Model Inversion in Split Learning for Personalized LLMs: New Insights from Information Bottleneck Theory

TL;DR

This work comprehensively highlights the potential privacy risks during the deployment of personalized LLMs on the edge side and is the first to identify model inversion attacks in the split learning framework for LLMs, emphasizing the necessity of secure defense.

Abstract

Personalized Large Language Models (LLMs) have become increasingly prevalent, showcasing the impressive capabilities of models like GPT-4. This trend has also catalyzed extensive research on deploying LLMs on mobile devices. Feasible approaches for such edge-cloud deployment include using split learning. However, previous research has largely overlooked the privacy leakage associated with intermediate representations transmitted from devices to servers. This work is the first to identify model inversion attacks in the split learning framework for LLMs, emphasizing the necessity of secure defense. For the first time, we introduce mutual information entropy to understand the information propagation of Transformer-based LLMs and assess privacy attack performance for LLM blocks. To address the issue of representations being sparser and containing less information than embeddings, we propose a two-stage attack system in which the first part projects representations into the embedding space, and the second part uses a generative model to recover text from these embeddings. This design breaks down the complexity and achieves attack scores of 38%-75% in various scenarios, with an over 60% improvement over the SOTA. This work comprehensively highlights the potential privacy risks during the deployment of personalized LLMs on the edge side.

Figures (5)

• Figure 1: Collaborative training in split learning scenario
• Figure 2: Visualization for embedding and representation after decoder block 1
• Figure 3: Mutual Information across Transformer Blocks
• Figure 4: System of RevertLM
• Figure 5: Attack performance towards GPT2