Privacy and threat models

To evaluate a private inference system, ask six questions:

1. Which values should remain private?
2. Which metadata can each party see?
3. Which parties must follow the protocol?
4. Which parties must not collude?
5. Who receives the output?
6. What evidence supports each answer?

In PLLM's prepared public-weight path, prompts, decoded output, seeds, masks, private scales, and model state stay with the client. The preparation and inference services both hold the public transformer body. Preparation receives stage seeds before inference starts. Inference receives prepared corrections and masked integer tensors later.

This path assumes that both services follow the protocol and do not collude. If you run preparation yourself, that trust stays within your own boundary. Two services controlled by the same operator do not provide meaningful non-collusion.

Authentication and replay controls protect the transport, but they do not protect against every malicious participant. Timing, traffic volume, public model identity, tensor shapes, and approximate sequence length may remain visible.

Use research evidence records to evaluate a specific privacy claim. Do not infer privacy from the number or names of the services alone.