Local small language models hide task intent when consulting cloud models
Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent
Cryptography and SecurityArtificial IntelligenceDistributed, Parallel, and Cluster Computing
Summary
When small language programs running on a user’s device ask bigger cloud-based programs for help, it can reveal what the user is trying to do, even if sensitive details are hidden. The authors studied how to keep these intentions private by looking at two parts: the background info and the main operation of the task. They created a method called PriCon, which changes the way tasks are asked so the cloud model can help without learning the real goal. Tests showed PriCon almost completely stops the cloud from guessing the user’s intent while still providing useful answers.
What this means in practice
- •For healthcare data teams: Protect sensitive healthcare allocation plans from cloud-side inference while consulting powerful cloud language models.
- •For financial services engineers: Securely query cloud models to assist with portfolio balancing without exposing private investment strategies.
Authors
Yanmeng Wang, Yunxuan Li, Shilong Fan, Yuhan Zheng, Tsung-Hui Chang
Abstract
As local small language models (SLMs) increasingly collaborate with more capable cloud large language models (LLMs), a natural privacy question arises: Can a local SLM obtain cloud LLM guidance while protecting user privacy? Existing privacy-preserving SLM-LLM frameworks primarily hide sensitive values while preserving task semantics, which can still expose what the user is trying to accomplish. For example, allocating scarce medical supplies across hospitals may signal an emerging public-health emergency, while rebalancing an investment portfolio may reveal a private investment strategy, even when names and numerical values are hidden. Recent decoy-based methods further obscure task intent by hiding the real request among alternatives, but stronger protection relies on more decoys or semantic abstraction, increasing overhead or risking utility loss. More fundamentally, existing work does not systematically characterize the components of private task intent or how each should be protected. We therefore introduce task-private consultation, which characterizes task intent through two components: task context and task operation. To the best of our knowledge, this is the first systematic study of these components and their individual and joint protection in local-cloud SLM-LLM consultation. To realize this setting, we propose PriCon, an end-to-end framework that transforms the task itself through recoverable mathematical reformulation rather than hiding it among alternatives. A local closed-loop refinement mechanism further maintains privacy and recoverability throughout consultation. Experiments on 100 tasks show that PriCon reduces cloud-side task-intent inference Hit@1 to nearly 0%, versus 93-99% under sensitive-value removal and 3-30% under decoy-based protection, while preserving cloud-assisted utility.