LLM-Attacker preprint tests privacy risks in split language models

Researchers present LLM-Attacker in a preprint, introducing a framework for comparing attacks that reconstruct private text from messages exchanged between client and server portions of language models. It records attacker access, datasets and scoring choices, saves predictions for independent scoring, and requires an undefended reference before a defence can pass. In a controlled GPT-2 experiment, giving attackers access to gradients returned during training increased token recovery from 94.20% to 97.38% and exact-document recovery from 13.71% to 37.77%. The experiment tests how evaluation responds to changes in attacker access and is shared with a companion study. Reports distinguish implementation checks from measured attack effectiveness and identify untested attacks.