Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys
The privacy check missed the return path: zero gradients marked the real rows every time.
In the tested split-LLM setup, decoy rows passed the forward privacy check, but the loss ignored them, making their returned gradients exactly zero. Across nine seeds, that zero pattern identified all 4,096 real rows in every run. A content attack recovered only about one extra token per hundred over baseline, but the authors say the gradient channel still broke the privacy claim. Clipping and adding noise closed this measured leak at a small quality cost, while other attack classes were not tested. HF Daily Papers' note
In the tested split-LLM setup, decoy rows passed the forward privacy check, but the loss ignored them, making their returned gradients exactly zero. Across nine seeds, that zero pattern identified all 4,096 real rows in every run. A content attack recovered only about one extra token per hundred over baseline, but the authors say the gradient channel still broke the privacy claim. Clipping and adding noise closed this measured leak at a small quality cost, while other attack classes were not tested. HF Daily Papers' note
score 5