AlienLM: Alienization of Language for API-Boundary Privacy in Black-Box LLMs

TL;DR

This work tackles plaintext exposure at the API boundary in black-box LLM deployments by introducing AlienLM, a privacy layer that translates text into an Alien Language using a vocabulary-level bijection and recovers plaintext on the client side. It enables API-only adaptation through Alien Adaptation Training (AAT), maintaining strong task performance across multiple backbones while significantly limiting recovery of plaintext by adversaries. The approach relies on proxy embeddings to optimize the bijection under black-box constraints and introduces an adjustable alienization ratio $\rho$ to balance opacity and utility. Extensive experiments across seven benchmarks and multiple models demonstrate robust performance retention ($>81\%$ of Oracle) and strong resistance to recovery under three observer scenarios, with domain adaptation and multi-tenant considerations discussed for deployment. While not offering formal cryptographic guarantees, AlienLM provides a practical, deployable solution for privacy-preserving LLM use in API-only environments, alongside clear directions for safety, alignment, and scalable key management.

Abstract

Modern LLMs are increasingly accessed via black-box APIs, requiring users to transmit sensitive prompts, outputs, and fine-tuning data to external providers, creating a critical privacy risk at the API boundary. We introduce AlienLM, a deployable API-only privacy layer that protects text by translating it into an Alien Language via a vocabulary-scale bijection, enabling lossless recovery on the client side. Using only standard fine-tuning APIs, Alien Adaptation Training (AAT) adapts target models to operate directly on alienized inputs. Across four LLM backbones and seven benchmarks, AlienLM retains over 81\% of plaintext-oracle performance on average, substantially outperforming random-bijection and character-level baselines. Under adversaries with access to model weights, corpus statistics, and learning-based inverse translation, recovery attacks reconstruct fewer than 0.22\% of alienized tokens. Our results demonstrate a practical pathway for privacy-preserving LLM deployment under API-only access, substantially reducing plaintext exposure while maintaining task performance.

Figures (7)

• Figure 1: Overview of AlienLM: client-side translation via a vocabulary-level bijection, server-side processing on alien text, and lossless decoding back to plaintext using shared token IDs under a permuted mapping.
• Figure 2: Figure 2. (a) Domain-specific AAT results (General Avg, GSM8K, Code Avg across training configurations; dashed line marks the full baseline). (b) Average performance vs. alienization ratio $\rho$; lower $\rho$ permutes fewer tokens.
• Figure 3: Key diversity across seeds. Pairwise token overlap between seed-specific bijections remains low, supporting per-tenant keys and practical key rotation.
• Figure 4: Examples of alienized text across alienization ratios ($\rho$). Green spans indicate tokens that change surface form under the alien tokenizer; $\langle$U$\rangle$ denotes non-ASCII/unicode markers.
• Figure 5: Pairwise token-overlap heatmap between seeds (overlap ratio, %; lower is better).