Web assistant method protects private data while improving answer accuracy
Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger
Cryptography and SecurityArtificial Intelligence
Summary
When people use web-based AI helpers to answer questions about their private documents, sometimes secret information can accidentally leak to the AI service. The researchers found that this leakage can happen even if the final answer and the user's question don't reveal the secret. They designed a new method called ADLER that ensures messages sent to the cloud only contain safe information, preventing hidden leaks. Their method also improves how accurately smaller on-device AI models can answer questions without exposing private data.
What this means in practice
- •For mobile app developers: Create mobile assistants that answer private user questions with improved accuracy without risking hidden data leaks to cloud services.
- •For cloud service engineers: Build cloud APIs that receive only approved public information during joint answer generation, ensuring compliance with privacy constraints.
Authors
Liang Yuan, Xiaohu Du, Ruikun Luo, Jinze Wang, Mashud Rana, Kaibin Wang, Jiangwen Zhou, Bo Li, Xiaoyu Xia
Abstract
Web assistants increasingly answer questions about a user's private documents by pairing a small on-device model with a cloud LLM behind a Web API. In collaborative decoding, the document stays on the client, and the cloud receives only a public view that the user approves, such as the question alone, but the two models exchange messages while the answer is generated. We show that the message transcript can disclose private content that neither the public view nor the answer contains. In a planted-secret audit, speculative decoding with private drafts did not include the secret code in its answers, yet sent the code to the cloud in rejected drafts. We present ADLER, a decoding protocol for streaming LLM APIs in which every message to the cloud depends only on the public view and the answer the user sees, regardless of how the client combines the two models or how the cloud behaves. A client-side leakage ledger then bounds how much the answer itself reveals relative to a public reference process built from the cloud's replies. In the audit, no ADLER configuration exposed the secret beyond the answer. On GSM8K math problems with numerical values masked in the cloud's input, ADLER with an unlimited leakage budget raises the exact-match accuracy of a 0.5B client from 0.41 to 0.83 and of a 1.5B client from 0.67 to 0.85 under lenient answer parsing, close to the 0.92 achieved by uploading the full problem. It also exceeds a zero-leakage program baseline (0.69) by 0.14 and 0.16, respectively. In this baseline, the cloud writes a program that the client runs offline using the private numbers. The ledger records the disclosure charge associated with this gain; budgets of 16 nats or less leave accuracy near the cloud-only baseline on GSM8K.