P2Skill: Privacy Preserving Skill Distillation for Cloud-Local LLM Inference Systems

Myunghoon Ryu; Geunpyo Park; Sungjoon Lee; XinYu Piao; Jong-Kook Kim

cs.CRAug 14, 2026

P2Skill: Privacy Preserving Skill Distillation for Cloud-Local LLM Inference Systems

Authors: Myunghoon Ryu, Geunpyo Park, Sungjoon Lee, XinYu Piao, Jong-Kook Kim

Organizations: Department of Electrical and Computer Engineering, Korea University, Seoul, Republic of Korea

Abstract

Cloud-local LLM inference can use the reasoning capability of large cloud models, but cloud-bound requests must exclude personally identifiable information (PII). Existing privacy-preserving methods modify the prompt or the model, which may distort contextual semantics or require additional training. This paper proposes P2Skill, a prompt-based skill distillation method in which a local small language model (SLM) autonomously performs four skills. A cloud LLM iteratively refines the skills from execution failures to let the local SLM generalize beyond memorized PII patterns, and the final skills are selected at the lowest validation leakage within set bounds. P2Skill requires no privacy-specific fine-tuning or learned auxiliary detectors. On real user queries, P2Skill on the best of three local SLMs transmits fewer annotated identifiers than every existing privacy-preserving method that sends text to the cloud and preserves quality more often than the closest of them in leakage, although fully local answering preserves quality more often.

Figures & tables

Figure 1: Overview of the P2Skill pipeline.

Figure 2: Privacy-preserving decomposition (skill #1) and PII-aware routing (skill #2).

Figure 4: Final response reconstruction (skill #4).

Figure 5: Iterative refinement loop for skill distillation.

		PRISM-160					PUPA test
Local SLM	Method	Leak $\downarrow$	J-Leak $\downarrow$	Q $\uparrow$	IQ $\uparrow$	PQ $\uparrow$	Leak $\downarrow$	J-Leak $\downarrow$	Q $\uparrow$	IQ $\uparrow$	PQ $\uparrow$
–	Cloud Only	100.0	98.9	–	9.06	0.00	100.0	97.0	–	8.66	0.00
	Presidio	37.9	37.9	0.344	8.04	5.03	46.4	49.4	0.528	7.63	4.00
	Presidio+GLiNER	2.3	2.3	0.325	8.01	8.19	22.8	24.4	0.452	7.42	5.61
Gemma4	Local Only	0.0	–	0.938	9.11	–	0.0	–	0.877	8.64	–
	Uniform LDP	69.3	66.7	0.731	8.29	2.81	66.9	73.6	0.567	7.71	2.54

Table 1: Leakage and quality on PRISM-160 and the PUPA test split.

Prompts	SLM	$n$	direct	para- phrased	solvable	fallback	skipped
			cloud		local
PII	Gemma4	80	0.0	77.5	22.5	0.0	0.0
	Qwen3.5	97	12.4	43.3	44.3	0.0	0.0
	Llama3.2	80	43.8	51.2	5.0	0.0	0.0
PII-free	Gemma4	80	27.5	66.2	6.2	0.0	0.0
	Qwen3.5	140	37.1	14.3	48.6	0.0	0.0

Table 2: Sub-task routes of P2Skill (% of the

n

sub-tasks). PII denotes the Medical and Banking prompts of PRISM-160, PII-free its other prompts, and fallback a paraphrase that fails the identifier matcher.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

(a) M11 , Gemma4:e2B, no leak, paraphrased (62 prompts)
Prompt	A 7-year-old female patient named Mia reports symptoms: pain, fatigue, indigestion, bloating. What is the likely diagnosis?
Sub-task	The whole prompt, $p_{1}{=}1$ , cloud paraphrased
To cloud	A 7-year-old female patient reports symptoms: pain, fatigue, indigestion, bloating. What is the likely diagnosis?
Answer	When evaluating a 7-year-old female patient named Mia […], one likely diagnosis […] is celiac disease. […]
Result	Leak 0/0/0, Q tie, IQ 9
P+G	A [AGE_1] female patient named [PERSON_1] reports symptoms: […] (Leak 0, Q loss, IQ 7)

Appendix

Table 3: P2Skill examples on PRISM-160, where P+G denotes the request of Presidio+GLiNER.

Artifact	License or terms
PUPA and PAPILLON code ( Li et al., 2025b )	MIT
WildChat ( Zhao et al., 2024 )	ODC-BY 1.0
PRISM-160 and PRISM code ( Zhan et al., 2026 )	MIT
AI4Privacy pii-masking-200k ( AI4Privacy, 2023 )	AI4Privacy free license
Nemotron-PII ( Steier et al., 2025 )	CC BY 4.0
HotpotQA ( Yang et al., 2018 )	CC BY-SA 4.0

Appendix

Table 4: Licenses and terms of the datasets, models, and tools.

	Gemma4:e2B			Qwen3.5:2B			Llama3.2:3B
Method	Med.	Bank.	Both	Med.	Bank.	Both	Med.	Bank.	Both
Cloud Only	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
Presidio	7.47	2.58	5.03	7.47	2.58	5.03	7.47	2.58	5.03
Presidio+GLiNER	7.88	8.50	8.19	7.88	8.50	8.19	7.88	8.50	8.19
Local Only	8.62	9.53	9.07	8.28	8.95	8.61	7.10	7.85	7.47
Uniform LDP	3.15	2.48	2.81	2.67	2.23	2.45	2.60	2.31	2.46

Appendix

Table 5: Privacy-quality score (PQ) on the PII-containing PRISM-160 prompts, where Med. and Bank. denote the Medical and Banking prompts.

		Leak (count) $\downarrow$		Q $\uparrow$				IQ $\uparrow$
Local SLM	Method	Med./40	Bank./47	Med.	Bank.	Tour.	Gen.	Med.	Bank.	Tour.	Gen.
–	Cloud Only	40	47	–	–	–	–	8.93	9.03	8.90	9.40
	Presidio	1	32	0.275	0.150	0.150	0.800	7.67	8.95	6.60	8.95
	Presidio+GLiNER	0	2	0.350	0.075	0.250	0.625	7.88	8.95	7.15	8.05
Gemma4:e2B	Local Only	0	0	0.850	1.000	0.925	0.975	8.62	9.53	8.93	9.38
	Uniform LDP	27.3	33	0.800	0.975	0.400	0.750	8.72	8.93	7.30	8.20

Appendix

Table 6: Per-domain results on PRISM-160 for the Medical (Med.), Banking (Bank.), Tourism (Tour.), and General knowledge (Gen.) domains.

		PRISM-160					PUPA test
Local SLM	Method	Leak $\downarrow$	J-Leak $\downarrow$	Q $\uparrow$	IQ $\uparrow$	PQ $\uparrow$	Leak $\downarrow$	J-Leak $\downarrow$	Q $\uparrow$	IQ $\uparrow$	PQ $\uparrow$
Gemma4:e2B	PAPILLON (released prompt)	0.0	0.0	0.956	9.05	8.99	28.7	29.6	0.857	8.56	5.33
Gemma4:e2B	P2Skill-RO	0.0	–	0.938	9.12	9.07	11.3	–	0.938	8.68	7.00
Qwen3.5:2B	PAPILLON (released prompt)	16.1	16.1	0.744	8.32	7.29	31.4	33.5	0.657	7.41	4.46
Llama3.2:3B	P2Skill-RO	38.3	–	0.912	8.56	4.40	19.7	–	0.770	7.80	4.90

Appendix

Table 7: Leakage and quality of the exploratory variants, where P2Skill-RO denotes the route-only variant of P2Skill.

	PUPA test			PRISM-160
Skills of	G4	Q3.5	L3.2	G4	Q3.5	L3.2
Gemma4:e2B	15.6	53.6	27.1	0.0	30.7	16.1
Qwen3.5:2B	11.4	27.3	23.4	0.0	10.0	36.0
Llama3.2:3B	62.5 ∗	67.0 ∗	28.3	4.2 ∗	96.9 ∗	66.3

Appendix

Table 8: String-match leakage (%) of cross-SLM skill transfer, where rows give the skills, columns give the executing SLM, and G4, Q3.5, and L3.2 denote Gemma4:e2B, Qwen3.5:2B, and Llama3.2:3B.

Skill Distillation

See all 10 papers

Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent
Sep 26, 2026Yanmeng Wang, Yunxuan Li, Shilong Fan +2Privacy-Preserving Language Models Privacy Protection for LLM Agents
Nanjing University of Posts and Telecommunications, Nanjing, 210023, China · The Chinese University of Hong Kong, Shenzhen, 518172, China
SharedRequest: Privacy-Preserving Model-Agnostic Inference for Large Language Models
Jun 3, 2026Peihua Mai, Xuanrong Gao, Youlong Ding +3Privacy-Preserving Language Models LLM Inference
1National University of Singapore (Chongqing) Research Institute · 2Chongqing Key Laboratory of Trusted Perception and Interaction Technology for Intelligent and Connected Vehicles, Chongqing, China · 3National University of Singapore +3
Your Inference Request Will Become a Black Box: Confidential Inference for Cloud-based Large Language Models
Feb 27, 2026Chung-ju Huang, Huiqiang Zhao, Yuanpeng He +5Privacy-Preserving Language Models Privacy Leakage in Language Models
Key Lab of High Confidence Software Technologies (Peking University), Ministry of Education, China · School of Computer Science, Peking University, Beijing, China · Tencent, Shenzhen, China +1

Sep 26, 2026J/K move · Enter open · S save

Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent

Yanmeng Wang, Yunxuan Li, Shilong Fan, Yuhan Zheng+1

Nanjing University of Posts and Telecommunications, Nanjing, 210023, China · The Chinese University of Hong Kong, Shenzhen, 518172, China

Privacy-Preserving Language Models Privacy Protection for LLM Agents Privacy Leakage in Language Models

Open paper AskPDF arXiv

As local small language models (SLMs) increasingly collaborate with more capable cloud large language models (LLMs), a natural privacy question arises: Can a local SLM obtain cloud LLM guidance while protecting user privacy? Existing privacy-preserving SLM-LLM frameworks primarily hide sensitive values while preserving task semantics, which can still expose what the user is trying to accomplish. For example, allocating scarce medical supplies across hospitals may signal an emerging public-health emergency, while rebalancing an investment portfolio may reveal a private investment strategy, even when names and numerical values are hidden. Recent decoy-based methods further obscure task intent by hiding the real request among alternatives, but stronger protection relies on more decoys or semantic abstraction, increasing overhead or risking utility loss. More fundamentally, existing work does not systematically characterize the components of private task intent or how each should be protected. We therefore introduce task-private consultation, which characterizes task intent through two components: task context and task operation. To the best of our knowledge, this is the first systematic study of these components and their individual and joint protection in local-cloud SLM-LLM consultation. To realize this setting, we propose PriCon, an end-to-end framework that transforms the task itself through recoverable mathematical reformulation rather than hiding it among alternatives. A local closed-loop refinement mechanism further maintains privacy and recoverability throughout consultation. Experiments on 100 tasks show that PriCon reduces cloud-side task-intent inference Hit@1 to nearly 0%, versus 93-99% under sensitive-value removal and 3-30% under decoy-based protection, while preserving cloud-assisted utility.

Abstract

Skill Distillation

Explore similar work

Ask Without Telling: Local SLMs Consult Cloud LLMs Without Revealing Task Intent

SharedRequest: Privacy-Preserving Model-Agnostic Inference for Large Language Models

Your Inference Request Will Become a Black Box: Confidential Inference for Cloud-based Large Language Models