Inverting Hidden States: Revealing Multimodal Privacy Leakage in Collaborative LVLM Inference

Researchers propose a multimodal reconstruction attack, RASR, against collaborative LVLM inference, showing that deep hidden states transmitted between edge devices and the cloud can still recover private images and text. Collaborative inference deploys LVLMs by partitioning computation between edge devices and the cloud; although raw inputs are not transmitted, the intermediate hidden states constitute an attack surface. The paper first theoretically analyzes the recoverability of hidden states, proving that under regularity assumptions and a positive semantic–nuisance margin, privacy-relevant visual semantics can still be identified and stably recovered. RASR first obtains initial reconstructions of images and text through modality-specific inverse paths that run in the reverse direction along their respective forward processing pipelines, and then refines both using hidden-state consistency. Evaluations on Qwen3-VL-8B-Instruct and LLaVA-1.5-7B across five datasets show that RASR reduces image reconstruction MSE by about 50% compared with the strongest baseline, and text recovery reaches token accuracy of up to 99%.