Privacy Leakage in Split-LLM Training: A Security Case Study

A security case study of a two-node split-LLM training system revealed that while the privacy evaluation passed, an observable channel was left untested. The Trusted Local Node (TLN) sends protected activations to the Untrusted Cloud Node (UCN), which returns output, and TLN, holding the private loss, returns the output gradient. The frame received by UCN mixes real rows with decoys, and the loss ignores decoys, revealing real rows through a pattern of zeros. This finding highlights potential vulnerabilities in privacy checks.