Every prompt sent to a hosted language model is readable by whoever operates the server. A new arXiv paper asks whether that has to be true, proposing a setup where the prompt stays on the client and the host receives transformed vectors instead.
The approach uses a learned input-embedding transform applied to a frozen Qwen3.8-27B model. The idea is that the transformed vectors stand in for the original text, allowing the hosted model to perform inference without ever seeing the raw prompt.
The abstract is truncated in the source, so details on the transform's design and measured privacy-utility trade-offs are not available here. The paper's contribution at this stage is the question itself: can a client-side embedding transform make hosted inference meaningfully more private without breaking the model's behavior?