HiddenEcho: Mitigating Noise Amplification in Differentially Private LLMs with Hidden-State Correction
Authors: Wenhao Li
Kunhao Li
Lei Yang
Venue: ICLR 2026 Poster (2026)
Keywords: LLM
Privacy Preservation
Denoise
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We introduce a server-guided client correction mechanism HiddenEcho that suppresses inter-layer noise amplification under differential privacy, achieving a superior privacy–utility trade-off for LLMs.

Abstract: The rise of large language models (LLMs) has driven the adoption of Model-as-a-Service (MaaS). However, transmitting raw text to servers raises critical privacy concerns. Existing approaches employ deep neural networks (DNNs) or differential privacy (DP) to perturb inputs. Yet, these approaches suffer notable limitations: DNN-based methods often require task-specific pre-training, and conventional DP techniques, though privacy-preserving, suffer from noise amplification as perturbed inputs propagate through the deep transformer layer, leading to significant degradation in downstream task performance. To alleviate this, we propose HIDDENECHO, an end-to-end framework with client noise correction, where hidden states are sent from the server to the client and refined by a lightweight module using both embeddings and intermediate representations. HIDDENECHO suppresses inter-layer noise amplification without pretraining, effectively preserving task-relevant signals under DP constraints. To further reduce communication, HIDDENECHO incorporates gradient-based hidden layer selection and information bottleneck compression, reducing communication cost while preserving essential task information. Experiments across text classification and generation tasks demonstrate that HIDDENECHO achieves up to 46.89\% performance improvement over DP baselines, over 85\% communication reduction, and up to 72.52\% faster training compared to existing denoising approaches, establishing a new privacy-utility trade-off for privatized LLMs. Codes are available at https://github.com/liwh011/hidden-echo.

Published as a conference paper at ICLR 2026
HIDDENECHO: MITIGATING NOISE AMPLIFICATION IN DIFFERENTIALLY PRIVATE LLMS WITH HIDDEN- STATE CORRECTION
Wenhao Li Kunhao Li
School of Software Engineering
South China University of Technology
Guangzhou, China
wenhaol - out look. com, kunhoml fifagga i com
Lei Yang
School Software Engineering
South China University of Technology Guangzhou, China sel wyscutt.eu.......
ABSTRACT
The rise of large language models (LLMs) has driven the adoption of Model-as- a-Service (MaaS). However, transmitting raw to servers raises critical privacy concerns. Existing approaches employ deep neural networks (DNNs) or differ- ential privacy (DP) perturb inputs. Yet, these approaches suffer notable lim- itations: DNN-based methods often require task-specifi pre-training, and con- ventional DP techniques, though preeeyppresrvving suffer from noise amplifi- cation perturbed inputs propagate through the deep transformer layer, lead- ing to significant degradation in downstream task performance. To alleviate this, propose Hi HiddenEcho,
end-to-end framework with client noise correc- tion, where hidden states are sent from the server to the client and refined by lightweight module using both embeddings and intermediate representations. Hi EideEEcho suppresses inter-layer noise amplification without pretraining, ef- fectively preserving task-relevant signals under DP constraints. To further reduce communication, Hi ddenEcho incorporates gradient-based hidden layer selec- tion and information bottleneck compression, reducing communication cost while preserving essential task information. Experiments across text classification and generation tasks demonstrate that HiddenEcho achieves up 46. 46.89% perfor- mance improvement over DP baselines, over 85% communication reduction, and up 72.52% faster training compared existing denoising approaches, estab- lishing new privacy-utility trade-off for privatized LLMs. Codes are available at https://iitub..com/iiiht 1/hidden-echo.
INTRODUCTION
The advancement of large language models (LLMs) has profoundly transformed scientific search Kulmanov et al. (2024); VM et al.] (2024): Li et al. (2023b); Yang et al.] (2024b). The substantial computational costs associated with the growing number of parameters in L.LMs have driven the emergence of the aodeel-a--a-Service (MaaS) paradigm. MaaS offers a platform for users without access high-performance computing resources, enabling them leverage LLMs for var- ious purposes, including inference, fine-tuning, and the development of customized agents (David al. 2014). Nevertheless, MaaS also raises significant security concerns. Specifically, sensitive
"Equal contributions. Corresponding author.

---

Published as a conference paper at ICLR 2026
Client
Server
LDP(d,) in 100)
HiddenEcho 5000)
Train
HiddenEcho (n 100)
HiddenEcho (n 6000)
Dutaset
14.69
Perturbed
Dataset
DP
MSE
Poor task
(a) LDP
10
15
20
performance
(b) EehdenEeho
Good performance
h
Layer
Denoise Module
LLM
Mean squared error (MSE) between clean hidden states and noisy hidden states under different privacy budgets based on Qwen2-1.5B (Yang et 2024a) with hidden layers retaining on the server side the MRPC dataset (Wang al. 2018
Figure 1:
formation, such as personally identifiable information (PII), including names, phone numbers, email addresses, and financial details, may be exposed when users upload data LLM vendors.
Privacy protection for LLMs the MaaS framework mainly relies on cryptography- based and perturbation-basel methods. While cryptographic techniques like secure multiparty computa- tion (Hou et al.] (2044) and homomorphic encryption (Liu & Liu 2023) provide strong security, their high computational overhead makes them impractical for resource-constraneed clients.
In contrast, perturbation-bar methods have gained attention because of their flexibility to add perturbations the data privacy-preserving mechanism. For instance, deep neural network (DNN)-basee perturbation methods leverage learned data distributions to generate perturbed data that can deceive adversaries. However, these approaches typically require pretraining phases for the whole training, limiting their practicality. Differential privacy (DP) as perturbation-base with lower computational overhead, has emerged as an alternative. It introduces noise of specified intensity to the input on the client side before transmitting it to the server. For example, Qu et al. (Qu ct al. 2021 I proposed adding dDP noise (based on x² distance to prevent reconstruction of the original data) to text embeddings, achieving enhanced privacy protection at the cost of reduced accu- racy. However, when such noise is left unprocessed, leads to significant performance degradation in downstream tasks when applied to LLM. Mai et al. (Mai al.] 2024) improve this issue with their SnD framework, which involves pretraining a denoising module on the server and deploying it on the client. This approach filters a part of noises and enhances model performance.
method
Nevertheless, Experiments show that differential privacy noise in text embeddings is progressively amplified through LLM transformer blocks, leading to increasing MSE and significant performance degradation, as seen in the "LDP(dy) (r==100)" curve in Fig [ Existing denoising methods, relying on pretraining and disconnected from LLM dynamics, fail mitigate inter-layer noise effectively.
Based on this, we propose an end-to-end framework HiddenEcho that integrates noise correction the MaaS to protect data privacy LLMs. Unlike existing denoising approaches: (1) eliminates the need for pretraining, enabling effective denoising of inter-layer noise from the server; (2) it fully leverages the internal hidden layer information of LLMs, optimizing their performance; and (3) Con- sidering the communication overhead between the client and server, we introduce a tradieet-based hidden layer filter to identify and select critical hidden layers, alongside an information bottleneck- based dimension reducer retain essential information from the hidden states. This design enables near-complete noise correction with minimal data transmission, striking an effective balance be- tween communication efficiency and model performance. As illustrated by the "HiddenEcho curves in Fig [ in the final hidden layer, HiddenEcho (7=1000) reduces noise (14.69 - 8.31) by 33.43% compared to LDP(d,) (00)
2

---

Published as a conference paper at ICLR 2026
In summary, our contributions are: We identify and analyze the critical issue of noise amplification in LLMs under differential privacy, where injected noise grows progressively through hidden layers, severely degrading model performance. @ We propose Hi HideEchoo, that enables pretraining-fies progressive noise correction via client-side denoising guided by hidden states from server, which is applicable both inference and fine-tuning with balanced privacy, utility, and communication cost. @ We evaluate Hi ddhnEcho in MaaS scenarios, showing up to 46. 89% performance gain in text classification over baselines, over 85% communication reduction with H HiddenEcho, and 72.52% faster denoising compared to existing methods.
end-to-end framework
2 RELATED WORKS
Privacy Preservation for LLMs Privacy preservation in LLMs has become critical with widespread deployment (Miranda et al. 2024). Existing approaches fall into cryptographic and perturbation-based methods. Cryptographic techniques, such as secure multi-party computa- tion (Hou et al., 2024) and homomorphic encryption (Hao et al. 2022 Liu & Liu 2023), offer strong privacy guarantees but incur high computational costs and are limited to defending against external adversaries, making them impractical for essurce-constraine clients. Perturbation-baa methods provide
flexible trade-off between privacy and utility. While some approaches per-
turb model outputs (Liu et al.) (0199) or use adversarial training (Coavoux et al. (2018a), differential privacy has emerged popular choice in the MaaS paradigm due its lightweight noise injection into embeddings (Lyu et al., 2020: Qu et al.) 2021 [hhen et al., 2023 Li et al. (023a)). However. DP noise is amplified through transformer layers, degrading model performance. SnD (Mai al.) 2024) introduces client-side denoising module to mitigate this effect, but fails to fully address noise propagation across deep transformer blocks challenge our work aims to resolve.
PRELIMINARIES
3.1 THREAT MODELS
For language models, attackers typically aim extract sensitive information from the original user data. We consider a split MaaS deployment in which the client hosts the embedding layer and the server hosts the remaining model Shen al. (2023). They follow the protocol but may attempt to infer additional information from observed artifacts. An attacker may be either (i) a malicious
service provider), or (ii) eavesdropper possessing any subset of the following: 1 Perturbed
embeddings: the attacker observes perturbed token embeddings & (xx) = E(x)) + 5 submitted by the client. @ Embedding layer parameters: the attacker observes the embedding matrix Wemb used to map tokens to vectors. As highlighted in (Song & Raghunathan [020 Shen et al.) al., (023)) Embedding Inversion Attacks (EIA) and Attribute Inference Attacks (AIA) represent significant
privacy threats in machine learning:
Definition 1 (Embedding Inversion Attack (EIA)) Given perturbed embeddings Vxx E Rixd and the embedding matrix Wemb, the goal is to reconstruct each token is recovered by
0 = arg min | cmb (2:)
vEV
Definition 2 (Attribute Inference Attack (AIA)) Let A be sensitive attribute. Given auxil- iary labeled samples S = {(#;, ā. the attacker trains
fw R + A
on (V (ī:)).)) āz) and predicts = (z)( for target
3.2 PROBLEM DEFINITION
Based on threat models, we focus on the privacy concerns associated with data transfer between the client and server when utilizing LLMs in the MaaS. In this scenario, the client holds private
dataset X {x), (2,, "2, }_ Following a split learning framework Gupta & Raskar (0018);
Zhang al. (2023b). we mitigate the client's resource constraints by deploying the word embedding
3

---

Published as a conference paper at ICLR 2026
LLM
Dimension Reducer
Forward
Denoise Modulé
Filter
Dimensiceally
Propagation
H denorieed
Reduced Hidden Stares
Server
PEFT Modules
Propagation
Backward
W
Step Transfer
Trainable
Step Filter layers
Parameters
91
Stop food LLM
Hidden States
Down-ssampi kidden states
Noisy Embods
Denoised Hidden State
Step Emeeed tokons
Stop Perturee embods
II
Client
aOCO
Stop
=
Loss
Step 10 Up-sample Task-spectfic denolsed renult
Step
Step
11
Dowe somple
0000 Dimensionally Reduced
Caiculate
clean embests
processing
Denoise Module
Task
Wide
Tokens
Embed Layer
Perturbation
Embodd
Head
Figure 2:
Framework of Hi ddenEcho. The denoise module is deployed the client side, and the operations related to LLM's hidden layer of the Down- nown-sampling, Layer Filter, and Dimension Reducer are deployed on the server side.
layer & of the LLM on the client, while the remaining layers are hosted on the server. To ensure privacy, perturbations based on differential privacy, denoted as 6, are applied the embeddings on the client. The optimization of the global LLM after incorporating these perturbations can be formalized follows:
0" arg min
Σ ZEX
C(O. (E(())) +
X
Here, 9 are the model parameters to be optimized, and V denotes a denoising module. To enhance the feedback received by the client from the server, the design of effective vi for mitigating the impact of added noise on the model's outputs is crucial.
4 METHODOLOGY
Hi ddenEcho leverages hidden layer correction to address noise amplification in LLMs. Under the split learning framework, HiddenEcho reduces transmission significantly with only a minor performance trade-off. Fig- 2 and Algorithm I provide detailed descriptions. The complexity anal- ysis, theoretical justification, and comparison with DP are presented in Appendix D
4.1 FULL NOISE CORRECTION
In H ddenEcho, server-side hidden layer states transmitted back the client for correction. This process is designed to be integrated with the fine-tuning of the LLM.
E(x;) E RRad on the client, where n is the sequence length and d is the hidden size of the server-side L.M.. To ensure privacy, noise is added to embeddings, yeilding E' + 8, which are then transmitted to the server.
Perturbation Tokenized texts are converted to embeddings
Server-side Forward Propagation The server inputs the noisy embeddings E' into the LLM B. During forward propagation, intermediate hidden states H B(E') [Ho. H are col- lected from all L layers. However, injected noise progressively distorts the hidden states' feature space, which prevents LLM from effectively learning the task information. Consequently, denois- ing mechanism is erucial correct these hidden states for effective task learning.
Denoising
The client-side denoising module refines the hidden states received from the server. Drawing inspiration from the LST method (Sung et al. 2022), which uses a dimension-reducee LLM side network for downstream task learning, the denoising module takes the initial noise-free
4

---

Published as a conference paper at ICLR 2026
embedding and the hidden states of the LLM on the server side input. By utilizing the information contained in the initial embedding, generates optimized hidden states: Hedenoised = D H), where D is the denoise module.
The denoise module has a hidden size of d' = d/r, where r is the reduction factor, and has L layers. Each layer contains transformer T; and gate vector 9:- To integrate the server-side hidden states, the input to layer is combination of H; and the previous layer's 's output A; with the gate vector gi controlling the proportion of this mixture. The proportion is computed by μ4; = sigmoid(g:). Thus, the input to the transformer T; is
Z P:A-11 + H.),
(2) A,-1 = Edn, Ed
where Hilh E Raxd" is the downsampled H;. Specifically, for the first layer also represents the downsampled E. The gating mechanism adjusts the influence of the server-side hidden states on the denoising process, ensuring that the refined hidden state optimally balances the client-side and server-side information.
To further enhance the learning ability of the denoise module, residual connections are introduced, which propagate the information of the initial embeddings to the deeper layers, preserving the in- tegrity of the original signals during denoising. The output of layer i is recursively defined as:
A = A,-1 + Ti(2,)
(3)
The downsampling process, along with the subsequent upsampling, is learned by linear layers on the server side to reduce communication cost:
H W
(4)
Edn = Weln (E).
(5)
The final output AL-1 of the denoising module is then upsampled back to the original dimension d to create the denoised hidden state: Hdenolsed Wh (A1-1))
Optimization The denoised hidden state is fed into a task-specific head to generate predictions, and the corresponding loss is computed for model optimization. For classification tasks, the head outputs logits, and cross-entropy loss is applied:
ÿ = Wttkkk/ (ddeniisdd)
C(j. v)
Σ Uo log(ūs),
(8)
where y represents the vector of ground-truth labels. Both the denoising module and the task-specific parameters are optimized to minimize this loss, improving classification accuracy and denoising effectiveness. This ensures denoised hidden states effectively contribute to the task performance.
4.2 COMMUNICATION OVERHEAD REDUCTION
While leveraging all intermediate hidden states yields strong denoising performance, the resulting communication overhead limits practicality. To address this, HiddenEscho incorporates a hidden layer filter and dimension reducer, effectively balancing model performance with communication efficiency and reducing transmission costs without notable performance loss.
Hidden Layer Filter Transmitting all intermediate hidden states between server and client incurs prohibitive communication costs. We observe that not all layers contribute equally the final output, suggesting that selectively transmitting only the most informative layers could maintain performance while reducing overhead.
To quantify the contribution of each hidden layer to the final output, a gradient-bart based filter is de- signed. For given layer i(i < I. 1), gradually vary the value of its hidden state from 0 H,
5

---

Published as a conference paper at ICLR 2026
and observe the corresponding changes in the output of the last layer. Denoting 7, as layer i of the server-side LLM, we have:
H1-1 TT-1= o... T, (H.,),
(9)
where H. is the current value of layer i, and H1-1 is the output of the last layer corresponding to the hidden state H. signifies the sequential application of layers, with each layer's 's output feeding into the next layer in the sequence.
The layer's s contribution C; is defined by the cumulative gradient of these output changes:
/
H.
aff
C H: Ju
(10)
0H,
However, in practice, calculating the continuous integral is computationally challenging. Follow- ing (Dai et al. 2022), we approximate the integral using Riemann summation with m steps:
H
0HL-1 0H,
C
(11)
This calculation is performed before fine-tuning. A small subset sampled from the training dataset. Each sample undergoes standard preprocessing: tokenization, embedding, and perturbation, but not denoising. The server computes the layer contributions for each sample using Eq. (T]) and averages these contributions across all samples.
Layers with the highest k contributions are selected minimize communication overhead while maintaining performance, where k is small hyperparameter. During each forward pass, only these layers' hidden states are transmitted, significantly reducing communication costs. Upon receiving these hidden states, the client's 's denoising module correspondingly skips unselected layers, acceler- ating computation and lowering resource requirements.
Dimension Reducer While layer selection reduces the number of transmitted states, each hidden state remains high-dimensional Projecting the hidden states of the server-side LLM using linear layers is often effective, but it may fail to learn optimal representations due the lack of explicit optimization objectives. We address this by applying the information bottleneck technique (Alemi et al. 2017 compress hidden states while preserving task-relevant information.
In Hi ddenEcho, we formulate dimension reduction as an information bottleneck problem: min- imize the mutual information (MI) between the noisy embedding E' and the downsampled hidden states Hil while maximizing the MI between the denoised output // denoiseed and the downsampled hidden states Hdl. The corresponding loss function is:
n-1 Σ T(E'; - deddnoidedd HH.l)). n2
(12)
Consequently, the overall model optimization loss a combination of the task loss and the informa- tion bottleneck loss, weighted by a, 3::
L= ((..)) + oL.
(13)
Although exact MI computation for high-dimensional variables is inherently challenging (Belghazi et al. 2018). an exact value is often unnecessary for optimization. Based on this, MINE (Belghazi al. 2018). neural network- based approach, is employed to estimate MI effectively. MINE uses a statistics network to learn a function fe that maximizes the difference between its expectation over the joint distribution P(X, Y). and the exponential expectation over the product of the marginal dis- tributions P P(Y) The estimated MI is then approximated by the supremum of this difference. Mathematically, this can be expressed as
max (Ep(x.))(f(X,,, Y)] (epp 0
(14)
I(x;Y) (fxxx.)ff(XXX - exp(Brrxx (3I)))
(15)

---

Published as a conference paper at ICLR 2026
This neural network- based estimator allows for efficient computation of MI in scenarios where traditional methods are computationally prohibitive.
Specially, we prepare two statistics networks for each hidden state H, to estimate the MI [EE; "), and the other to estimate [[Hdeeniee,, _I ). After calculating the task loss at each step, these statistics networks are optimized for several steps according to Eq. equation] Once the
optimization process is finished, the networks are used to compute the MI estimates. The informa-
tion bottleneck loss is computed based on these estimates, as described in Eq. equation
EXPERIMENTS
We evaluate perturbation methods text classification and generation tasks using Qwen2-1.5B and Llama3- (1.54B and 1.23B parameters) for classification, and T5-Large (0.75B parameters) for generation. Datasets include Financial Phrasebank, MRPC, BBC News, and Tweet Annotation for classification; IWSL12014, CNN/DailyMail, and Samsum for generation. Details are provided in Appendix [.2 We employ LoRA fine-tuning via Transformers (Wolf et al.] (020)) and PEFT (Man- grulkar et al., 2022), with AdamW and a constant scheduler (Ir = 1.5e-4). Performance is measured using AUC and Empirical Privacy (Definition 4 for classification (Li et al. 2023a), and BLEU for
generation (Papineni et al. 2002). All experiments run on an NVIDIA RTX 3090 GPU.
Attacks Following prior studies (Song & Raghunathan 2020), we evaluate the privacy protec- tion effectiveness of HiddenEcho and baseline methods under simulated attacks within the split learning framework (Shen et al.) 2023). In our experiments, a white-box attack setting is assumed, where attackers have access user-submitted text embeddings and the parameters of the embed- ding model. As described in 3.1 the Embedding Inversion Attack (EIA) and Attribute Inference Attack (AIA) models used evaluate the effectiveness of privacy preservation methods.
Table I: Performance of different perturbation methods on text classification tasks based on Qwen2- 1.5B.
Dataset
MRPC
Finuncial
BBC News
Privacy Budget
100
1000
5000
6000
100
1000
5000
6000
100
1000
5000
6000
GAN-DP
AUC
0.497
0.532
0.597
0.612
0,501
0.524
0,618
0.629
0.606
0.620
0.684
0.720
EP
1.000
0,999
0.999
0.998
1.000
0.999
0.997
0.992
0.995
0.991
0.971
0,962
LDP
AUC
0.557
0.553
0.599
0.595
0.629
0.617
0.803
EP'
0.988
0.987
0.956
0,867
0.988
0.987
0.967
0.886
0,973
0,972
0.914
0.820
SuD
AUC
0,313
0,313
0.326
0.333
0,358
0.365
0,395
0.630
0.627
0.628
0.629
0.637
AUC
0.646
0.657
0.661
0.667
0.875
0.874
0.883
0.889
0.685
0,803
0.839
0.960
HiddenEcaa
AUC
0.660
0.655
0.666
0.668
0.857
0.855
0.860
0.866
0.732
0.747
0.805
0.951
AUC Improve %
19.78
15.22
11.56
9.15
46.81
46.89
40.38
41.11
12,96
24.30
13.99
19.55
'The EP of SnD and hs ddenEcho is consistent with that of LDP, while GAN-DP differs from the other methods. Suhsequent tables follow this format in reporting EP.
5.1 RESULTS OF EMBEDDING INVERSION ATTACK
We evaluate various methods against embedding inversion attacks in text classification using Qwen2-1.5B under Metric-DP, which is based on dy-privacy budgets 7) 100, 1000, 5000, 6000 (definition in Appendix B results on Llama3- IB are in Appendix J.3] J. We describe the baseline methods in Appendix P.1 Our proposed approach has two variants: HiadenEcho-Full uses all hid- den layers for denoising, while Hi ddenEcho selectively transmits high-impact layers via gradient- based filtering to achieve significantly reduced communication. For comparison, we also evaluate
SnD, which relies on a fixed pre-trained denoising model.
As shown in Table I i dridddeEcch--Pee achieves higher AUC scores, confirming its effectiveness in mitigating noise amplification and delivering the best performance several datasets, with AUC improvements of up to 46.89% (Financial Phrasebank) and 24.30% (BBC News). Interestingly, the more efficient HiddenEcho variant can even outperform HiddenEcho-Ful on MRPC (+19.78%) and BBC News (+12.96%), suggesting that not all layers contribute positively to denoising. In con- trast, SnD underperforms because its fixed model fails adapt to the shifting hidden distributions
7

---

Published as a conference paper at ICLR 2026
Table 2: Ablation study of Hi EdeeEcho text classification tasks based on Qwen2-1.5B.
Dataset
MRPC
Financial
BBC News
Privacy 1 1
100
BiddenBcho
0.660
0.655
0.666
0.857
0.855
0.805
HiddenEcho Res
0.646
0.648
0.658
0.814
0.815
0.819
0.659
0.661
0.729
#iddenBcha LLF
0.637
0.640
0.641
0.773
0.773
0.774
0.629
0.630
0.719
RiddenFcho DR
0.632
0.649
0.644
0.789
0.799
0.801
0.630
0.663
0.789
during fine-tuning, leading ineffective noise removal. See Appendix (..endix..66ea for visualization of the
baselines' classification. Additional EIA evaluation text generation is provided in Appendix [.4 We further compare HiddenEEcho with the federated learning baseline POPri (Hou et al. 2025) in Appendix J.8
5.2 ABLATION STUDY
We conduct ablation studies on Hi BideEEcho, which subsumes all components. We evaluate three variants: removing residual connections (-Res), replacing the Hidden Layer Filter with fixed skip layers LF, and substituting the Dimension Reducer with a linear layer (-DR). As shown in Table 2 the complete HiddenEcho consistently achieves the highest AUC across datasets and privacy budgets, Removing residual connections degrades performance by 1.1%-11.51% with the largest drop on BBC News 19.4%-11.51%% %). Replacing the HLF causes the most significant de- the importance
cline-up to 14.1% (e.g., 0.732-0.6299 on BBC News at (e000)dddmoosttratiii of dynamic layer selection in noise suppression. The DR variant reduces AUC by 0.9%-13.9%, with greater impact on complex tasks (e.g., 6.5%-7.99% drop on Financial).
These results confirm that residual connections stabilize training, the HLF enhances communication and noise control, and the dimension reducer improves feature robustness, collectively ensuring architectural efficacy under DP perturbations.
5.3 RESULTS OF ATTRIBUTE INFERENCE ATTACK
Compared other text classification datasets, the Tweet Annotation dataset includes critical attributes such as the author's age and educa- tion, making it well-suited for attribute infer- ence attacks. Following the approach in (Song & Raghunathan (020), we train an MLP model predict related information for each tweet. For detailed architecture, refer to Appendix [.5] Specifically, we evaluate the model's robust- ness using RMSE for age prediction and Em pirical Privacy (EP) for education inference, where higher values indicate stronger resistance to attacks. As depicted in Fig the red dashed line represents the privacy protection capabil- ity without perturbation. Both Hi HiddenEcho and standard LDP exhibit performance degrada- tion as privacy protection increases. However, except in scenarios with high privacy budgets (e.g., 100), where both methods show nearly comparable, HiddenEcho consistently outperforms LDP terms of privacy protection under other conditions. A discussion potential privacy risks regarding gradient inversion attacks is provided in Appendix H
16
0.5
15
RASE
14
0.5
13
HiddenEcho
HiddenEcho
LDP
0.4
LDP
12
Unpretected
Unpratected
11
10000
Privacy Budget
Privacy Budget
Figure 3: AIA performance on Tweet Annotation Sensitivity etal 2023) with Qwen2-1.5BB
5.4 OPTIMIZATION
We report the optimization process of the HiddenEcho, with results on the BBC News dataset using Qwen2-1.5B visualized in Fig 4 Specifically, compare the optimization trajectories of two configurations: HiddenEcho-Fin which utilizes full hidden layer states, and HiddenEcho, which employs filtered & hidden layers. The evaluation metrics encompass training loss, evaluation
8

---

Published as a conference paper at ICLR 2026
0.50
0.50
Lask
Fan
18
0.75
18
0.75
1.8
0.75
1.5
0.75
103
0.70
0.70
0.70
1.8
0.70
0.55
14-
0.8
0.85
1.-
3.85
12-
0.60
12
0.60
12-
0.60
1.2
3.60
0.55
0.55
Epach
(a) HiddenZcho-Full
(b) HiddenEcho k=4
(c) HiddenEcho k=8
(d) HiddenEcho k=16
Figure 4: Optmization performance of HiddenEchh-Full and HiddenEcho with different hidden layers on BBC News based on Qwen2-1.5B.
Training time cost overhead of different methods for one epoch (left) and communication cost of HiddenEcho-Ful (HE-Full) and H HiddenEcho (HE) for one batch (right).
Table 3:
Training time cost (Secend)
Communication cost (MiB)
Approaches
LDP
GAN-DP
SnD
Approaches
DE Full
Saved
MRPC
125
118
196
85.55%
Financial
74
76
184
115
92
Financial
1.97
0.28
85.79%
BBC News
95
393
118
108
BBC News
10.50
1.50
85.71%
IWSLT
25
26
51
37
IWSLT
6.00
2.25
62.50%
CNNDM
CNNDM
Samsum
32
33
62
40
Samsum
3.05
1.14
62.62%
loss, and evaluation AUC, providing comprehensive view of model convergence and classification performance. During optimization, HiddenEcho-Full shows stable decline in evaluate loss in the early period, while overfitting starting the 14th epoch, with increased evaluation loss and performance degradation, likely due to the use of full hidden layers for correction. In contrast, we observe the optimization trajectories of HiddenEcho with 4, 8, and 16 hidden layers. The 4-layer configuration achieves an AUC above 75% by the 12th epoch. The hidden layer filter in i ddenEcho enables more focused corrections, reducing overfitting. These findings suggest that using fewer hidden layers in HiddenEcho can lead to faster convergence and lower communication overhead without sacrificing performance.
5.5
TIME COST
We compare the time overhead of different methods for perturbing embeddings by recording the training time for one epoch for each method. Statistics are shown in the left side of Table 3] where Q and T denotes Qwen2-1.5B and T5-Large, respectively. Since SnD not applicable to text gen- eration, we do not report statistics for it in this context. The Hi BidenEccho framework, which builds upon LDP, incurs higher computational overhead compared to LDP alone. However, when compared to SnD, which also includes denoising module, Hi HiddenEEho-Full demonstrates faster training speeds, with time costs reduced by up to 72.52% on the BBC News dataset. Although HiddenEcho incorporates additional steps such still achieves faster training speeds due to the use of fewer hidden layers. Notably, while the GAN- DP method based DNN shows advantages in single training epoch, it requires pre-training process for the GAN, which adds to its overall time cost.
hidden layer filter and dimension reduction, it
5.6 COMMUNICATION COST
This section analyzes the communication overhead of Hi ddenEcho. Hi ddenEcho requires trans- mitting hidden layer states between the server and client to enable correction. The full hidden states are transmitted in HiddeeEchh-FFll, resulting in large data volumes and high real-time transmission demands during LLM fine-tuning. In contrast, HiddenEhho compresses communi- cation by selecting key hidden layers for transmission. The communication costs per data batch for both Hiddeccho variants shown in the right side of Table g The results indicate that Hi ddenEcho reduces communication overhead by over 60% compared to HiddenEcho- Specifically, for text classification tasks, it achieves remarkable space saving of over 85%. For text

---

Published as a conference paper at ICLR 2026
generation tasks, which require HiddenEcho filter more hidden layers to achieve optimal per- formance, the space saving is approximately 62%. Under typical network bandwidth, client-server communication using Hi HiddenEcho remains unaffected. A detailed communication conservation analysis is provided in Appendix H Additional analysis on inference-time communication overhead provided in Appendix J.7
CONCLUSION
Large language models (LLMs) in the Model-as-a-Service paradigm enable convenient customiza- tion but raise privacy concern.. While differential privacy (DP) mitigates these risks, it degrades model performance, especially as injected noise is amplified through multi-layer transformer blocks. To address this, we propose H Hidenchho, a split learning-based framework that integrates with hidden layers and supports both fine-tuning and inference. Experiments show that Hi RiddeFchho achieves superior privacy-utility trade-off and significantly improves downstream task perfor- mance under DP constraints, offering a novel solution to noise mitigation in privatized LLMs.
ACKNOWLEDGMENTS
This work was supported in part by Hong Kong RGC Theme-based Research Scheme (TRS) under Grant T43- 513/23-N, in part by the NSFC and Hong Kong RGC Collaborative Research Scheme under Grant 62321 166652,, in part by the Guangdong Basic and Applied Basic Research Foundation under Grant 2025A151501 1996, and in part by the Fundamental Research Funds for the Central Univer- sity under Grant CXTD202406.
REFERENCES
Iwslt2014, international workshop on spoken language translation. httpo://wworkhhop2014
Swslt.orgh 2014.
Alexander A. Alemi, Ian Fischer, Joshua V. Dillon, and Kevin Murphy, Deep variational information bottleneck. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
Rouzbeh Behnia, Mohammadreza Reza Ebrahimi, Jason Pacheco, and Balaji Padmanabhan. Ew- tune: A framework for privately fine-tuning large language models with differential privacy. In 2022 IEEE International Conference on Data Mining Workshops (ICDMW), pp. 560-566. IEEE, 2022.
Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeswar, Sherjil Ozair, Yoshua Bengio, R. Devon Hjelm, and Aaron C. Courville. Mutual information neural estimation. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsmüsssan, Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pp. 530-539. PMLR, 2018
Maximin Coavoux, Shashi Narayan, and Shay Cohen. Privacy-preserving neural representations of text. In 2018 Conference on Empirical Methods in Natural Language Processing, pp. 1-10. Association for Computational Linguisties, 2018a.
Maximin Coavoux, Shashi Narayan, and Shay B Cohen. Privacy-preserving neural representations of text. In 2018 Conference on Empirical Methods in Natural Language Processing. pp. 1-10. Association for Computational Linguistics, 2018b
Damai Dai, Li Dong, Yaru Hao, Zhifang Sui, Baobao Chang, and Furu Wei. Knowledge neurons in pretrained transformers. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 8493-8502, 2022.
Olaf David, Wes Lloyd, Ken Rojas, Mazdak Arabi, Frank Geter, James C Ascough II, Tim Green, George Leavesley, and Jack Carlson. soodel-as---sevvee (maas) using the cloud services innova- tion platform (csip). 2014.
10

---

Published as a conference paper at ICLR 2026
Oluwaseyi Feyisetan, Borja Balle, Thomas Drake, and Tom Diethe. Privacy-an and cuility-preserving textual analysis via calibrated multivariate perturbations. In Proceedings of the 13th international conference on web search and data mining, pp. 178-1861 2020.
Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. SAMSum corpus: human- annotated dialogue dataset for abstractive summarization. In Proceedingss of the 2nd Workshop on New Frontiers in Summarization, pp. 70-79, Hong Kong, China, November 2019, Association for Computational Linguisties.
Derek Greene and Pádraig Cunningham. Practical solutions the problem of diagonal dominance in kernel document clustering. In Proceedings of the 23rd international conference on Machine learning. pp. 377-384, 2006.
Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Nenwork and Computer Applications, 116:1-8, 2018
Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: private inference transformers. In Proceedings the 36th International Conference on Neural Information Processing Systems, pp. 15718-15731, 2022.
Charlie Hou, Mei- Yu Wang. Yige Zhu, Daniel Lazar, and Giulia Fanti. Popri: Private federated learning using preference-optimized synthetic data, 2025. URL httpps://a.xi...rg////// 22504. 16438
Xiaoyang Hou, Jian Liu, Jingyu Li, Jiawen Zhang, and Kui Ren. Faster lookup table evaluation with application to secure Ilm inference. Cryptology ePrint Archive, 2024.
Christoph Kern, Stephanie Eckman, Jacob Beck, Rob Chew, Bolei Ma, and Frauke Kreuter, An- notation sensitivity: Training data collection methods affect model performance. Findings of the Association for Computational Linguistics: EMNLP 2023, pp. 14874-14886, Singapore, December 2023. Association for Computational Linguistics.
Maxat Kulmanov, Francisco Guzmán- Vega, Paula Duek Roggli, Lydie Lane, Stefan T Arold, and Robert Hoehndorf. Protein function prediction as approximate semantic entailment. Nature Ma- chine Intelligence, 6(2):220-228, 2024.
Yansong Li, Zhixing Tan, and Yang Liu. 2023a. services. arXiv preprint S.ti::2305.062111
prompt tuning for large language model
Yinheng Li, Shaofei Wang, Han Ding, and Hang Chen. Large language models in finance: A survey. In Proceedings of the fourth ACM international conference on Al in finance, pp. 374-382, 2023b.
Xuanqi Liu and Zhuotao Liu, Llms can understand encrypted prompt: Towards privacy-computing friendly transformers. arXiv preprint arXiv:2305.1883 2023.
Yi Liu, Jialiang Peng, JQ James, and Yi Wu. Ppgan: prevey-pres generative adversarial net- work. In 2019 IEEE 25th international conference on parallel and distributed systems (ICPADS), pp. 985-989, 989. IEEE, 2019.
Lingjuan Lyu, Xuanli He, and Yitong Li. Differentially private representation for nlp: Formal guarantee and empirical study privacy and fairness. In Findings of the Association for Computational Linguistics: EMNLP 2020, pp. 2355-2365, 2020.
Peihua Mai, Ran Yan, Zhe Huang, Youjia Yang, and Yan Pang. Split-and-denoise: Protect large language model inference with local differential privacy. In International Conference on Machine Learning. pp. 34281-34302. PMLR, 2024.
Pekka Malo, Ankur Sinha, Pekka Korhonen, Jyrki Wallenius, and Pyry Takala. Good debt or bad debt: Detecting semantic orientations in economic texts. Journal of the Association for Informa- fion Science and Technology, 65(4).782-79, 2014.
Sourab Mangrulkar, Sylvain Gugger, Lysandre Debut, Younes Belkada, Sayak Paul, and Benjamin Bossan. Peft: State-of-the-art parameter-efficiet fine-tuning methods, 2022.

---

Published as a conference paper at ICLR 2026
Michele Miranda, Elena Sofia Ruzzetti, Andrea Santilli, Fabio Massimo Zanzotto, Sébastien Bratières, and Emanuele Rodolà. Preserving privacy in large language models: A survey on current threats and solutions. arXiv preprint wrXiv:2408.05212 2024.
Ramesh Nallapati, Bowen Zhou, Caglar Gulcehre, Bing Xiang, et al. Abstractive text summarization using sequence-to-sequueee rnns and beyond. arXiv preprint
2016
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pp. 311-318, 2002.
Chen Qu, Weize Kong, Liu Yang, Mingyang Zhang, Michael Bendersky, and Mare Najork. Natural language understanding with privacy-preserving bert. In Proceedings of the 30th ACM Interna- tional Conference on Information & Knowledge Management, pp. 1488-1497, 2021.
Xicong Shen, Yang Liu, Huiqi Liu, Jue Hong, Bing Duan, Zirui Huang, Yunlong Mao, Ye Wu, and Di Wu. A aplit-and-privatize framework for large language model fine-tuning. arXiv preprint vrXiv:2312.15603 2023.
Congzheng Song and Ananth Raghunathan. Information leakage in embedding models. In Pro- ceedings of the 2020 ACM SIGSAC conference on computer and communications security, pp- 377-390, 2020.
Yi-Lin Sung, Jaemin Cho, and Mohit Bansal. Lst: Ladder side-tuning for parameter and memory efficient transfer learning. In Koyejo. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (eds.), Advances in Neural Information Processing Systems, volume 35, pp. 12991-13005. Curran Associates, Inc., 2022.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 911)), 2008.
Kushala VM, Harikrishna Warrier, Yogesh Gupta, al. Fine tuning Ilm for enterprise: Practical guidelines and recommendations. arXiv preprint PrXiv:2404.1077 2024.
Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. GLUE: A multi-task benchmark and analysis platform for natural language understanding. In Proceedings of the 2018 EMNLP Workshop BlackboxNIPP: Analyzing and Interpreting Neural Networks for NLP, pp. 335- Association for Computational Linguisties, November 2018.
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick VOn Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Transformers: State-of-the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp. 38-45, Online, October 2020. Association for Computational Linguistics.
An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115. 2024a.
Qimin Yang, CHEN JIEXIN, Runqi Su, Tao Tan, et al. Fine-tuning medical language models for en- hanced long-contextual understanding and domain expertise. In First Workshop Long-Context Foundation Models@@ ICML 2024, 2024b.
Rui Zhang, Song Guo, Junxiao Wang, Xin Xie, and Dacheng Tao. A survey on gradient inversion: Attacks, defenses and future directions. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, pp. 5678-685, 2023a.
Zongshun Zhang, Andrea Pinto, Valeria Turina, Flavio Esposito, and Ibrahim Matta. Privacy and efficiency of communications in federated split learning. IEEE Transuctions on Big Data, 95): 1380-1391, 2023b.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural infor- mation processing systems, 32, 2019.
12

---

Published as a conference paper at ICLR 2026
A THE USE OF LARGE LANGUAGE MODELS
The language of this paper was polished using large language models (LLMS) to enhance clarity and readability. The final content and academic integrity remain the responsibility of the authors.
B dx PRIVACY
Differential Privacy (DP) is perturbation-baset orous framework for safeguarding data confidentiality. By introducing carefully calibrated noise during the training or fine-tuning of LLMs. DP makes it significantly harder to extract sensitive information from the perturbed data (Behnia et al. 2022).
mechanism that provides rig-
In particular, the da-bd Metrie-DP method more suitable for text structural embed- dings (Feyisetan et al. 2020). Based on the differential privacy, we define the dy -x-Pricc
Definition (ri-ariyy Let X be the input domain, Y be the output domain, and d be a distance metric over X. A randomized mechanism M X Y satisfies -dx-vviv if for any two inputs x' E X and any subset S S YY the following inequality holds:
(r(M(x) S] {6002(002)
(16)
Pr(M E
where v) 2 represents the privacy budget, controlling the trade-off between privacy and utility.
Hi Rden offers novel solution to mitigate LLM performance degradation caused by noise- based differential privacy mechanisms.
C PRIVACY DEFINITION
Building on prior research (Coavoux et al. 20188), which defines privacy as the adversary's inability infer information about the input from its latent representations, we adopt similar perspective in our work.
Definition 4 (Empirical Privacy) Empirical Privacy (EP) quantifies the adversury's 's inability to or
reconstruct the original input infer sensitive attributes from perturbed text. The degree of privacy protection increases as it becomes more challenging for an attacker to recover the original text or extract sensitive information.
EP = En,ex (((())))
(17)
[X]
where (xx,) represents the embedding layer of the LLM, J denotes a general inversion process, and I indicates the correct predictions.
D TIME AND SPACE COMPLEXITY
D.1 HIDDEnECHO-FULL
The computational cost of Hi ddel is primarily driven by its denoising module. For the time complexity:
Transformer Layers: Each Transformer layer processes hidden states with a complexity of O ( + nd?2), where d' = d/r (reduced hidden size), n is the sequence length, and L is the number of layers. The total complexity for all layers is:
O(I(n2 nat ndd/r²)) /r²)))
2. Down/Upsampling: The linear transformations for downsampling and upsampling the em- beddings have complexity of ((Tndd').
13

---

Published as a conference paper at ICLR 2026
3. Computing gate vectors and performing mixing operations incurs complexity of O(Lnd".
Combining these, the total time complexity is: OL nal /r² + ndd /r)).
For the space complexity:
1. Parameter storage: The Transformer layers and linear transformations require O + Ldd') for storing parameters.
2. Intermediate Representations: The hidden states and gate vectors contribute ( + Idd) to memory usage.
Thus, the total space complexity is:
O[L(d//++nd/ nd/r dr)))
D.2 HIDDENECHO
To address the high communication overhead, Hi dienEcho compresses the hidden layer states using selective filtering and dimensionality reduction. For the time complexity:
1. Hidden Layer Filter: Estimating the gradient a for each approximation step involves 8H; backpropagation through the layers following H; This incurs complexity of O(mn?d) per layer, where m denotes the number of approximation steps. Summing across L layers, the total cost is:
O(mLn'd).
2. Dimension Reducer: Downsampling and upsampling hidden states incur O(ndd"), where d' d/r is the reduced dimension, and is the reduction factor. MINE operations over ny selected layers require O Oknngd"), where the optimization steps for MINE.
The total time complexity is:
O(mLn + knngd/r + nat /r).
For the space complexity:
1. Hidden Layer Filter: Requires ((Ind) for storing gradients and contributions.
2. Dimension Reducer: MINE statistics networks require Onn pled/upsampled states add Onnngd")
Downsam-
The total space complexity is:
(LLnd + agd /12 + nnnd/r).
E COMMUNICATION ANALYSIS
In the i ddenEcho-Full, all L, hidden states of the server-side LLM are transmitted. Each hidden state has dimensions of d, where n represents the sequence length and d'' = d/r denotes the reduced hidden dimension achieved via dimensionality reduction by factor The total communi- cation volume can be expressed as:
VA FuilF
L L-n--
In contrast, the Hiddenchho configuration transmits only n, selected hidden layers, resulting in total communication volume of:
14

---

Published as a conference paper at ICLR 2026
VaiddenEcho = n n
To quantify the reduction in transmission, the ratio of communication volumes between the two configurations is given by:
WiddeenEcho
n d' L d'
11 L
Vaiddenscho-Full
The percentage of transmission volume saved is therefore:
Savings (%)
1
nH L
100.
Example Case: When < L. significant communication savings can be achieved. For instance, consider n = and = 28. The percentage savings transmission volume is calculated as:
-11
4 28
Savings (%)
100 R 87.50%.
F PROOF OF NOISE MITIGATION IN HIDDENECHO
We provide proof demonstrating how the HiddeEEcho-Ful framework mitigates interlayer noise amplification by analyzing noise propagation through transformer layers and the corrective effects of the denoising module.
NOISE AMPLIFICATION IN TRANSFORMER LAYERS
Let the hidden state at the i-th layer be H4, and the corresponding noise be 8,. The hidden state the (i + 1)-th layer can be expressed as:
H4+1 T + 64),
where Ti+1 represents the transformer operation. Due the nonlinear nature of Ti+1, noise 6; propagates and amplified. The noise at the (i + 1)-th layer can approximated as:
8,+1 f(5)),
where f(-) denotes the transformation applied by the layer. The magnitude of 6 is bounded by the Jacobian norm of the transformation:
| S [H,) -|6,1.
where [H,) the Jacobian norm. Defining the noise amplification factor as as = (H,)) obtain:
| || < as 62]] where a; > 1.
Over L layers, the noise the final layer is amplified as:
| < II a. 15ll.
where & denotes the initial noise introduced by the privacy- mechanism.
F.2 NOISE DECOMPOSITION AND DENOISING
The hidden state H; can be decomposed into two components:
H: = S: + ò.s
where:
15

---

Published as a conference paper at ICLR 2026
Sy: Signal component containing task-relevant information.
6, Noise component introduced for privacy preservation.
The HiddenEcho module D utilizes the noise-free initial embedding E and the set of server-side hidden states H {Ho. HI...., HL-13 produce denoised hidden state:
Hdanoised D F, H).
The denoised hidden state can expressed as:
H. S; 0, ddencised
where gdenoised represents the residual noise after applying the denoising module.
F.3 DYNAMIC MIXING AND RESIDUAL CONNECTIONS
The Hi ddenEcho module incorporates dynamic mixing and residual connections to enhance signal retention and suppress noise. The input to the i-th layer of the module is given by:
Z 1 (1 H,
where:
1 Output from the previous layer with reduced noise.
Hdln Wdn (H,): Compressed version of the hidden state, containing both signal and noise.
The gate parameter μ4 (0, 1) dynamically adjusts the contributions of A,-1 and H Expanding Z; in terms of its components:
Z: (S + )A,,,) (1 (s + +HH).
The contributions of signal and noise can be written as
Sz, = A + (1 SS), 8z, = nuô + (1 - p1) p:)6n.
Using the triangle inequality, the noise magnitude satisfies:
| 14
- 1..11
This demonstrates the effectiveness of dynamic mixing and residual connections in amplifying the signal while suppressing sparse noise. Generally, ensures that D E, H)ll
F.4
NOISE REDUCTION AT THE FINAL LAYER
The residual noise after denoising is given by:
DD( E. MIll
||8
gddeoissed
||o||
11811
We have E, HI| > 0, ensuring:
D E, HI
<<
1,
||8||
which implies:
||
gddenissed
||
< ||
Let 0 < 3 gloosed
1. The corrected noise at the i-th layer satisfies:
[
| geemoised S 8.
At the (i + 1)-th layer, the noise satisfies:
denoissed
S 1 1 (gdenoised
By recursively applying this relationship across I. layers, the noise at the final layer satisfies:
f.
|
gdenoised
<
II 8,0;
|
II
asl 6oll = ||1
16

---

Published as a conference paper at ICLR 2026
G COMPARING WITH DP
G.1 PRIVACY GUARANTEE UNDER EMBEDDING-BASED INVERSION
We first analyze the privacy strength of H HiddeEchh compared with the standard DP mechanism under Embedding- Inversion. Let the clean embedding be E and the added DP noise 6, such that the privatized embedding is
E' E
Since the randomization is fully applied at the client side, the transmitted E' already satisfies the DP constraint with privacy budget v/. By the post-proessinng property differential privacy, any further mapping of E' (e.g., the server computing hidden states H B(F") and returning them to the client) does not weaken the privacy guarantee. Therefore, the overall mechanism of Echo satisfies the same Dy-DP guarantec as the bascline DP approach:
DP budeet DP budgetpr 7).
G.2 MODEL ACCURACY AND NOISE AMPLIFICATION
Next, we compare robustness to noise amplification across transformer layers. Denote by the amplification factor of the i-th layer. For the baseline DP mechanism, the accumulated noise the final layer L is bounded by
L a1601)1601.
|| =
16o1l.
where is the initial DP noise the embedding layer. In HiddenEcho, a lightweight client-side correction is applied at each layer with suppression factor 3r E (0, 1), yielding
L [II 1=1
-
3,00 |1bo1--
Since 3, 1, we have
| || < ||
which shows that Hi ddenEcho effectively suppresses inter-layer noise amplification and preserves task-relevant signals under the same DP budget.
G.3 COMMUNICATION COST
Finally, compare the communication overhead. For the baseline DP mechanism, transmitting only embeddings requires
VIP n -
where the sequence length and d the embedding dimension. For HiddenEcho-Full, all hidden layers are downsampled to dimension d' = d/r, resulting in
VilddenBehoo- L d'.
In the communication-efficine variant HiddenEcho, only ny critical layers are transmitted, giv- ing
VatadenFoto = 11 n
The relative saving ratio is
VriddenEcho
TH L
Savings
V VeiddenEche-Full
For example, if L = 28 and nH = 4, the saving is 87.5%, which aligns with our experimental results showing than 85% reduction in classification tasks.
17

---

Published as a conference paper at ICLR 2026
H POTENTIAL PRIVACY RISKS
HiddenEcho's s denoising procedure builds on one-shot Local Differential Privacy (LDP) pertur- bation of client-side embeddings. Consequently, against embedding based inversion attacks, Hid- denEcho inherits the formal privacy guarantees of LDP: since the server receives only the perturbed embedding (E' E + 6), all subsequent processing protected by DP post-processing invariance.
A different situation arises under wradient-based reconstruction attacks, because HiddenEcho re- quires returning certain gradient signals from the client-side denoiser to the server during training. Under threat model, eavesdropping adversary may intercept these gradients. In such cases, HiddenEcho no longer benefits from a provable DP guarantee, since the gradient may, in principle, encode additional information about the client input.
However, mainstream gradient inversion techniques (e.g., Deep Leakage from Gradients (Zhu et al, 2019) and follow-up work) rely fundamentally tively search for "virtual input" whose gradients are computed using the known model architecture and parameters and match the intercepted gradients. White-box access (or a surrogate with high structural fidelity) is crucial for high-quality recovery.
white-box optimization pipeline: they itera-
Under HiddenEcho's deployment setting, the adversary does have access the server-side LLM parameters or weights. They observe only (i) perturbed embeddings and (ii) a small subset of gra- dient signals from the denoiser. As summarized in the recent survey of Zhang al. (2023a), when model parameters are unavailable, gradient inversion becomes dramatically harder: attackers require additional priors, surrogate models, or complex meta-optimization, and recovery quality degrades substantially. Black-box/ sooikkoo//gryybboo scenarios are far less effective than white-box settings.
Thus, while HiddenEcho does not offer formal DP guarantee under gradient interception, the practical feasibility of such reconstruction attacks is significantly constrained by the absence of model parameters.
I WORKFLOW OF HIDDENECHO
Algorithm Caaitimmouttiiii
outlines the training process for HiddenEcho.
Algorithm Workflow of Training Step of HidnEchho
Require: Input tokens x, grouth truth y
Ensure: Loss
Client Phase
1: Embed tokens: ++ Ex=(x;;
2: Inject sampled noise to F: E + F
3: Send F' to server;
Server Phase
4: Compute hidden states: H - B(E"):
5: Filter the hidden states according to the precomputed layer contributions to create subset S;
6: Downsample the hidden states in by Eq. equation
7: Return the downsampled S to client; Client Phase
8: Compute downsampled embeddings Edu by Eq. equation
9: Denoising: Haenolsed <- D(Ed=, SS:
10: Compute task loss Lissk by Eq. equation and Eq. equation
8
11: Optimize the MI estimators by Eq. equation 14
12: Compute information bottleneck loss L1 by Eq. equation 12
13: Compute total loss L by Eq. equation return Loss L:
18

---

Published as a conference paper at ICLR 2026
J EXPERIMENTAL SUPPLEMENTS
J.1 BASELINES
We evaluate Hiddenccho against several strong baselines within the segmented framework, en- compassing standard DP algorithms, DP-based denoising methods, and DNN-based perturbation approaches. The baselines include:
Local Differential Privacy (LDP): Embeddings fed into the LLM's word embedding layer are perturbed with dx-noise (Qu et al., 2021), then transmitted to the server.
In the standard LDP framework for language model inference, the client first maps each input token to its corresponding dense emhedding e Embed(a:) TR To satisfy local differential privacy under the metric dx (e, e') = |le - 12, the client adds calibrated noise 77 drawn from the multivariate Laplace mechanism:
ed
<el7/ll2 B
e 77 where p(n) CaBd exp
(18)
with B = supz~r' |mmbed(x) Embed(x')le denoting the L2 sensitivity of the embed- ding function, and Ca = m (dd(222 being the surface area of the unit sphere in Rd This distribution ensures that for any neighboring inputs x and x', the resulting perturbed embeddings satisfy
p(ê xx)
S exp(e).
(19)
p(ē x²)
which is the formal guarantee of c-dx-privacy. The privatized embedding è is then trans- mitted to the server, which performs downstream inference using the standard LLM archi- tecture without any modification.
GAN-DP: A GAN-based noise addition method designed to perturb embeddings by intro- ducing dx- -based noise of varying magnitudes to generate perturbed vectors.
In the GAN-DP, a generative adversarial network synthesizes privacy- peevacc-preserving noise adapted to the geometry of the embedding space under the dy-privacy notion, where ee,ee) = ||e - e'112- The generator G learns to produce adaptive noise vectors con- ditioned on the clean embedding and a target privacy budget c, while the discriminator DE distinguishes between natural (unperturbed) and perturbed embeddings to preserve se- mantic utility. Given an input token embedding e = Embed(x)) Idd, the client samples latent vector N/O I) and generates privacy-aware noise as
(e 2;,),
(20)
which is added the original embedding yield the privatized representation
e
(21)
During training, the generator is optimized such that the induced distribution over ap- proximates the exponential mechanism required for -privacy
p(ë ee x exp ( (- 6 - el22
where B sup [Embed(x) Embed(x')ll denotes the L2 sensitivity. The adversarial objective further encourages é to remain close to the manifold of real embeddings. balanc- ing privacy and utility. Once trained, only the generator Go is deployed on the client side, enabling efficient, on-device generation of privacy-compliag embeddings without server interaction during inference.
SnD Maa et al. 2024): Da-based denoising approach where the denoising module is pre-trained on the server and then downloaded to the client for noise correction. Embed(z) from
In the SnD framework, the client first computes token embedding the private input x, then perturbs with calibrated noise to satisfy c-dx- --iv-arivacy under the La metrie, yielding the privatized embedding
<1|nnl22
= e n, with p(n) x exp (
(22)
19

---

Published as a conference paper at ICLR 2026
Table 4: Performance of different perturbation methods text classification tasks based on Llama3- IB.
Dataset
MRPC
Financial
BBC News
Privacy Budget 7)
1000
4000
5000
1000
4000
5000
1000
4000
5000
AUC
0.506
0.502
0.513
0.540
0.550
0.576
0.619
0.647
0.664
GAN-DP
EP
0.999
0.998
0.998
0.999
0.999
0.997
0.999
0.989
0.986
AUC
0.489
0.529
0.494
0.561
0.567
0.559
0.619
0.627
0.64T
LDP
EP
0.951
0.889
0.809
0.952
0.897
0.848
0.903
0.803
0.700
SnD
AUC
0.509
0.504
0.507
0.558
0.553
0.572
0.632
0.633
0.633
HiddenScho-Full
AUC
0.654
0.659
0.663
0.894
0.906
0.905
0.978
0.978
0.978
HiddenEcho
AUC
0.645
0.653
0.655
0.828
0.824
0.829
0.971
0.972
0.974
AUC Improve
28.48
24.57
29.24
59.36
59.79
57.12
54.75
51.16
47.29
Table 5: Statistics of datasets.
Dataset
Task
#Train #Dev
#Test
FP
sentiment analysis
1,811
226
227
MRPC
semantic equivalence judgment
3,301
1,725
1,725
BBC News
news topic classification
1225
500
500
Tweet
offensive speech detection
1500
500
500
IWSLT
machine translation
1,044
130
131
CNNDM
summarization
1,322
50
47
Samsum
summarization
2,916
171
150
where B is the L2 sensitivity of the embedding function. The client sends ē to the server, which performs the main LLM inference:
LLM
(23)
The returns y to the client, who then applies pre-trained denoising module Dg downloaded from the server and trained on public data with synthetic d complliaa noise to refine the result using knowledge of the original input and the privacy param- eters (c, B):
Doly: x, e, B).
(24)
This client-side denoising step mitigates utility degradation caused by privacy privacy-preservve preserving perturbation while preserving the formal --dx-privacy guarantee of the initial encoding.
Hi didenEcho-Full. Our end-to-end client-side denoising method transmits the full LLM hidden states for processing.
ii Echn Featuring gradient-based hidden layer filtering and dimensionality reduc- tion via information bottleneck theory to lower communication overhead while preserving performance.
J.2 DATASET DETAILS AND BASE PERFORMANCE
For the text classification task, utilize:
Financial Phrasebank (Malo et al. 2014): A sentiment classification dataset with 4,840
financial news sentences, categorized by annotator agreement rates.
Microsoft Research Paraphrase Corpus (Wang al.) 2018 A sentence pairs dataset col- lected from news articles, each labeled by human annotators to indicate whether the pairs are paraphrases.
20

---

Published as a conference paper at ICLR 2026
Table 6: Performances of centralized fine-tuning six datasets for each L.Ms.
Text Classification
Base Model
Metric
MRPC
Financial
BBC News
1wen2-1.5BB
AUC
0.920
0.976
0.998
Llama3- IB
AUC
0.928
0.980
0.999
Text Generation
Base Model
Metric
IWSLT
CNNDM
Samsum
T5-large
BLEU
34.047
17.738
24.371
Table 7: Performance of different perturbation methods on text generation tasks based on T5-Large.
Dataset
IWSLT
CNNDM
Samsum
Privacy Budget ?
20
30
40
20
30
40
20
30
40
BLEU
0.109
10.309
29.816
5.461
13.572
12.697
4.120
4.964
5.509
GAN-DP
EP
0.883
0.821
0.799
0.460
0.372
0.348
0.503
0.461
0.449
BLEU
0.035
15.553
24.576
0.764
7.974
12.107
2.403
14.602
20.235
LDP
EP
0.994
0.970
0.914
0.987
0.916
0.764
0.989
0.93/
0.806
HiddenEcho-Full HiddenEcho
BLEU
1.092
20.080
26.366
2.915
11.617
12.323
4.618
20.636
21.851
BLEU
0.824
22.403
25.654
0.971
10.925
12.718
4.323
18.192
20.867
BBC News (Greene & Cunningham, 2006
Consists of articles published on the BBC News between 2004 and 2005, with each article categorized into one of five topics: busi- ness, entertainment, politics, sports, or technology.
Tweet Annotation (Kern et al., 2023): : A dataset comprises annotated tweet data for hate speech and offensive language under five experimental conditions, which are utilized for attribute inference attacks.
For the text generation task, we utilize:
IWSIT2004 (IWSLT) 201 2014): dataset for English-to-French machine translation,
focusing spoken language.
CNN Mail Short (CNNDM) NNallapati et al. 2016): A concise version of CNN Dai- IyMail news summaries, paired with fill-in-the-blan questions.
Samsum Short (Samsum): A shortened version from (Gliwa et al.) 2019). comprising messenger-style dialogues with corresponding summaries.
More dataset statistics are reported Table For reference, the ground truth performance of each large model across various datasets is provided in Table 6
J.3 EIA AGAINST FOR TEXT CLASSIFICATION BASED ON LLAMA3-1B
Furthermore, extend to evaluate the performance of baselines against EIA in text classification tasks using Llama3-1B. Given the significant differences embedding layer parameter scales across different LLMss privacy budgets of 1000, 4000, and 5000 selected for this experiment. All other experimental settings are consistent with those outlined in 5.1 The detailed results are presented in T
In contrast to Qwen2- 1.5B. HiddenEcho-FFu Full exhibits clear superiority when applied to Llama3, achieving significantly higher improvements over baselines, with maximum performance gain of
21

---

Published as a conference paper at ICLR 2026
59.79%. Although HiddenEcho typically performs slightly below HiddenEcho-Full, it remains a more advantageous choice in handwidth-constreee scenarios.
J.4 EIA AGAINST FOR TEXT GENERATION BASED ON T5-LARGE
We evaluate machine translation on the IWSLT dataset and text summarization on the CNN Dai- lyMail Short and Samsum Short datasets, using T3-Large the base model. The BLEU scores of Hi ddenEcho and other baseline methods are assessed against EIA at varying f/ Note that SnD's noise reduction model, which processes classification vectors, is unsuitable for text generation tasks.
As shown in Table 7 Hi FridddEEchhoFul consistently demonstrates near-optimal performance, On the IWSLT dataset, ddenEcho-Full achieves the highest BLEU scores at y 20 (1.092) and 40 (26.366), while H HiddenEche outperforms at 30 (22.403). A similar trend is observed on the CNNDM dataset, although diddenEcho- performs suboptimally at lower privacy bud- gets.
The Samsum dataset further confirms di..ddnnnhooPlll's effectiveness, with EiddenEcho-Ful consistently delivering the highest BLEU scores across all privacy budgets (4.618 at 20, 20.636 at = 30, and 21.851 at v = 40). FiddenEcho-Full significantly outperforms GAN-DP and LDP, particularly at lower privacy budgets.
i wwdencchoooFll strikes better balance between privacy and utility text generation, maintain- ing competitive EP values while achieving significantly higher generation quality, particularly in summarization tasks.
J.5 AIA MODEL ARCHITECTURE
The architecture of the attacker model for attribute inference attacks detailed in Table model's output size is set to 4 for education inference and for age prediction.
The
Table & Attacker Model Architecture
Layer
Shape
Input
Batch size 1536 1536 x 768
FC ReLU
FC
768 x Output size
(a) LDP
(b) SnD
(c) GAN-DP
(d) HiddenEcho
Figure 5: Comparison of visualization of (-SNE between baselines and HiddenEcho on the Fi- nancial Phrasebank with Qwen2-1.5B.
J.6 VISUALIZATION
Additionally, extract the output of the final layer of the server-side LLM after training conver- gence and employ t-SNE (Van der Maaten & Hinton 2008) to project the embeddings into a 2D space, maintaining consistent settings across all methods. This visualization enables comparative
22

---

Published as a conference paper at ICLR 2026
analysis of the effects of different perturbation techniques the feature space. Each perturbation algorithm is evaluated under the same privacy budget e.
We conduct experiments using four perturbation baselines the Financial Phrasebank dataset with the Qwen2-1.5B model and of 5000. The results are visualized Fig 5
The visualization of Hi ddenEcho reveals triangular spatial distribution of clusters, with points from the same category forming compact groups. This clustering pattern especially evident in the orange and green categories. highlighting effective feature separation. In contrast, other methods fail to form distinct clusters, with nodes exhibiting dispersed and overlapping distributions. The lack of clear intra-class cohesion and inter-class separation in the embedding space leads to their suboptimal performance.
J.7 ADDITIONAL COMMUNICATION COST
To further demonstrate the practical efficiency of HiddenEcho, we also measured its inference-ting communication overhead on three representative generation benchmarks: IWSLT (machine transla- tion), CNNDM (abstractive summarization), and SamSum (dialogue summarization). As shown in Table [ the reported values represent the per-sample autoregressive communication cost (normal- ized relative full activation transmission), where Avg denotes the mean across all samples in the dataset, and Min/Max indicate the smallest and largest costs observed for any single sample.
Notably, even on long-output tasks like CNNDM, the average overhead remains below 0.75x, with many samples (e.g.. in SamSum) requiring as little as 0.17x, This confirms that HiddenEccho effec- tively reduces communication during decoding, especially by leveraging incremental updates and state caching between Prefill and Decode stages
Table 9: Inference communication cost overhead of Hi #ideEeEoho for epoch.
Dataset
Avg
Min
Max
IWSLT
0.27MiB
0. D.1M
0.92MiB
CNNDM
0.73MiB
0.30MiB
1.09MiB
Samsum
0.28MiB
0.17MiB
0.44MiB
J.8 COMPARISON WITH FEDERATED LEARNING METHOD
Table 10: Performances of POPri on different tasks based on Qwen2-1.5B.
Task
Metric
Task
Metric
Classification
AUC
Generation
BLEU
Financial
0.615
IWSLT
30.604
MRPC
0.596
CNNDM
10.570
BBC News
0.727
Samsum 8.231
To enable a more comprehensive comparison with state-of-the-ar federated learning approaches, we report the performances of POPri Hou et al. (2025) on different tasks in Table 10 It is important to note that direct alignment of privacy settings between our method and POPri not feasible, as their mnivacy-preseree generation optimized via client DP feedback, while our approach relies on split learning with client- side noise injection. To ensure fair comparison, adopt the original privacy parameters reported in POPri's ' experiments without modification.
mechanism fundamentally differs from ours. POPri leverages synthetic data
The results show that POPri generally underperforms text classification tasks. It achieves rela- tively better performance only on the IWSLT translation task in terms of BLEU score, but still lags behind our method most other benchmarks.
23

---

Published as a conference paper at ICLR 2026
J.9 PARAMETER SENSITIVITY OF INFORMATION BOTTLENECK
Our experiments on the Financial dataset (Table 11) show that the hyperparameter 3 critically bal- ances privacy and utility:
0.1, AUC is only 0.779 due insufficient task-relevant signal retention; performance peaks at 3 = 0.5 (AUC= = and /3 = 1 (AUC= 0.823); but rises sharply 0.612 when 3 5. This because 3 governs trade-off, which targets on minimizing mutual information between noisy embeddings and compressed states (for privacy) while preserving mu- tual information between denoised outputs and compressed states (for utility). Values of [0.5, 1] achieve the optimal balance between these competing objectives.
Table 11: Sensitivity of 3 on Finantial dataset based on Qwen2-7B.
3
0.1
0.5
AUC
0.779
0.826
0.823
0.612
J.10 ADDITIONAL ABLATION RESULTS
Table 12: Additional Ablation Study of HiddenEcho on Financial dataset based on Qwen2-7B.
Privacy Budget
100
1000
5000
6000
A
0.573
0.571 0.569
0.576 0.565
0.577
0.567
0.569
We added two comparison schemes for the ablation studies: Scheme A uses the original denoising module structure, with inputs limited to dimension-reduced clean embeddings and the final-layer hidden state (in the split learning architecture, the server only feeds back the final hidden layer to the client to complete the task prediction loop, which is an inherent constraint of data interaction under this paradigm, the last hidden layer must serve the fixed input benchmark); Scheme takes noisy embeddings and intermediate hidden states as denoising module inputs. Scheme A isolates the independent contribution of clean embeddings in denoising, while Scheme B highlights the role of the server's intermediate hidden layers in noise correction.
Experiments the FP dataset and Qwen2-1.5B model show both schemes performed poorly. This confirms dimensionalit--redueed clean embeddings and server-side noisy hidden states are comple- mentary and indispensable. The former provides the basic noise correction signal, while the latter delivers task-related deep features. Only their combination supports effective task learning.
24


Reviews:
[{"review_id": "rOuSpGnxEx", "reviewer": "Reviewer_UaRs", "summary": "This paper proposes a method, HiddenEcho, which splits an LLM where the client has the embedding layer and the rest of the model is on the server side. The main insight is that adding privacy at the token embedding level amplifies errors at each layer of the transformer, so denoising intermediate hidden states can help reduce the noisiness of the outputs. \n\nSpecifically in HiddenEcho the client sends noised client embeddings to the server, where the server calculates hidden layers and send the most important ones back to the client. The client then uses the original noise-free token embeddings plus the (noisy) intermediate hidden states and inputs them into a denoiser which then uses a combination of the clean embeddings and the noisy intermediate hidden states to produce an output hidden state for downstream task usage. \n\nThe contributions as claimed by the paper are as follows:\n1. Analyzes noise amplification in LLMs coming from token embedding perturbation\n2. Introduces HiddenEcho (as discussed above)\n3. Shows large performance gains and efficiency improvements", "questions": "Questions listed above", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- This paper makes progress on a difficult and important problem: how do we ensure DP in the MaaS setting?\n- The method is fairly novel and interesting. In particular I find the formulation of adding hidden states together in equation 2 pretty new and thought it was interesting to learn that it works\n- The authors consider a range of text classification baselines and they seem fairly comprehensive\n- Thorough ablations give insight into specific design choices.", "weaknesses": "- One concern I have is in the generality of the method. Specifically, I think this method would not support the next-token-prediction task well. From what i understand, you would need to do this 'Echo' for each new token you generate, which makes this quite expensive considering clients typically have slow upload speeds. Not being able to support next-token-prediction is pretty big drawback I think, as it limits us to encoder-based tasks like summarization and classification (which are largely getting done by autoregressive models anyways!). Furthermore each 'Echo' would cost more privacy.\n- As far as I can tell, it is not clear how small the denoising network is. It is a transformer, so understanding how small it is compared to the full LLM that is stored on the server side would be nice to understand how scalable this solution is. Most clients in this setting are small which is the motivation of this splitting approach.\n- What needs to be communicated to the server side to enable backprop on the server LLM? I think in general it would be good to be more explicit about what is being communicated, and how it compares in communication cost to other baselines (not just HE-full). One thing to compare against would be just not running any denoising.\n- Comparison and discussion with \"federated learning\" methods would be ideal. For example you could train a small model on a downstream task and have it perform inference on the client side. Is HiddenEcho better than that? Some representative modern work in FL (some of which have adapted to incorporate LLMs):\n\nKairouz, Peter, et al. \"Practical and private (deep) learning without sampling or shuffling.\" International Conference on Machine Learning. PMLR, 2021.\n\nChoquette-Choo, Christopher A., et al. \"Privacy amplification for matrix mechanisms.\" arXiv preprint arXiv:2310.15526 (2023).\n\nHou, Charlie, et al. \"Private federated learning using preference-optimized synthetic data.\" arXiv preprint arXiv:2504.16438 (2025).\n\nTan, Bowen, et al. \"Synthesizing privacy-preserving text data via finetuning without finetuning billion-scale llms.\" arXiv preprint arXiv:2503.12347 (2025).\n\nWu, Shanshan, et al. \"Prompt public large language models to synthesize data for private on-device applications.\" arXiv preprint arXiv:2404.04360 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QiQlXvvC6q", "reviewer": "Reviewer_v3aX", "summary": "This paper introduces HiddenEcho, a split-learning framework designed to mitigate noise amplification in large language models (LLMs) under differential privacy (DP) constraints. The method employs a lightweight client-side denoising module that refines selectively transmitted hidden states from the server by leveraging both clean embeddings and intermediate representations. To minimize communication overhead, HiddenEcho utilizes an integral-gradient-based hidden layer selection mechanism and an information bottleneck–based dimension reducer to retain task-relevant information. Experimental results on text classification and generation tasks across multiple LLM architectures demonstrate that HiddenEcho achieves substantial performance gains over existing DP baselines while significantly reducing communication cost.", "questions": "1. What is the impact of varying the information bottleneck coefficient β on privacy–utility trade-offs? As well as the layer-selection hyperparameter k.\n2. Does sending intermediate hidden states to the client alter the formal DP guarantee? Is the overall protocol still (ε,δ)-DP or only empirically private?\n3. Because in this method, the filter is precomputed on a subset before fine-tuning. I’m wondering does distribution shift make selections stale? Did you try dynamic re-selection during training?\n4. Are selected layers typically contiguous or scattered? Any patterns shown over different depth or dataset?\n5. Since HiddenEcho transmits and corrects only a subset of hidden layers, gradient flow during training becomes sparse across the full transformer. How does this partial backpropagation affect optimization stability and representation alignment between the selected and unselected layers? Have you observed any degradation or convergence issues compared to full-layer backpropagation, and how does the method mitigate this potential imbalance?\n6. What are the formal guarantees and empirical attack outcomes when an eavesdropper can observe both E’ (embedding with noise) and the returned hidden states (server→client) across training/inference, with proper DP composition and channel-security assumptions made explicit?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "This paper explicitly characterize and address the intermediate layer noise amplification problem in DP-based LLMs. The framework is comprehensive, including the gradient-based layer selection, information bottleneck compression and denoising module. Experimental results consistently suppress baseline methods over diverse datasets and backbone models. This paper also provide theoretical proofs and analyses which strength the technical credibility.", "weaknesses": "1. The experiments are conducted on 1B or 1.5B parameter models, while scalability to lager model is not shown, which may limit the scalability of this work. \n2. While three ablations are presented, there is no evaluation isolating the impact of the information bottleneck parameter β.\n3. Selection uses a Riemann-sum gradient proxy (Eq. 11) but the paper doesn’t show that high-contribution layers are the ones that improve downstream utility, nor how sensitive selection is to the step count m.\n4. Experiments assume a white-box attacker on embeddings/embedding-matrix, but not on returned hidden states or repeated releases across epochs.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gSTgg8saOY", "reviewer": "Reviewer_p3hP", "summary": "This paper studies the issue of privately sharing text data in a split learning framework where a client and a server own different parts of an LLM. The client own the first embedding layer and the final fine-tuning layers. The server owns the main attention layer blocks. Directly sharing embeddings can lead to privacy leakage through embedding inversion and attribute inference attacks, thus a solution is to share noisy embeddings. The noise however propagates through the network leading to low utility. \n\nThis paper tackles the issue of noise amplification by introducing a denoising strategy, where the server sends the paramters of the hidden layers to the client and the client denoises those layers with access to the original text. The client then uses the denoised hidden layers together with the last few layers to complete one training step. To mitigate the communication cost of the hidden layer paramters, the authors propose using dimensionality reduction on the layers and selecting only the most relevant layers. \n\nWith this approach, the authors achieve between 10-40% increase in AUC compared to other differential privacy approaches for classification tasks.", "questions": "The client sends gradients from the denoised hidden layers to the server. The denoising of the hidden layers uses the original embeddings as input. Is it correct that there could be some privacy leakage through the backprops from the denoised hidden layers?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Authors show substanative improvement over prior methods. \n\n- Authors provide comprehensive experimental results.", "weaknesses": "- I belive the approach has limited applications due to the high communication costs of (1) split learning, where client and server communicate for each forward and backward pass and (2) the additional cost introduced by this paper of sharing the hidden state parameters. \n\n- Prior work and baselines are not sufficiently well described: please explain DP-GAN and SnD in more detail. LDP, while simple, also needs some explanation.\n\n- Please add explanation for the d_X-DP notation where it is first used, or better to replace with \"metric-DP\".", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kyNykoje0q", "reviewer": "Reviewer_WawF", "summary": "The paper presents HiddenEcho, an end-to-end framework that introduces client noise correction to address the issue of noise amplification in LLMs under differential private input embeddings. The main motivation for this paper is the usage of LLMs as Model-asa-Service (MaaS). In these setups, DP noise is added to text embeddings for preserve user privacy. However, this noise gets progressively amplified as it passes through the transformer layers, significantly degrading model performance. HiddenEcho works by having the server send hidden states back to the client, where a lightweight denoising module uses both the original embeddings and intermediate representations to correct the noise. The framework includes gradient-based hidden layer selection and dimensionality reduction of hidden embeddings to reduce communication overhead. Experiments on selected classification and generation tasks show that HiddenEcho achieves up to 46.89% performance over DP baseline.", "questions": "1. What is the memory overhead on the client side? Usually, the client devices can't support models larger than 1-2 GB (this is after considering the high end devices) and usually embedding layers of an large scale LLM is significantly large. \n2. In Model-asa-Service (MaaS) setups, we will not know the clients data distribution apriori. In such scenarios, how can we get the client model adapt to new inputs? how would we precompute layer contributions? Or do the authors think their model is robust to shift in data distribution?\n3. \"However, when compared to SnD, which also includes a denoising module, HiddenEcho-Full demonstrates faster training speeds.\" -- SnD trains the denoising module on server where one could utilize latest GPUs and larger clusters to train these models. However, HiddenEcho aims to train the denoising model on-device where resources will be the bottleneck. In my opinion, inference time comparison is more reasonable here. How does HiddenEcho compare with other baselines in terms of inference latency and inference compute FLOPs?\n4. The eval loss shown in Figure 4a doesn't seem to be converging but AUC improved. Can authors provide more insights on this?\n5. Can you add two more baselines to Table 2: 1) the performance on a small on-device model which only uses \"Dimensionally Reduced Clean Embeds\" for the given task, vs 2) the performance of the server-side model without any denoising? This will basically help us understand the contribution of noisy server-side embeddings vs reduced clean on-device embeddings to the correctness of predicted outcome.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper address an import problem of user (input) privacy when using LLMs as a Service. The paper presents an end-to-end framework to which addresses the noise amplification through the model when DP noise is added to the token embeddings before leaving the device. The proposed method learns a denoising module that takes compressed clean embeddings and a few selected & compressed hidden states from the base LLM as inputs and outputs the final predictions.\n2. The paper presents experimental results on classification and generation tasks showing the benefits of the proposed method.\n3. The paper also studies Embedding Inversion Attack (EIA) and Attribute Inference Attack (AIA) to measure the empirical privacy of the proposed method.\n4. Paper presents an ablation study to show the benefit of each design choice ie the residual connections, hidden layer filtering and dimensionality reduction with a linear layer.\n5. The paper also analysis communication overhead introduced by the proposed method.", "weaknesses": "1. The framework mentions training the model on the client but it is unclear if the model is trained in a federated fashion (federated split learning in particular) across a set of clients or if it is trained locally on each client. \n2. The proposed method introduces additional communication cost between the service and client.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)