Unresolved cross-tensor attacks on the split-LLM protocol

Investigate whether cross-tensor attacks other than the implemented rotation-invariant cross-Gram feature can extract private information from the concatenated forward activation and returned-gradient views of the two-node split-LLM training system.

Background

The paper evaluates a cross-Gram invariant formed from the forward activation matrix and returned gradient, exploiting their shared per-request rotation. That feature remains at the no-attack floor on both defended and naked captures. However, the authors explicitly distinguish this negative result from the broader class of cross-tensor attacks: other ways of jointly processing the forward activations and returned gradients were not evaluated. Such attacks could potentially exploit information that is not exposed by the specific cross-Gram construction tested in the paper.

References

Under the two implemented emitters, the joint-view effect therefore runs through the concatenated gradient block's own content, not through the rotation-cancelling cross-term; other cross-tensor attacks remain open.

— Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys  (2609.04382 - Politis et al., 3 Sep 2026) in Section 5.2, subsection “Does the leak survive a configuration worth deploying?”