Multimodal activation sharing can leak attributes hidden from model outputs

A split inference system protects some raw inputs by processing initial layers near the user, then sends hidden-state vectors to a remote server. Those vectors can still carry information about visible attributes. A server that can observe activations and train probes may infer attributes the product did not intend to display.

The paper reports sensitive-attribute inference from transmitted intermediate multimodal representations with limited labeled examples, recovering a substantial share of the reference leakage despite output-facing protections. The reported 75-85 percent figure in the checkpoint is relative to a baseline leakage level, not an absolute accuracy guarantee. No real user records or breach are documented in this paper.

Evaluate privacy directly at the chosen split boundary, not only through redaction of final text. Access controls and tested representation transforms remain separate defenses. Moving a compute stage to an edge device is not a proof that upstream hidden states reveal no user information. Primary evidence.

Additional evidence and trust boundary

Output filtering does not erase protected features already encoded in intermediate activations transmitted to an external server. The attacker in this study is a server receiving permitted split-inference features, not a remote user extracting attributes from a published answer. A privacy claim for edge processing should specify which representations leave the device and measure conditional attribute inference against an attacker who has access to them. Supporting record.