The privacy ledger: five new ways your AI gives away too much

Search without telling

The good news first. Amora, a preprint on communication-efficient private approximate nearest-neighbors search, cuts online communication by 93 to 99 percent compared to the state-of-the-art Pacmann system — while achieving higher search accuracy. The trick is a dual-PIR layout that shifts the cost model of private information retrieval from per-vertex to per-partition. Private search has historically been a tax everyone agrees to in principle and nobody pays in practice; a two-orders-of-magnitude communication cut changes the negotiation. m:…0459

The shields that don't shield

The bad news starts on-device. BiShield-TEE audits a popular protection for phone-deployed LLMs — hiding model weights inside a trusted execution environment via unilateral matrix transformations — and finds it vulnerable to what the authors call the Solution Determinacy Property: attackers can uniquely determine the obfuscation secret. Existing methods GroupCover and ArrowCloak are reduced to negligible protection under these attacks, with attack accuracy exceeding 2.4 times the full-shielding black-box baseline. The shield was decorative. m:…2437

The paper's own fix, bilateral obfuscation of input and output dimensions, induces ambiguous solutions — hiding the true key among multiple valid candidates. If you ship weights on devices, the question to ask your vendor is not whether the weights are obfuscated. It is whether the obfuscation is unilateral. m:…2437

Embeddings leak too. Encoded but Exposed shows cosine-similarity attacks can recover item identities from language embeddings in recommender systems — and that item-level leakage propagates to user re-identification. The vector you thought was a representation turns out to be a fingerprint. Obfuscating item descriptions creates a leakage-utility tradeoff, the authors note, which is the polite way of saying you can have private or useful, and the dial is stuck between. m:…8060

Training and seeing

Federated fine-tuning, the technique that was supposed to keep data on devices, has its own entry. Federated Art Chase finds backdoor attacks achieving up to 54.7 percent attack success with less than 1 percent clean-accuracy loss — the poisoned model behaves normally until it doesn't. FLTrust, a defense, reduces the backdoor rate to 1.8 percent even at 30 percent malicious client participation. There is also a quieter result: label-count recovery in small federated settings is less accurate than uniform guessing, a small mercy for privacy in the 5-to-10-client regime. m:…7650

And then there is what the models can see. KoreaGEO, a study of multimodal geolocation, finds that input modality exerts a stronger influence on localization precision and privacy exposure than model scale or architecture — what you feed the model matters more than how big it is. High-risk captions substantially boost geolocation accuracy in vision-language models, and mainstream VLMs show structural prediction biases toward core cities. Post a photo with a careless caption and the model knows where you live. The privacy surface is not just your weights and your embeddings. It is your inputs. m:…4684

Audit the whole surface: the retrieval path, the on-device weights, the embeddings you hand to third parties, the federated training loop, and the inputs your users paste in. The ledger grows every week; the defenses that hold — Amora's partitioned PIR, bilateral obfuscation, FLTrust — share a shape. They assume the attacker is already inside the room. m:…0459 m:…2437 m:…8060 m:…7650