Edge cloud split models leak sensitive info despite protections
Label-Budgeted Attribute Inference from Protected Features in Edge-Cloud Split Multimodal LLMs
Cryptography and Security
Summary
When some parts of a language model run on a personal device and send early results to a server, people think private data like images stays safe. But the authors show that servers can still guess personal details like age, gender, or race from the data sent. They built a way to measure how well privacy holds up when servers have access to some labeled examples. Their tests found that even protection steps don’t fully stop servers from learning sensitive info from the shared data in real use.
What this means in practice
- •For mobile device developers: Design data transmission in split models to better prevent leakage of user attributes like age or gender from intermediate features.
- •For cloud service engineers: Evaluate and enhance privacy measures on intermediate data received from edge devices, considering limited labeled data attackers might have.
Authors
Junguang Yao, Peichun Hua, Hanxiu Zhang, Yue Zheng
Abstract
Edge-cloud split inference runs the early layers of a multimodal large language model (MLLM) on a device and sends intermediate features to a server to complete the task. While keeping raw images local is often perceived as a privacy benefit, an honest-but-curious server can still infer sensitive attributes, such as age, gender, and race, from the received features. Existing protections intervene at the input, transmitted representation, or model's responses, but their native evaluations rely on final-response refusals or fixed-classifier failures, which underestimate an adaptive server's capabilities. To address this, we propose a label-budgeted attribute-inference framework that measures representation-level privacy through a recovery curve: the share of the unprotected leakage the server recovers as a function of its labeled-sample budget, from zero (a classifier trained on unprotected features) to a full labeled set. Our evaluation across two popular MLLMs reveals two critical findings. First, in unprotected pipelines, intermediate features leak all three attributes regardless of the split depth. Second, even when protection mechanisms are deployed across different stages, sensitive information remains recoverable under limited label budgets. For example, Safe-LLaVA removes biometric content from the model's responses, but from the features it transmits in split inference, 20 labeled samples per class recover 75-85% of the unprotected leakage. This work provides a label-budgeted measure of feature-level privacy for split MLLM inference and motivates defenses that act on the transmitted representation.