Privacy
Results
What one node can recover under five ways of running a model.
Five ways to run a model, one question: given a single node's view, how much of the prompt comes back? Each is scored against live model shares.
| Setup | Recovered | Why |
|---|---|---|
| Hosted API | 100% | Your prompt arrives as plain text and can be logged. |
| Open weights, local | 100% | Raw activations are visible at every layer. |
| Open-weight obfuscation | 100% | Any transform you apply, an attacker with the weights can undo. |
| Sharded, multi-node | 94–100% | Every hop handles real activation tensors. |
| PRINET, one 2PC share | 0.21% | At chance: no better than guessing. |
| Chance baseline | 0.20% | What a node would get by guessing. |
Anything that does not split the data leaks almost all of it. A single PRINET share recovers 0.21%, against a chance baseline of 0.20%.
The full method is in the paper.