adapters implemented as information bottlenecks, the framework produces representations that limit prompt reconstruction while maintaining downstream inference utility, yielding theoretical bounds on reconstruction error and token-level accuracy along with empirical reductions in attack success.

Load-bearing premise

Mutual information between activations and prompts can be minimized in practice via low-dimensional privacy adapters without violating computational constraints or substantially degrading downstream task utility, and the derived theoretical guarantees hold under real model architectures.

Editorial extensions

If this is right

  • Theoretical guarantees on prompt reconstruction error follow directly from the mutual information minimization.
  • Fundamental privacy-utility tradeoffs are characterized for collaborative inference.
  • Token-level accuracy bounds are established for the downstream task.
  • The approach yields up to 35% reduction in attack success compared with existing defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same mutual-information minimization could be applied to protect against other leakage risks in distributed inference pipelines.
  • The adapter construction might transfer to collaborative settings that use models other than LLMs.
  • Deployment would require checking whether the low-dimensional adapters preserve the stated tradeoffs under real network latency and hardware limits.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The paper proposes an information-theoretic defense framework against prompt inversion attacks in collaborative edge-cloud LLM inference. It learns privacy-preserving representations by minimizing mutual information between intermediate activations and input prompts via low-dimensional privacy adapters (while preserving task utility), derives theoretical guarantees on prompt reconstruction error and token-level accuracy bounds, characterizes privacy-utility-latency tradeoffs, and reports up to 35% reduction in attack success versus baselines across experiments.

Significance. If the central claims hold, the work supplies a principled alternative to heuristic defenses by linking explicit MI minimization to reconstruction-error bounds and empirical tradeoffs. This would be significant for secure collaborative inference deployments, as it moves beyond empirical tuning toward information-theoretic characterizations. The combination of derived bounds with adapter-based implementation is a potential strength if the approximations are rigorously controlled.

major comments (2)
  1. [§3] §3 (theoretical guarantees): The reconstruction-error bounds and token-level accuracy claims rest on exact minimization of I(activations; prompt). The privacy adapters implement this via a low-dimensional bottleneck, but the derivation provides no error bounds or concentration results on the variational or estimator approximation to the true MI; without this, the stated guarantees do not necessarily transfer to the implemented method.
  2. [§5] §5 (experiments): The reported 35% attack-success reduction and privacy-utility curves are presented as validation of the framework, yet the attack models used for evaluation are not shown to match the threat model assumed in the theoretical bounds (e.g., whether the adversary has access to the same adapter parameters or only to the transmitted activations). This gap makes it impossible to assess whether the empirical gains confirm the derived bounds or merely reflect a different operating regime.
minor comments (2)
  1. Notation: The definition of the privacy adapter objective (likely Eq. (X)) should explicitly state whether the MI term is the true mutual information or a variational lower/upper bound, and how the Lagrange multiplier for the utility constraint is chosen.
  2. Related work: The manuscript should cite recent results on high-dimensional MI estimation error (e.g., variational bounds and their sample complexity) to contextualize the practical achievability of the claimed minimization.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the insightful comments, which highlight important aspects of the connection between our theoretical analysis and practical implementation. We address each major comment below.

read point-by-point responses

  1. Referee: [§3] §3 (theoretical guarantees): The reconstruction-error bounds and token-level accuracy claims rest on exact minimization of I(activations; prompt). The privacy adapters implement this via a low-dimensional bottleneck, but the derivation provides no error bounds or concentration results on the variational or estimator approximation to the true MI; without this, the stated guarantees do not necessarily transfer to the implemented method.

    Authors: We agree that the stated bounds assume exact mutual information minimization. The implemented privacy adapters rely on a variational lower bound and dimensionality reduction, introducing approximation error not quantified in the current derivation. In the revision we will add a dedicated paragraph in §3 that invokes standard concentration inequalities for MI estimators (under Lipschitz and bounded-support assumptions on the activation distributions) and derives an explicit additive error term between the variational estimate and the true MI. This will state the conditions under which the reconstruction-error and token-accuracy bounds continue to hold approximately. revision: yes

  2. Referee: [§5] §5 (experiments): The reported 35% attack-success reduction and privacy-utility curves are presented as validation of the framework, yet the attack models used for evaluation are not shown to match the threat model assumed in the theoretical bounds (e.g., whether the adversary has access to the same adapter parameters or only to the transmitted activations). This gap makes it impossible to assess whether the empirical gains confirm the derived bounds or merely reflect a different operating regime.

    Authors: The theoretical threat model in §3 assumes the adversary receives only the post-adapter activations and has no knowledge of the adapter weights. The experiments in §5 train inversion attacks on exactly those activations, which is consistent with the stated model. We will nevertheless revise the threat-model subsection and the experimental-setup paragraph to make this assumption explicit and to discuss the stronger adversary that also knows the adapter parameters. We will also add a short note on how the reported 35 % figure would be expected to change under that stronger model. revision: partial

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: theoretical claims presented as derived from MI minimization without reduction to fitted quantities or self-citations

full rationale

The provided abstract and description state that the framework minimizes mutual information to learn privacy-preserving representations and derives theoretical guarantees on reconstruction error and token-level bounds. No equations, self-citations, or derivation steps are exhibited that would reduce the guarantees to the training of the adapters by construction, nor is any uniqueness theorem or ansatz imported from prior author work. The experimental results on privacy-utility tradeoffs are presented separately from the theoretical derivation, leaving the claims self-contained against external information-theoretic principles.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Abstract-only view provides no explicit free parameters, axioms, or invented entities; the low-dimensional bottleneck dimension and any weighting on the mutual information term are likely free parameters but are not quantified here.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Defense Against Prompt Inversion Attacks: An Information-Theoretic Approach for LLM Collaborative Inference." pith.science (2026). https://pith.science/paper/P24YTHCO

@misc{pith2026260611592,
  author       = {Pith},
  title        = {Pith review of: Defense Against Prompt Inversion Attacks: An Information-Theoretic Approach for LLM Collaborative Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P24YTHCO}},
  note         = {Machine review of arXiv:2606.11592}
}
read the original abstract

Collaborative edge-cloud inference enables resource-constrained devices to leverage large language models (LLMs) by offloading partial computation to cloud servers. However, transmitting intermediate activations exposes sensitive user prompts to prompt inversion attacks, where an adversary reconstructs the original input from shared representations. Existing defenses rely largely on heuristic perturbations or empirical tuning, offering limited theoretical understanding of privacy leakage and its interaction with utility and latency constraints. We propose an information-theoretic defense framework for prompt inversion in collaborative LLM inference. Our approach learns privacy-preserving representations by explicitly minimizing the mutual information between intermediate activations and the input prompt while maintaining task utility under computational constraints. We derive theoretical guarantees on prompt reconstruction error, characterize fundamental privacy-utility tradeoffs, and establish token-level accuracy bounds for downstream inference. We then propose a novel defense based on privacy adapters implemented via low-dimensional information bottlenecks. Extensive experiments across multiple settings demonstrate that our method achieves superior privacy-utility-latency tradeoffs compared to existing defenses (up to 35% reduction in attack success), providing a principled foundation for private and efficient collaborative LLM inference.

Figures

Figures reproduced from arXiv: 2606.11592 by the authors.

Figure 1
Figure 1. Privacy-adapter–based collaborative inference. Lightweight trainable adapters are inserted [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Cross-dataset privacy-utility tradeoff over [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Skytrax dataset (LLaMA-2-7B, k=4, r=512). The privacy gap widens as λ increases. 0.2 0.4 0.6 0.8 Privacy Weight 0 20 40 60 80 100 Token Accuracy (%) (a) Token Accuracy Overall Acc. Sensitive Acc. Common Acc. Privacy Gap 0.2 0.4 0.6 0.8 Privacy Weight 0.0 0.2 0.4 0.6 0.8 1.0 BLEU Score 0.76 0.71 0.43 0.15 (b) BLEU Score 0.2 0.4 0.6 0.8 Privacy Weight 0 20 40 60 80 100 NERR (%) 53.5% 45.9% 17.6% 1.4% (c) Entity Recove… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Medical dataset (LLaMA-2-7B, k=4, r=512). Sensitive token accuracy drops most aggressively, reflecting the high concentration of domain-specific terminology (medical conditions, drug names). attacker Luo et al. [2025] on LLaMA-2-7B at split k=4. Our privacy adapters at…
Figure 5
Figure 5. Figure 5: Legal dataset (LLaMA-2-7B, k=4, r=512). Token accuracy curves converge at intermedi￾ate λ, indicating more uniform entropy across token types in legal text. the additional computation introduced by the adapters is fixed by the bottleneck dimension r rather than by the …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

173 extracted references · 7 canonical work pages

  1. [3]

    2020 International Conference on Data Mining Workshops (ICDMW) , pages=

    NoPeek: Information leakage reduction to share activations in distributed deep learning , author=. 2020 International Conference on Data Mining Workshops (ICDMW) , pages=. 2020 , organization=

    2020

  2. [4]

    ICML , year=

    Bounding training data reconstruction in private (deep) learning , author=. ICML , year=

  3. [5]

    International Conference on Machine Learning (ICML) , pages=

    Wasserstein Generative Adversarial Networks , author=. International Conference on Machine Learning (ICML) , pages=. 2017 , organization=

    2017

  4. [6]

    Advances in Neural Information Processing Systems (NeurIPS) , volume=

    Generative Adversarial Nets , author=. Advances in Neural Information Processing Systems (NeurIPS) , volume=

  5. [7]

    33rd USENIX Security Symposium (USENIX Security 24) , pages=

    Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attacks , author=. 33rd USENIX Security Symposium (USENIX Security 24) , pages=. 2024 , organization=

    2024

  6. [8]

    International Conference on Machine Learning (ICML) , pages=

    CLUB: A Contrastive Log-ratio Upper Bound of Mutual Information , author=. International Conference on Machine Learning (ICML) , pages=. 2020 , organization=

    2020

  7. [9]

    2006 , publisher=

    Elements of Information Theory , author=. 2006 , publisher=

    2006

  8. [10]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Task-Agnostic Privacy-Preserving Representation Learning for Federated Learning Against Attribute Inference Attacks , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

Show all 173 references
  1. [11]

    , author=

    Lora: Low-rank adaptation of large language models. , author=. ICLR , volume=

  2. [12]

    2025 IEEE Symposium on Security and Privacy (SP) , pages=

    Prompt inversion attack against collaborative inference of large language models , author=. 2025 IEEE Symposium on Security and Privacy (SP) , pages=. 2025 , organization=

    2025

  3. [13]

    Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Deep Learning with Differential Privacy , author=. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2016

  4. [14]

    International Conference on Learning Representations , year=

    Deep Variational Information Bottleneck , author=. International Conference on Learning Representations , year=

  5. [15]

    International Conference on Machine Learning , year=

    CLUB: A Contrastive Log-ratio Upper Bound of Mutual Information , author=. International Conference on Machine Learning , year=

  6. [16]

    John Wiley & Sons , year=

    Information Theory and Statistics , author=. John Wiley & Sons , year=

  7. [17]

    arXiv preprint arXiv:2302.13971 , year=

    LLaMA: Open and Efficient Foundation Language Models , author=. arXiv preprint arXiv:2302.13971 , year=

    arXiv

  8. [18]

    arXiv preprint arXiv:2205.01068 , year=

    OPT: Open Pre-trained Transformer Language Models , author=. arXiv preprint arXiv:2205.01068 , year=

    arXiv

  9. [19]

    arXiv preprint arXiv:1812.00564 , year=

    Split Learning for Health: Distributed Deep Learning without Sharing Raw Data , author=. arXiv preprint arXiv:1812.00564 , year=

    arXiv

  10. [20]

    2017 IEEE Symposium on Security and Privacy (SP) , pages=

    Membership Inference Attacks Against Machine Learning Models , author=. 2017 IEEE Symposium on Security and Privacy (SP) , pages=

    2017

  11. [21]

    Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages=

    Model Inversion Attacks That Exploit Confidence Information and Basic Countermeasures , author=. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages=

  12. [22]

    International Conference on Machine Learning , pages=

    Flexgen: High-throughput generative inference of large language models with a single gpu , author=. International Conference on Machine Learning , pages=. 2023 , organization=

    2023

  13. [23]

    Advances in neural information processing systems , volume=

    Distributed inference and fine-tuning of large language models over the internet , author=. Advances in neural information processing systems , volume=

  14. [24]

    ACM Computing Surveys , volume=

    Towards efficient generative large language model serving: A survey from algorithms to systems , author=. ACM Computing Surveys , volume=. 2025 , publisher=

    2025

  15. [25]

    IEEE Communications Surveys & Tutorials , year=

    Mobile edge intelligence for large language models: A contemporary survey , author=. IEEE Communications Surveys & Tutorials , year=

  16. [26]

    Forty-first International Conference on Machine Learning , year=

    Position: Exploring the robustness of pipeline-parallelism-based decentralized training , author=. Forty-first International Conference on Machine Learning , year=

  17. [27]

    Proceedings of the 29th Annual International Conference on Mobile Computing and Networking , pages=

    Enc2: Privacy-preserving inference for tiny IoTs via encoding and encryption , author=. Proceedings of the 29th Annual International Conference on Mobile Computing and Networking , pages=

  18. [28]

    Forty-first International Conference on Machine Learning , year=

    Mobilellm: Optimizing sub-billion parameter language models for on-device use cases , author=. Forty-first International Conference on Machine Learning , year=

  19. [29]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Cloud-device collaborative learning for multimodal large language models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  20. [30]

    ACM SIGARCH Computer Architecture News , volume=

    Neurosurgeon: Collaborative intelligence between the cloud and mobile edge , author=. ACM SIGARCH Computer Architecture News , volume=. 2017 , publisher=

    2017

  21. [31]

    Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Prompt inference attack on distributed large language model inference frameworks , author=. Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2025

  22. [32]

    IEEE Internet of Things Journal , year=

    Edgeshard: Efficient llm inference via collaborative edge computing , author=. IEEE Internet of Things Journal , year=

  23. [33]

    34th USENIX Security Symposium (USENIX Security 25) , pages=

    Depth Gives a False Sense of Privacy: \ LLM \ Internal States Inversion , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

  24. [35]

    Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack , author=. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    2024

  25. [36]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Invariant representations through adversarial forgetting , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  26. [37]

    IEEE Internet of Things Journal , volume=

    A hybrid deep learning architecture for privacy-preserving mobile analytics , author=. IEEE Internet of Things Journal , volume=. 2020 , publisher=

    2020

  27. [38]

    2019 IEEE symposium on security and privacy (SP) , pages=

    Exploiting unintended feature leakage in collaborative learning , author=. 2019 IEEE symposium on security and privacy (SP) , pages=. 2019 , organization=

    2019

  28. [39]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  29. [40]

    Advances in neural information processing systems , volume=

    GAN you see me? enhanced data reconstruction attacks against split inference , author=. Advances in neural information processing systems , volume=

  30. [41]

    Advances in Neural Information Processing Systems , volume=

    Posthoc privacy guarantees for collaborative inference with modified propose-test-release , author=. Advances in Neural Information Processing Systems , volume=

  31. [42]

    Advances in neural information processing systems , volume=

    Measuring data reconstruction defenses in collaborative inference systems , author=. Advances in neural information processing systems , volume=

  32. [43]

    Advances in Neural Information Processing Systems , volume=

    Trade-offs and guarantees of adversarial representation learning for information obfuscation , author=. Advances in Neural Information Processing Systems , volume=

  33. [44]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Learning Robust and Privacy-Preserving Representations via Information Theory , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  34. [45]

    International conference on machine learning , pages=

    Improving adversarial robustness via mutual information estimation , author=. International conference on machine learning , pages=. 2022 , organization=

    2022

  35. [46]

    31st USENIX Security Symposium (USENIX Security 22) , pages=

    Cheetah: Lean and fast secure \ Two-Party \ deep neural network inference , author=. 31st USENIX Security Symposium (USENIX Security 22) , pages=

  36. [47]

    2024 IEEE Symposium on Security and Privacy (SP) , pages=

    Bolt: Privacy-preserving, accurate and efficient inference for transformers , author=. 2024 IEEE Symposium on Security and Privacy (SP) , pages=. 2024 , organization=

    2024

  37. [48]

    Advances in neural information processing systems , volume=

    Iron: Private inference on transformers , author=. Advances in neural information processing systems , volume=

  38. [49]

    2025 IEEE Symposium on Security and Privacy (SP) , pages=

    Dataseal: Ensuring the verifiability of private computation on encrypted data , author=. 2025 IEEE Symposium on Security and Privacy (SP) , pages=. 2025 , organization=

    2025

  39. [50]

    34th USENIX Security Symposium (USENIX Security 25) , pages=

    Breaking the layer barrier: Remodeling private transformer inference with hybrid \ CKKS \ and \ MPC \ , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

  40. [51]

    Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Tensorshield: safeguarding on-device inference by shielding critical dnn tensors with tee , author=. Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2025

  41. [52]

    2024 IEEE Symposium on Security and Privacy (SP) , pages=

    No privacy left outside: On the (in-) security of tee-shielded dnn partition for on-device ml , author=. 2024 IEEE Symposium on Security and Privacy (SP) , pages=. 2024 , organization=

    2024

  42. [53]

    Advances in neural information processing systems , volume=

    How transferable are features in deep neural networks? , author=. Advances in neural information processing systems , volume=

  43. [54]

    8th International Conference on Learning Representations, ICLR 2020 , year=

    Overlearning Reveals Sensitive Attributes , author=. 8th International Conference on Learning Representations, ICLR 2020 , year=

    2020

  44. [55]

    Advances in Neural Information Processing Systems , volume=

    Partially encrypted deep learning using functional encryption , author=. Advances in Neural Information Processing Systems , volume=

  45. [56]

    MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture , pages=

    DarKnight: An accelerated framework for privacy and integrity preserving deep learning using trusted hardware , author=. MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture , pages=

  46. [57]

    2021 IEEE Symposium on Security and Privacy (SP) , pages=

    CryptGPU: Fast privacy-preserving machine learning on the GPU , author=. 2021 IEEE Symposium on Security and Privacy (SP) , pages=. 2021 , organization=

    2021

  47. [58]

    29th USENIX Security Symposium (USENIX Security 20) , pages=

    Delphi: A cryptographic inference service for neural networks , author=. 29th USENIX Security Symposium (USENIX Security 20) , pages=

  48. [59]

    Proceedings of the 18th International Conference on Mobile Systems, Applications, and Services , pages=

    DarkneTZ: towards model privacy at the edge using trusted execution environments , author=. Proceedings of the 18th International Conference on Mobile Systems, Applications, and Services , pages=

  49. [60]

    17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20) , pages=

    Telekine: Secure Computing with Cloud \ GPUs \ , author=. 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20) , pages=

  50. [61]

    2021 IEEE International Symposium on High-Performance Computer Architecture (HPCA) , pages=

    Cheetah: Optimizing and accelerating homomorphic encryption for private inference , author=. 2021 IEEE International Symposium on High-Performance Computer Architecture (HPCA) , pages=. 2021 , organization=

    2021

  51. [62]

    30th USENIX Security Symposium (USENIX Security 21) , pages=

    \ GForce \ : \ GPU-Friendly \ Oblivious and Rapid Neural Network Inference , author=. 30th USENIX Security Symposium (USENIX Security 21) , pages=

  52. [64]

    2022 IEEE International Symposium on High-Performance Computer Architecture (HPCA) , pages=

    SecNDP: Secure Near-Data Processing with Untrusted Memory , author=. 2022 IEEE International Symposium on High-Performance Computer Architecture (HPCA) , pages=. 2022 , organization=

    2022

  53. [65]

    Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems , pages=

    Client-optimized algorithms and acceleration for encrypted compute offloading , author=. Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems , pages=

  54. [66]

    , author=

    CraterLake: a hardware accelerator for efficient unbounded computation on encrypted data. , author=. ISCA , pages=

  55. [67]

    MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture , pages=

    F1: A fast and programmable accelerator for fully homomorphic encryption , author=. MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture , pages=

  56. [68]

    Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , pages=

    Shredder: Learning noise distributions to protect inference privacy , author=. Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , pages=

  57. [69]

    2021 IEEE 14th International Conference on Cloud Computing (CLOUD) , pages=

    Origami inference: Private inference using hardware enclaves , author=. 2021 IEEE 14th International Conference on Cloud Computing (CLOUD) , pages=. 2021 , organization=

    2021

  58. [70]

    2021 IEEE/ACM 21st International Symposium on Cluster, Cloud and Internet Computing (CCGrid) , pages=

    Pripro: towards effective privacy protection on edge-cloud system running dnn inference , author=. 2021 IEEE/ACM 21st International Symposium on Cluster, Cloud and Internet Computing (CCGrid) , pages=. 2021 , organization=

    2021

  59. [71]

    International Conference on Machine Learning , pages=

    Low latency privacy preserving inference , author=. International Conference on Machine Learning , pages=. 2019 , organization=

    2019

  60. [72]

    2020 IEEE Symposium on Security and Privacy (SP) , pages=

    Cryptflow: Secure tensorflow inference , author=. 2020 IEEE Symposium on Security and Privacy (SP) , pages=. 2020 , organization=

    2020

  61. [73]

    Advances in Neural Information Processing Systems , volume=

    Glyph: Fast and accurately training deep neural networks on encrypted data , author=. Advances in Neural Information Processing Systems , volume=

  62. [74]

    Advances in Neural Information Processing Systems , volume=

    She: A fast and accurate deep neural network for encrypted data , author=. Advances in Neural Information Processing Systems , volume=

  63. [75]

    Advances in Neural Information Processing Systems , volume=

    FALCON: fast spectral inference on encrypted data , author=. Advances in Neural Information Processing Systems , volume=

  64. [76]

    Proceedings of the 19th Annual International Conference on Mobile Systems, Applications, and Services , pages=

    PPFL: privacy-preserving federated learning with trusted execution environments , author=. Proceedings of the 19th Annual International Conference on Mobile Systems, Applications, and Services , pages=

  65. [77]

    Proceedings of the Web Conference 2021 , pages=

    Not all features are equal: Discovering essential features for preserving prediction privacy , author=. Proceedings of the Web Conference 2021 , pages=

    2021

  66. [78]

    Proceedings of the International Conference on Internet-of-Things Design and Implementation , pages=

    SecDeep: Secure and Performant On-device Deep Learning Inference Framework for Mobile and IoT Devices , author=. Proceedings of the International Conference on Internet-of-Things Design and Implementation , pages=

  67. [79]

    Proceedings of the International Conference on Internet-of-Things Design and Implementation , pages=

    DeepObfuscator: Obfuscating intermediate representations with privacy-preserving adversarial learning on smartphones , author=. Proceedings of the International Conference on Internet-of-Things Design and Implementation , pages=

  68. [80]

    2021 16th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2021) , pages=

    Adversarial Mask Generation for Preserving Visual Privacy , author=. 2021 16th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2021) , pages=. 2021 , organization=

    2021

  69. [81]

    2020 IEEE Security and Privacy Workshops (SPW) , pages=

    Sentinet: Detecting localized universal attacks against deep learning systems , author=. 2020 IEEE Security and Privacy Workshops (SPW) , pages=. 2020 , organization=

    2020

  70. [82]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  71. [83]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Controllable guarantees for fair outcomes via contrastive information estimation , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  72. [84]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Fair representations by compression , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  73. [85]

    Proceedings of the European Conference on Computer Vision (ECCV) , pages=

    Towards privacy-preserving visual recognition via adversarial training: A pilot study , author=. Proceedings of the European Conference on Computer Vision (ECCV) , pages=

  74. [86]

    Advances in neural information processing systems , volume=

    Controllable invariance through adversarial feature learning , author=. Advances in neural information processing systems , volume=

  75. [87]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Mitigating information leakage in image representations: A maximum entropy approach , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  76. [88]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    On the global optima of kernelized adversarial representation learning , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  77. [89]

    Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , pages=

    TIPRDC: task-independent privacy-respecting data crowdsourcing framework for deep learning with anonymized intermediate representations , author=. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , pages=

  78. [90]

    ACM Transactions on Computation Theory (TOCT) , volume=

    (Leveled) fully homomorphic encryption without bootstrapping , author=. ACM Transactions on Computation Theory (TOCT) , volume=. 2014 , publisher=

    2014

  79. [91]

    Cryptology ePrint Archive , year=

    Somewhat practical fully homomorphic encryption , author=. Cryptology ePrint Archive , year=

  80. [92]

    Annual Cryptology Conference , pages=

    Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based , author=. Annual Cryptology Conference , pages=. 2013 , organization=

    2013

  81. [93]

    International conference on the theory and application of cryptology and information security , pages=

    Homomorphic encryption for arithmetic of approximate numbers , author=. International conference on the theory and application of cryptology and information security , pages=. 2017 , organization=

    2017

  82. [94]

    Journal of Cryptology , volume=

    TFHE: fast fully homomorphic encryption over the torus , author=. Journal of Cryptology , volume=. 2020 , publisher=

    2020

  83. [95]

    2022 , url =

    Microsoft , title =. 2022 , url =

    2022

  84. [96]

    2022 , url =

    Umang Gupta , title =. 2022 , url =

    2022

  85. [97]

    Introduction to Bayesian Statistics , url =

    Harry Thornburg , year =. Introduction to Bayesian Statistics , url =

  86. [98]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Age progression/regression by conditional adversarial autoencoder , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

  87. [99]

    2009 , url =

    Alex Krizhevsky , title =. 2009 , url =

    2009

  88. [100]

    27th USENIX Security Symposium (USENIX Security 18) , pages=

    \ GAZELLE \ : A low latency framework for secure neural network inference , author=. 27th USENIX Security Symposium (USENIX Security 18) , pages=

  89. [101]

    International conference on machine learning , pages=

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy , author=. International conference on machine learning , pages=. 2016 , organization=

    2016

  90. [102]

    2017 IEEE symposium on security and privacy (SP) , pages=

    Secureml: A system for scalable privacy-preserving machine learning , author=. 2017 IEEE symposium on security and privacy (SP) , pages=. 2017 , organization=

    2017

  91. [103]

    Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pages=

    Oblivious neural network predictions via minionn transformations , author=. Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pages=

    2017

  92. [104]

    Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages=

    Deep learning with differential privacy , author=. Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages=

    2016

  93. [105]

    The 25th Annual International Conference on Mobile Computing and Networking , pages=

    Occlumency: Privacy-preserving remote deep-learning inference using SGX , author=. The 25th Annual International Conference on Mobile Computing and Networking , pages=

  94. [106]

    2016 IEEE European symposium on security and privacy (EuroS&P) , pages=

    The limitations of deep learning in adversarial settings , author=. 2016 IEEE European symposium on security and privacy (EuroS&P) , pages=. 2016 , organization=

    2016

  95. [107]

    2017 ieee symposium on security and privacy (sp) , pages=

    Towards evaluating the robustness of neural networks , author=. 2017 ieee symposium on security and privacy (sp) , pages=. 2017 , organization=

    2017

  96. [108]

    25th USENIX security symposium (USENIX Security 16) , pages=

    Stealing machine learning models via prediction \ APIs \ , author=. 25th USENIX security symposium (USENIX Security 16) , pages=

  97. [109]

    2017 IEEE symposium on security and privacy (SP) , pages=

    Membership inference attacks against machine learning models , author=. 2017 IEEE symposium on security and privacy (SP) , pages=. 2017 , organization=

    2017

  98. [110]

    Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , pages=

    HEAX: An architecture for computing on encrypted data , author=. Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , pages=

  99. [111]

    2019 IEEE International symposium on high performance computer architecture (HPCA) , pages=

    FPGA-based high-performance parallel architecture for homomorphic computing on encrypted data , author=. 2019 IEEE International symposium on high performance computer architecture (HPCA) , pages=. 2019 , organization=

    2019

  100. [112]

    International Conference on Machine Learning , pages=

    Learning adversarially fair and transferable representations , author=. International Conference on Machine Learning , pages=. 2018 , organization=

    2018

  101. [113]

    IEEE Transactions on Knowledge and Data Engineering , volume=

    Deep private-feature extraction , author=. IEEE Transactions on Knowledge and Data Engineering , volume=. 2018 , publisher=

    2018

  102. [114]

    IEEE Transactions on Neural Networks and Learning Systems , year=

    Privacy Enhancing Machine Learning via Removal of Unwanted Dependencies , author=. IEEE Transactions on Neural Networks and Learning Systems , year=

  103. [115]

    Proceedings of the 27th Annual International Conference on Mobile Computing and Networking , pages=

    PECAM: privacy-enhanced video streaming and analytics via securely-reversible transformation , author=. Proceedings of the 27th Annual International Conference on Mobile Computing and Networking , pages=

  104. [116]

    Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining , pages=

    Not just privacy: Improving performance of private deep learning in mobile cloud , author=. Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining , pages=

  105. [117]

    International conference on machine learning , pages=

    Instahide: Instance-hiding schemes for private distributed learning , author=. International conference on machine learning , pages=. 2020 , organization=

    2020

  106. [118]

    2020 IEEE Symposium on Security and Privacy (SP) , pages=

    Enabling rack-scale confidential computing using heterogeneous trusted execution environment , author=. 2020 IEEE Symposium on Security and Privacy (SP) , pages=. 2020 , organization=

    2020

  107. [119]

    2020 20th IEEE/ACM International Symposium on Cluster, Cloud and Internet Computing (CCGRID) , pages=

    Serdab: An IoT framework for partitioning neural networks computation across multiple enclaves , author=. 2020 20th IEEE/ACM International Symposium on Cluster, Cloud and Internet Computing (CCGRID) , pages=. 2020 , organization=

    2020

  108. [120]

    Proceedings of the 11th ACM Symposium on Cloud Computing , pages=

    Vessels: Efficient and scalable deep learning prediction on trusted processors , author=. Proceedings of the 11th ACM Symposium on Cloud Computing , pages=

  109. [121]

    Advances in Neural Information Processing Systems , volume=

    Crypten: Secure multi-party computation meets machine learning , author=. Advances in Neural Information Processing Systems , volume=

  110. [122]

    Advances in Neural Information Processing Systems , volume=

    Cryptonas: Private inference on a relu budget , author=. Advances in Neural Information Processing Systems , volume=

  111. [123]

    30th USENIX Security Symposium (USENIX Security 21) , pages=

    Cerebro: A Platform for \ Multi-Party \ Cryptographic Collaborative Learning , author=. 30th USENIX Security Symposium (USENIX Security 21) , pages=

  112. [124]

    International conference on machine learning , pages=

    Hemet: A homomorphic-encryption-friendly privacy-preserving mobile neural network architecture , author=. International conference on machine learning , pages=. 2021 , organization=

    2021

  113. [125]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308--318, 2016

    2016

  114. [126]

    Task-agnostic privacy-preserving representation learning for federated learning against attribute inference attacks

    Caridad Arroyo Arevalo, Sayedeh Leila Noorbakhsh, Yun Dong, Yuan Hong, and Binghui Wang. Task-agnostic privacy-preserving representation learning for federated learning against attribute inference attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volum...

    2024

  115. [127]

    Wasserstein generative adversarial networks

    Martin Arjovsky, Soumith Chintala, and L \'e on Bottou. Wasserstein generative adversarial networks. In International Conference on Machine Learning (ICML), pages 214--223. PMLR, 2017

    2017

  116. [128]

    Distributed inference and fine-tuning of large language models over the internet

    Alexander Borzunov, Max Ryabinin, Artem Chumachenko, Dmitry Baranchuk, Tim Dettmers, Younes Belkada, Pavel Samygin, and Colin A Raffel. Distributed inference and fine-tuning of large language models over the internet. Advances in neural information processing systems, 36: 0 12...

    2023

  117. [129]

    Low latency privacy preserving inference

    Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. Low latency privacy preserving inference. In International Conference on Machine Learning, pages 812--821. PMLR, 2019

    2019

  118. [130]

    Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack

    Guanzhong Chen, Zhenghan Qin, Mingxin Yang, Yajie Zhou, Tao Fan, Tianyu Du, and Zenglin Xu. Unveiling the vulnerability of private fine-tuning in split-based frameworks for large language models: A bidirectionally enhanced attack. In Proceedings of the 2024 on ACM SIGSAC Confe...

    2024

  119. [131]

    Club: A contrastive log-ratio upper bound of mutual information

    Pengyu Cheng, Weituo Hao, Shuyang Dai, Jiachang Liu, Zhe Gan, and Lawrence Carin. Club: A contrastive log-ratio upper bound of mutual information. In International Conference on Machine Learning (ICML), pages 1779--1788. PMLR, 2020

    2020

  120. [132]

    Enc2: Privacy-preserving inference for tiny iots via encoding and encryption

    Hao-Jen Chien, Hossein Khalili, Amin Hass, and Nader Sehatbakhsh. Enc2: Privacy-preserving inference for tiny iots via encoding and encryption. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking, pages 1--16, 2023

    2023

  121. [133]

    Elements of Information Theory

    Thomas M Cover and Joy A Thomas. Elements of Information Theory. Wiley-Interscience, 2nd edition, 2006

    2006

  122. [134]

    Depth gives a false sense of privacy: \ LLM \ internal states inversion

    Tian Dong, Yan Meng, Shaofeng Li, Guoxing Chen, Zhen Liu, and Haojin Zhu. Depth gives a false sense of privacy: \ LLM \ internal states inversion. In 34th USENIX Security Symposium (USENIX Security 25), pages 1629--1648, 2025

    2025

  123. [135]

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International conference on machine learning, pages 201--210. PMLR, 2016

    2016

  124. [136]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Information Processing Systems (NeurIPS), volume 27, 2014

    2014

  125. [137]

    Bounding training data reconstruction in private (deep) learning

    Chuan Guo, Brian Karrer, Kamalika Chaudhuri, and Laurens van der Maaten. Bounding training data reconstruction in private (deep) learning. In ICML. PMLR, 2022

    2022

  126. [138]

    Adversarial mask generation for preserving visual privacy

    Aayush Gupta, Ayush Jaiswal, Yue Wu, Vivek Yadav, and Pradeep Natarajan. Adversarial mask generation for preserving visual privacy. In 2021 16th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2021), pages 1--5. IEEE, 2021 a

    2021

  127. [139]

    Controllable guarantees for fair outcomes via contrastive information estimation

    Umang Gupta, Aaron M Ferber, Bistra Dilkina, and Greg Ver Steeg. Controllable guarantees for fair outcomes via contrastive information estimation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 7610--7619, 2021 b

    2021

  128. [140]

    Iron: Private inference on transformers

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. Advances in neural information processing systems, 35: 0 15718--15731, 2022

    2022

  129. [141]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1 0 (2): 0 3, 2022

    2022

  130. [142]

    Cheetah: Lean and fast secure \ Two-Party \ deep neural network inference

    Zhicong Huang, Wen-jie Lu, Cheng Hong, and Jiansheng Ding. Cheetah: Lean and fast secure \ Two-Party \ deep neural network inference. In 31st USENIX Security Symposium (USENIX Security 22), pages 809--826, 2022

    2022

  131. [143]

    Telekine: Secure computing with cloud \ GPUs \

    Tyler Hunt, Zhipeng Jia, Vance Miller, Ariel Szekely, Yige Hu, Christopher J Rossbach, and Emmett Witchel. Telekine: Secure computing with cloud \ GPUs \ . In 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20), pages 817--833, 2020

    2020

  132. [144]

    Invariant representations through adversarial forgetting

    Ayush Jaiswal, Daniel Moyer, Greg Ver Steeg, Wael AbdAlmageed, and Premkumar Natarajan. Invariant representations through adversarial forgetting. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 4272--4279, 2020

    2020

  133. [145]

    Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, L \'e lio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Tho...

    2023 arXiv

  134. [146]

    \ GAZELLE \ : A low latency framework for secure neural network inference

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. \ GAZELLE \ : A low latency framework for secure neural network inference. In 27th USENIX Security Symposium (USENIX Security 18), pages 1651--1669, 2018

    2018

  135. [147]

    Neurosurgeon: Collaborative intelligence between the cloud and mobile edge

    Yiping Kang, Johann Hauswald, Cao Gao, Austin Rovinski, Trevor Mudge, Jason Mars, and Lingjia Tang. Neurosurgeon: Collaborative intelligence between the cloud and mobile edge. ACM SIGARCH Computer Architecture News, 45 0 (1): 0 615--629, 2017

    2017

  136. [148]

    Occlumency: Privacy-preserving remote deep-learning inference using sgx

    Taegyeong Lee, Zhiqi Lin, Saumay Pushp, Caihua Li, Yunxin Liu, Youngki Lee, Fengyuan Xu, Chenren Xu, Lintao Zhang, and Junehwa Song. Occlumency: Privacy-preserving remote deep-learning inference using sgx. In The 25th Annual International Conference on Mobile Computing and Net...

    2019

  137. [149]

    Oblivious neural network predictions via minionn transformations

    Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. Oblivious neural network predictions via minionn transformations. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 619--631, 2017

    2017

  138. [150]

    Secdeep: Secure and performant on-device deep learning inference framework for mobile and iot devices

    Renju Liu, Luis Garcia, Zaoxing Liu, Botong Ou, and Mani Srivastava. Secdeep: Secure and performant on-device deep learning inference framework for mobile and iot devices. In Proceedings of the International Conference on Internet-of-Things Design and Implementation, pages 67-...

    2021

  139. [151]

    Mobilellm: Optimizing sub-billion parameter language models for on-device use cases

    Zechun Liu, Changsheng Zhao, Forrest Iandola, Chen Lai, Yuandong Tian, Igor Fedorov, Yunyang Xiong, Ernie Chang, Yangyang Shi, Raghuraman Krishnamoorthi, et al. Mobilellm: Optimizing sub-billion parameter language models for on-device use cases. In Forty-first International Co...

    2024

  140. [152]

    Position: Exploring the robustness of pipeline-parallelism-based decentralized training

    Lin Lu, Chenxi Dai, Wangcheng Tao, Binhang Yuan, Yanan Sun, and Pan Zhou. Position: Exploring the robustness of pipeline-parallelism-based decentralized training. In Forty-first International Conference on Machine Learning, 2024

    2024

  141. [153]

    Prompt inference attack on distributed large language model inference frameworks

    Xinjian Luo, Ting Yu, and Xiaokui Xiao. Prompt inference attack on distributed large language model inference frameworks. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 1739--1753, 2025

    2025

  142. [154]

    Split-and-denoise: Protect large language model inference with local differential privacy

    Peihua Mai, Ran Yan, Zhe Huang, Youjia Yang, and Yan Pang. Split-and-denoise: Protect large language model inference with local differential privacy. arXiv preprint arXiv:2310.09130, 2023

    2023

  143. [155]

    Towards efficient generative large language model serving: A survey from algorithms to systems

    Xupeng Miao, Gabriele Oliaro, Zhihao Zhang, Xinhao Cheng, Hongyi Jin, Tianqi Chen, and Zhihao Jia. Towards efficient generative large language model serving: A survey from algorithms to systems. ACM Computing Surveys, 58 0 (1): 0 1--37, 2025

    2025

  144. [156]

    Secureml: A system for scalable privacy-preserving machine learning

    Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy-preserving machine learning. In 2017 IEEE symposium on security and privacy (SP), pages 19--38. IEEE, 2017

    2017

  145. [157]

    Inf2guard: An information-theoretic framework for learning privacy-preserving representations against inference attacks

    Sayedeh Leila Noorbakhsh, Binghui Zhang, Yuan Hong, and Binghui Wang. Inf2guard: An information-theoretic framework for learning privacy-preserving representations against inference attacks. In 33rd USENIX Security Symposium (USENIX Security 24), pages 2405--2422. USENIX Assoc...

    2024

  146. [158]

    A hybrid deep learning architecture for privacy-preserving mobile analytics

    Seyed Ali Osia, Ali Shahin Shamsabadi, Sina Sajadmanesh, Ali Taheri, Kleomenis Katevas, Hamid R Rabiee, Nicholas D Lane, and Hamed Haddadi. A hybrid deep learning architecture for privacy-preserving mobile analytics. IEEE Internet of Things Journal, 7 0 (5): 0 4505--4518, 2020

    2020

  147. [159]

    Bolt: Privacy-preserving, accurate and efficient inference for transformers

    Qi Pang, Jinhao Zhu, Helen M \"o llering, Wenting Zheng, and Thomas Schneider. Bolt: Privacy-preserving, accurate and efficient inference for transformers. In 2024 IEEE Symposium on Security and Privacy (SP), pages 4753--4771. IEEE, 2024

    2024

  148. [160]

    Mobile edge intelligence for large language models: A contemporary survey

    Guanqiao Qu, Qiyuan Chen, Wei Wei, Zheng Lin, Xianhao Chen, and Kaibin Huang. Mobile edge intelligence for large language models: A contemporary survey. IEEE Communications Surveys & Tutorials, 2025 a

    2025

  149. [161]

    Prompt inversion attack against collaborative inference of large language models

    Wenjie Qu, Yuguang Zhou, Yongji Wu, Tingsong Xiao, Binhang Yuan, Yiming Li, and Jiaheng Zhang. Prompt inversion attack against collaborative inference of large language models. In 2025 IEEE Symposium on Security and Privacy (SP), pages 1695--1712. IEEE, 2025 b

    2025

  150. [162]

    Mitigating information leakage in image representations: A maximum entropy approach

    Proteek Chandan Roy and Vishnu Naresh Boddeti. Mitigating information leakage in image representations: A maximum entropy approach. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2586--2594, 2019

    2019

  151. [163]

    Dataseal: Ensuring the verifiability of private computation on encrypted data

    Muhammad Husni Santriaji, Jiaqi Xue, Yancheng Zhang, Qian Lou, and Yan Solihin. Dataseal: Ensuring the verifiability of private computation on encrypted data. In 2025 IEEE Symposium on Security and Privacy (SP), pages 2378--2394. IEEE, 2025

    2025

  152. [164]

    Flexgen: High-throughput generative inference of large language models with a single gpu

    Ying Sheng, Lianmin Zheng, Binhang Yuan, Zhuohan Li, Max Ryabinin, Beidi Chen, Percy Liang, Christopher R \'e , Ion Stoica, and Ce Zhang. Flexgen: High-throughput generative inference of large language models with a single gpu. In International Conference on Machine Learning, ...

    2023

  153. [165]

    Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks

    Abhishek Singh, Ayush Chopra, Ethan Garza, Emily Zhang, Praneeth Vepakomma, Vivek Sharma, and Ramesh Raskar. Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognitio...

    2021

  154. [166]

    Posthoc privacy guarantees for collaborative inference with modified propose-test-release

    Abhishek Singh, Praneeth Vepakomma, Vivek Sharma, and Ramesh Raskar. Posthoc privacy guarantees for collaborative inference with modified propose-test-release. Advances in Neural Information Processing Systems, 36: 0 26438--26451, 2023

    2023

  155. [167]

    Tensorshield: safeguarding on-device inference by shielding critical dnn tensors with tee

    Tong Sun, Bowen Jiang, Hailong Lin, Borui Li, Yixiao Teng, Yi Gao, and Wei Dong. Tensorshield: safeguarding on-device inference by shielding critical dnn tensors with tee. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 1008--1022, 2025

    2025

  156. [168]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  157. [169]

    Slalom: Fast, verifiable and private execution of neural networks in trusted hardware

    Florian Tramer and Dan Boneh. Slalom: Fast, verifiable and private execution of neural networks in trusted hardware. arXiv preprint arXiv:1806.03287, 2018

    2018 arXiv

  158. [170]

    Nopeek: Information leakage reduction to share activations in distributed deep learning

    Praneeth Vepakomma, Abhishek Singh, Otkrist Gupta, and Ramesh Raskar. Nopeek: Information leakage reduction to share activations in distributed deep learning. In 2020 International Conference on Data Mining Workshops (ICDMW), pages 933--942. IEEE, 2020

    2020

  159. [171]

    Cloud-device collaborative learning for multimodal large language models

    Guanqun Wang, Jiaming Liu, Chenxuan Li, Yuan Zhang, Junpeng Ma, Xinyu Wei, Kevin Zhang, Maurice Chong, Renrui Zhang, Yijiang Liu, et al. Cloud-device collaborative learning for multimodal large language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and P...

    2024

  160. [172]

    Controllable invariance through adversarial feature learning

    Qizhe Xie, Zihang Dai, Yulun Du, Eduard Hovy, and Graham Neubig. Controllable invariance through adversarial feature learning. Advances in neural information processing systems, 30, 2017

    2017

  161. [173]

    Breaking the layer barrier: Remodeling private transformer inference with hybrid \ CKKS \ and \ MPC \

    Tianshi Xu, Wen-jie Lu, Jiangrui Yu, Yi Chen, Chenqi Lin, Runsheng Wang, and Meng Li. Breaking the layer barrier: Remodeling private transformer inference with hybrid \ CKKS \ and \ MPC \ . In 34th USENIX Security Symposium (USENIX Security 25), pages 2653--2672, 2025

    2025

  162. [174]

    Learning robust and privacy-preserving representations via information theory

    Binghui Zhang, Sayedeh Leila Noorbakhsh, Yun Dong, Yuan Hong, and Binghui Wang. Learning robust and privacy-preserving representations via information theory. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 22363--22371, 2025

    2025

  163. [175]

    Edgeshard: Efficient llm inference via collaborative edge computing

    Mingjin Zhang, Xiaoming Shen, Jiannong Cao, Zeyang Cui, and Shan Jiang. Edgeshard: Efficient llm inference via collaborative edge computing. IEEE Internet of Things Journal, 2024 a

    2024

  164. [176]

    No privacy left outside: On the (in-) security of tee-shielded dnn partition for on-device ml

    Ziqi Zhang, Chen Gong, Yifeng Cai, Yuanyuan Yuan, Bingyan Liu, Ding Li, Yao Guo, and Xiangqun Chen. No privacy left outside: On the (in-) security of tee-shielded dnn partition for on-device ml. In 2024 IEEE Symposium on Security and Privacy (SP), pages 3327--3345. IEEE, 2024 b

    2024

  165. [177]

    Trade-offs and guarantees of adversarial representation learning for information obfuscation

    Han Zhao, Jianfeng Chi, Yuan Tian, and Geoffrey J Gordon. Trade-offs and guarantees of adversarial representation learning for information obfuscation. Advances in Neural Information Processing Systems, 33: 0 9485--9496, 2020

    2020

Pith tools

Reviewed June 27, 2026 · model on record in the stance chip above.