LLMs AND DATA PRIVACY

Integrity Checking Mechanism for PrivacyPreserved Auditing of Cloud Shared-Data

A viable, privacy-friendly auditing framework of clouds which guarantees the end-toend encrypted verification without sacrificing the efficiency is presented.

Regression on encrypted datasets using fully homomorphic encryption 1

Secure Cloud-based EHR Analytics using a Hybrid Homomorphic Encryption and Differential Privacy Pipeline

A Survey on Privacy-Preserving Techniques for Cloud Data Processing Using Homomorphic Encryption and Federated Learning

This paper presents a structured review of privacy-preserving data processing techniques for cloud environments built on HE and FL, individually and in hybrid combination, and identifies promising directions for future research.

Doppio : Communication-Efficient and Secure Multi-Party Shuffle Differential Privacy

SpliTEE: Improving LLM Inference on Trusted Hardware with Differentially Private GPU Outsourcing

User prompts provided to large language models (LLMs) may contain sensitive or private information that can be misused by remotely deployed models, such as through inadvertent memorization during retraining. One way to protect user prompts is to execute the LLM inside a trusted execution environment (TEE), with the guarantee that the service provider has no access to computations performed within or information exchanged with the TEE. However, current TEEs are primarily CPU-based and significantly slower than GPUs optimized for LLM inference. To circumvent this, Tramer and Boneh (2019) proposed Slalom, which splits neural network inference between a TEE and an untrusted GPU and encrypts intermediate inputs sent to the GPU. We extend this split-inference architecture to LLM inference and instead protect intermediate inputs using differential privacy. We show that masking intermediate representations is necessary by showing that a prompt-reconstruction attack can recover prompts from these representations with nearly 80% accuracy. Our main contribution is a global sensitivity analysis of key LLM functions, which bounds the required scale of differentially private noise. Unlike encryption, differential privacy avoids quantization, allowing the LLM to remain in the floating-point domain. We also derive an upper bound on floating-point error from masking and noise cancellation in the TEE as a function of the privacy parameter epsilon. We implement our architecture using Intel TDX and evaluate it with two LLMs: Llama-3.2-3B and Qwen3-4B. Our split execution is nearly twice as fast as fully CPU-based inference inside TDX and 5-15 seconds faster than encryption-based Slalom while achieving higher accuracy. Finally, we demonstrate that prompt reconstruction, even with knowledge of the differential privacy mechanism, cannot recover more information than is contained in an unrelated prompt.