Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys

In split-LLM training, the security boundary is the network connection between the local node and the cloud. The gap across these elements is the conflict between utility and privacy, you cannot add infinite noise without destroying the model’s ability to learn.

Here is a step-by-step breakdown of the split training architecture, the obfuscation techniques that successfully hide information, and where the weaknesses remain.

The Forward Wire (Activations sent to Cloud)

What can we protect? We can prevent the cloud’s untrusted nodes from seeing raw text. By applying latent-space bottlenecks, injecting Gaussian noise (Differential Privacy), and shuffling row orders, we obfuscate the immediate features of the data.
What cannot we protect (The Gap)? The activations must retain enough semantic meaning for the cloud model to process them usefully. Advanced adversaries can train “shadow models” to map these noisy, compressed activations back to the original text domain.
The Backward Wire (Gradients sent back to Cloud)

What can we protect? We can stop the cloud from identifying real data by exploiting structural flaws. By clipping and noising every single row, including the decoys, we hide the “zero-support” signature that gives away which rows are fake.
What cannot we protect (The Gap)? Gradient inversion attacks. The gradients inherently contain the mathematical direction needed to improve the model. An attacker can use these gradients to reverse-engineer the private labels or inputs, especially since noise is limited by the training budget.
The Decoy Mechanism (Anonymity Sets)

What can we protect? Spatial anonymity within a single training frame. Mixing 32 real rows with 48 synthetic decoys forces the cloud to guess which data to attack at that specific moment.
What cannot we protect (The Gap)? Temporal accumulation over time. If a real row is processed consistently across multiple training epochs, while decoys are randomly generated or handled differently, the cloud can track statistical anomalies across steps to eventually separate real from fake.
The Untrusted Cloud Node Processing

What can we protect? We can withhold the final objective (the loss function) and the ground-truth labels from the cloud’s direct view.
What cannot we protect (The Gap)? The cloud controls its own weights. This forces the trusted local node to send back highly revealing, magnified gradients that bypass standard noise protections. This forces the trusted local node to send back highly revealing, magnified gradients that bypass standard noise protections.