Yuan, Liang, Du, Xiaohu, Luo, Ruikun, Wang, Jinze, Rana, Mashud, Wang, Kaibin, Zhou, Jiangwen, Li, Bo, Xia, Xiaoyu · Oct 28, 2026
arXiv cs.AI paper proposes ADLER to limit private-data leaks in cloud-assisted answers
Markdown · JSON · Original source
The paper’s authors argue that a web assistant can leak private document content through messages exchanged with a cloud model, even when that content appears in neither the approved public view nor the final answer. In their planted-secret audit, speculative decoding sent a secret code to the cloud in rejected drafts, although the answers did not include it. They present ADLER, a protocol for streaming that makes every cloud-bound message depend only on the approved public view and the answer shown to the user. A client-side leakage ledger tracks disclosure in the answer against a public reference process. The authors report that, in their audit, no ADLER configuration exposed the secret beyond the answer. On GSM8K math problems with numerical values masked in the cloud’s input, the authors report that ADLER with an unlimited leakage budget raised exact-match accuracy under lenient answer parsing. For a 0.5B client, accuracy rose from 0.41 to 0.83; for a 1.5B client, it rose from 0.67 to 0.85. Budgets of 16 nats or less left accuracy near the cloud-only baseline. The results illustrate the paper’s central trade-off: allowing more disclosure in answers can improve performance, while the ledger records that disclosure. The abstract does not establish how the protocol performs outside these audits and conditions.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Oct 28, 2026 (2026-10-28).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-13T07:02:14.575Z. First observed: 2026-10-30T06:45:29.188Z. Retrieved: 2026-10-31T06:17:14.156Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The evidence is the paper abstract, not its full methods or results; it does not establish performance beyond the described audit and GSM8K conditions. The abstract does not specify how the reported results generalize to other private-document tasks or deployment settings.
Open question
How does ADLER perform on private-document tasks beyond the reported planted-secret audit and GSM8K conditions?
Source-stated
The authors say collaborative decoding messages can disclose private content absent from both the approved public view and the final answer.
the message transcript can disclose private content that neither the public view nor the answer contains
Source-stated
In a planted-secret audit, speculative decoding sent a secret code in rejected drafts, though it was absent from the answers.
did not include the secret code in its answers, yet sent the code to the cloud in rejected drafts
Source-stated
ADLER is designed so every message to the cloud depends only on the public view and the user-visible answer.
every message to the cloud depends only on the public view and the answer the user sees
Source-stated
On GSM8K with numerical values masked from the cloud, ADLER with an unlimited leakage budget raised reported exact-match accuracy for both tested client sizes under lenient answer parsing.
raises the exact-match accuracy of a 0.5B client from 0.41 to 0.83 and of a 1.5B client from 0.67 to 0.85 under lenient answer parsing
Source-stated
The authors report that budgets of 16 nats or less left GSM8K accuracy near the cloud-only baseline.
budgets of 16 nats or less leave accuracy near the cloud-only baseline on GSM8K
Source and contributor context
Yuan, Liang, Du, Xiaohu, Luo, Ruikun, Wang, Jinze, Rana, Mashud, Wang, Kaibin, Zhou, Jiangwen, Li, Bo, Xia, Xiaoyu · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Large language model
A language model with many learned numerical settings, used to process and generate language.
API
An application programming interface: a defined way for software to request data or actions from another system.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: b867d750-9b74-4cac-8eca-ab10e1ee03ab.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T07:02:14.575Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 1030277fd8396a9b0eee28d5beeeaceb12099dba3f574be8076d4d09c91767a9. Source text hash: 2747f69b34e90af0d516dec2c494b2f961028d37cd0fbe7386f33e99165dee52.
Revision and source-check history
Version 1 · 2026-11-13T07:02:14.575Z
arXiv cs.AI paper proposes ADLER to limit private-data leaks in cloud-assisted answers
The paper’s authors argue that a web assistant can leak private document content through messages exchanged with a cloud model, even when that content appears in neither the approved public view nor the final answer. In their planted-secret audit, speculative decoding sent a secret code to the cloud in rejected drafts, although the answers did not include it. They present ADLER, a protocol for streaming that makes every cloud-bound message depend only on the approved public view and the answer shown to the user. A client-side leakage ledger tracks disclosure in the answer against a public reference process. The authors report that, in their audit, no ADLER configuration exposed the secret beyond the answer. On GSM8K math problems with numerical values masked in the cloud’s input, the authors report that ADLER with an unlimited leakage budget raised exact-match accuracy under lenient answer parsing. For a 0.5B client, accuracy rose from 0.41 to 0.83; for a 1.5B client, it rose from 0.67 to 0.85. Budgets of 16 nats or less left accuracy near the cloud-only baseline. The results illustrate the paper’s central trade-off: allowing more disclosure in answers can improve performance, while the ledger records that disclosure. The abstract does not establish how the protocol performs outside these audits and conditions.
Original source
cs.AI · Article
Source details
Original source date: Oct 28, 2026 (2026-10-28).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-13T07:02:14.575Z. First observed: 2026-10-30T06:45:29.188Z. Retrieved: 2026-10-31T06:17:14.156Z.
Limits
The evidence is the paper abstract, not its full methods or results; it does not establish performance beyond the described audit and GSM8K conditions. The abstract does not specify how the reported results generalize to other private-document tasks or deployment settings.
Open question
How does ADLER perform on private-document tasks beyond the reported planted-secret audit and GSM8K conditions?
Source-stated
The authors say collaborative decoding messages can disclose private content absent from both the approved public view and the final answer.
the message transcript can disclose private content that neither the public view nor the answer contains
Source-stated
In a planted-secret audit, speculative decoding sent a secret code in rejected drafts, though it was absent from the answers.
did not include the secret code in its answers, yet sent the code to the cloud in rejected drafts
Source-stated
ADLER is designed so every message to the cloud depends only on the public view and the user-visible answer.
every message to the cloud depends only on the public view and the answer the user sees
Source-stated
On GSM8K with numerical values masked from the cloud, ADLER with an unlimited leakage budget raised reported exact-match accuracy for both tested client sizes under lenient answer parsing.
raises the exact-match accuracy of a 0.5B client from 0.41 to 0.83 and of a 1.5B client from 0.67 to 0.85 under lenient answer parsing
Source-stated
The authors report that budgets of 16 nats or less left GSM8K accuracy near the cloud-only baseline.
budgets of 16 nats or less leave accuracy near the cloud-only baseline on GSM8K
Source and contributor context
Yuan, Liang, Du, Xiaohu, Luo, Ruikun, Wang, Jinze, Rana, Mashud, Wang, Kaibin, Zhou, Jiangwen, Li, Bo, Xia, Xiaoyu · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Large language model
A language model with many learned numerical settings, used to process and generate language.
API
An application programming interface: a defined way for software to request data or actions from another system.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: b867d750-9b74-4cac-8eca-ab10e1ee03ab.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T07:02:14.575Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 1030277fd8396a9b0eee28d5beeeaceb12099dba3f574be8076d4d09c91767a9. Source text hash: 2747f69b34e90af0d516dec2c494b2f961028d37cd0fbe7386f33e99165dee52.
uncertain · 2026-11-13T07:02:14.575Z · anthropic/claude-opus-5.5
Publication: b867d750-9b74-4cac-8eca-ab10e1ee03ab
attribution — pass: The findings are attributed to the paper's authors, which matches the arXiv abstract. The title's 'arXiv cs.AI' label follows the publisher metadata. The paper's primary category is cs.CR with a cs.AI cross-list, but this does not misattribute the work.
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
summary — uncertain: Missing context: the draft never says the setup pairs a small on-device model with a cloud LLM, so readers cannot see why messages are exchanged or what a 'client' is. Smallest repair: add that clause. 'Nats' and 'cloud-only baseline' are unexplained (suggest term-library entries). The draft also omits the 0.92 full-upload result and the 0.69 zero-leakage program baseline, which frame ADLER's gain. 'Tracks' softens 'bounds'. It also drops the 'regardless of how... the cloud behaves' condition.
pairing a small on-device model with a cloud LLM behind a Web API
date — pass: The originalPublished date of 2026-10-28 matches the v1 submission date in the arXiv submission history.
[Submitted on 28 Oct 2026]
support — pass: Each claim's excerpt matches the abstract. The trade-off sentence is grounded in the ledger recording the disclosure charge for the gain. The limitations and the question do not overstate the evidence or turn benchmark scores into real-world reliability.
The ledger records the disclosure charge associated with this gain
media — pass: The selected media is the verified direct link to the original arXiv abstract page, which is the most relevant access point.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
A language model with many learned numerical settings, used to process and generate language.
Definition referenceAn application programming interface: a defined way for software to request data or actions from another system.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA language model with many learned numerical settings, used to process and generate language.
Definition referenceAn application programming interface: a defined way for software to request data or actions from another system.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv