Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs

Mohamed Shaaban; Mohamed Elmahallawy

cs.CRSep 28, 2026

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs

Authors: Mohamed Shaaban, Mohamed Elmahallawy

Organizations: School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

Abstract

Large language models (LLMs) are increasingly deployed in privacy-critical domains (e.g., healthcare, finance, and government), but their propensity to memorize and disclose personally identifiable information (PII) poses serious security and compliance risks. Existing defenses typically force a trade-off between model utility, privacy protection, and access to fine-tuned private knowledge. We propose LoRA-Oriented Control via Keyed Entry Tokens (Locket), a practical framework that embeds fine-grained, policy-driven access control directly into LLM generation. Locket trains a set of lightweight LoRA (Low-Rank Adaptation) adapters, each encoding a distinct access policy (e.g., full reveal, partial redaction via PII masking, or reveal under a specified differential privacy level). A compact gating module is trained to associate a learned keyed entry token with exactly one LoRA adapter via sequence-level hard routing; the presence of a valid token acts as an authorization key that unlocks corresponding private knowledge, while an invalid or absent token triggers a privacy-preserving adapter that redacts or sanitizes sensitive content. This design ensures Locket remains fully compatible with off-the-shelf LLMs, supporting scalable deployment while satisfying regulatory and privacy requirements. We evaluate Locket across multiple datasets (Enron, ECHR, Yelp) and a diverse set of state-of-the-art LLMs, including Qwen3 (1.7B and 8B), Meta's Llama-3.2 (1B and 3B), and Google's Gemma-2-2B. Our extensive experiments demonstrate that, when the correct token is provided, Locket preserves perplexity comparable to fine-tuning on raw data (without any defense). Conversely, when the token is missing or invalid, it substantially reduces PII leakage while maintaining utility and perplexity on par with strong baseline defenses.

Figures & tables

Fig. 1 : Perplexity comparison on the Llama-3.2-1B model without defense and with scrubbing as a defense, compared with our Locket framework. Locket preserves utility by gating the revealing adapter when the correct organization key is provided and ensures privacy by gating the scrubbing adapter when the key is missing or incorrect—effectively balancing utility and privacy.

Fig. 2 : An illustration of Locket ’s workflow for developing the revealing and defended adapters.

Fig. 3 : An illustration of the two-pass inference mechanism; gating pass and adapter pass in Locket Framework.

Fig. 4 : Training curve of the gating module: mean gating entropy (y-axis) versus training steps (x-axis) for the Llama-3.2-1B router. The entropy reduction indicates increasing confidence in adapter selection as training progresses.

Model	Access	ECHR		Yelp
Model	Condition	50 (%)	100 (%)	50 (%)	100 (%)
Llama-3.2-1B	Correct Key	$29.41$	$19.35$	$22.00$	$7.69$
Llama-3.2-1B	Wrong/No Key	$11.76$	$7.25$	$3.64$	$3.51$
Qwen3-1.7B	Correct Key	$22.73$	$16.67$	$16.95$	$11.48$
Qwen3-1.7B	Wrong/No Key	$5.33$	$2.53$	$5.36$	$1.61$
Gemma-2-2B	Correct Key	$65.82$	$60.76$	$58.33$	$65.22$

TABLE I : Inference attack accuracy (%) across datasets and models for candidate sizes 50 and 100. Values are percentages (%) of correctly identified candidates.

Model	Access	ECHR		Yelp
Model	Condition	Prec. (%)	Rec. (%)	Prec. (%)	Rec. (%)
Llama-3.2-1B	Correct Key	$9.06$	$6.81$	$15.44$	$2.86$
Llama-3.2-1B	Wrong/No Key	$11.32$	$0.19$	$12.50$	$0.29$
Qwen3-1.7B	Correct Key	$11.12$	$8.60$	$15.38$	$2.43$
Qwen3-1.7B	Wrong/No Key	$13.04$	$0.10$	$4.55$	$0.07$
Gemma-2-2B	Correct Key	$0.00$	$0.00$	$0.28$	$0.14$

TABLE II : Extraction attack performance across various datasets and models. Values indicate precision and recall (%) averaged over all attack trials.

PII Class	Correct Key			Wrong/No Key
	Acc. (%)	Adapter Selected		Acc. (%)	Adapter Selected
		Reveal (%)	Defended (%)		Reveal (%)	Defended (%)
PERSON	40.62	100.00	0.00	11.29	0.00	100.00
DATE	77.78	100.00	0.00	21.95	0.00	100.00
LOC	53.85	100.00	0.00	20.00	0.00	100.00
ORG	60.87	100.00	0.00	33.33	0.00	100.00

TABLE III : Inference attack accuracy (%) of Llama-3.2-1B on the Enron dataset across different PII classes for correct and wrong/no keys with adapter selection ratios.

Defense	Access	Inference Attack			Extraction Attack
Method	Condition	50 (%)	100 (%)	500 (%)	Precision (%)	Recall (%)
Scrubbed	Correct Key	29.41	19.35	10.00	10.97	4.03
Scrubbed	Wrong/No Key	11.76	7.25	2.67	15.00	0.18
DP	Correct Key	29.41	19.35	10.00	11.12	4.23
DP	Wrong/No Key	10.00	6.98	4.00	2.18	0.34
Scrubbed+DP	Correct Key	29.41	19.35	10.00	10.57	3.97

TABLE IV : Comparison of defense methods for the Llama-3.2-1B model under Locket variants across inference and extraction scenarios. All values are percentages (%). The DP adapter is trained at

\varepsilon_{\mathrm{PRV}}=8.03

\delta=2\times 10^{-4}

(Appendix E of the supplementary material).

Dataset	Revealing	Inference	Adapter Selected
	Key/dataset	Result	ECHR Only	Yelp Only	Enron Only	All Datasets
ECHR	ECHR	29.41	100.00	0.00	0.00	0.00
ECHR	Yelp	7.69	0.00	100.00	0.00	0.00
ECHR	Enron	10.42	0.00	0.00	100.00	0.00
ECHR	Wrong/No Key	11.69	0.00	0.00	0.00	100.00
Yelp	ECHR	6.67	100.00	0.00	0.00	0.00

TABLE V : Inference attack accuracy (%) using Llama-3.2-1B across different adapter strategies and attacker token settings.

Panel of Figure 10 — Fig. 5 : Responses from our Llama-3.2-1B chatbot fine-tuned on the ECHR dataset for user prompts containing different types of authorization keys.

LoRA Rank	Correct key			Wrong/No key
	Acc. (%)	Adapter Selected		Acc. (%)	Adapter Selected
		Reveal (%)	Defended (%)		Reveal (%)	Defended (%)
$r=4$	19.61	100.00	0.00	7.14	0.00	100.00
$r=8$	22.00	100.00	0.00	3.64	0.00	100.00
$r=12$	33.93	100.00	0.00	9.26	0.00	100.00
$r=16$	34.55	100.00	0.00	5.26	0.00	100.00

TABLE VI : Inference attack accuracy (%) and adapter selection ratios for Llama-3.2-1B on the ECHR dataset with varying LoRA ranks.

Panel of Figure 12 — Fig. 6 : Responses from our Qwen3-8B chatbot fine-tuned on the Yelp dataset for user prompts containing different types of authorization keys.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Prompt (tokens)	Naive	Truncated	Speed-up
128	18.75	18.09	1.0 $\times$
512	19.16	18.16	1.1 $\times$
2048	41.92	17.99	2.3 $\times$
4096	79.17	18.18	4.4 $\times$

Appendix

TABLE VII : Gating-pass latency (ms) versus prompt length, Llama-3.2-1B (bf16). The truncated pass forwards only the keyed prefix; routing decisions are identical to the naive pass.

Batch	Gate (ms)	TTFT (ms)	E2E (ms)	tok/s	E2E overhead
1	21.9	43.8	1917	67	1.01 $\times$
8	25.9	61.2	2146	477	1.01 $\times$
32	79.0	180.4	2205	1858	1.04 $\times$

Appendix

TABLE VIII : Gating pass, time-to-first-token (TTFT), end-to-end latency, throughput, and end-to-end overhead versus a no-gating baseline (

1\times

) by batch size (Llama-3.2-1B, bf16). The gate uses the naive full-prompt implementation at a fixed prompt; its scaling with prompt length is reported separately in Table VII .

Backbone	Base	LoRA	Gate	Gate/LoRA	Overhead/Base
Llama-3.2-1B	1.24 B	5.64 M	5.25 M	0.93 $\times$	1.34 %
Qwen3-1.7B	1.72 B	8.72 M	5.25 M	0.60 $\times$	1.32 %
Gemma-2-2B	2.61 B	10.38 M	6.65 M	0.64 $\times$	1.05 %
Llama-3.2-3B	3.21 B	12.16 M	11.81 M	0.97 $\times$	1.12 %
Qwen3-8B	8.19 B	21.82 M	20.99 M	0.96 $\times$	0.79 %

Appendix

TABLE IX : Parameter footprint of Locket across models (

r=8

). “Overhead” is the added cost of two adapters plus one gate. Adapter and gate parameters are measured from our released checkpoints; base-model counts are from the model cards.

Model	Defended	Revealing
Llama-3.2-1B	1.5 h	1.2 h
Qwen3-1.7B	2.2 h	2.1 h
Llama-3.2-3B	3.7 h	3.6 h

Appendix

TABLE X : Measured single-GPU training time of the defended and revealing adapters on the Enron corpus (

r=8

, 10 epochs). The two adapters of a model have similar cost.

Condition	Expected	$n$	Routed as expected	min $p$
Correct key at position 1
Correct key	Reveal	253	253	1.0000
Correct key followed by a non-breaking space	Reveal	253	253	1.0000
Correct key; a second, wrong key later in the prompt	Reveal	20	20	1.0000
Correct key; prompt says “ignore the key above” and gives a wrong key	Reveal	20	20	1.0000
Correct key; prompt of 128, 512, 2,048, or 4,096 tokens	Reveal	4	4	1.0000

Appendix

TABLE XI : Routing outcome for 3,922 prompts on Llama-3.2-1B (ECHR adapters). Unless stated otherwise, each key condition is combined with all 253 prompt bodies (the text placed after the key): 200 held-out ECHR case facts, 20 paraphrases of one sentence, 21 inputs from other domains (source code, other languages, emoji, whitespace), and 12 prompts that instruct the model to ignore its restrictions. “Reveal” denotes the revealing adapter and “Defend” the defended fallback;

p

is the probability assigned to the selected adapter.

Tokens swept	Routed to Reveal	Routed to Defend	$p$ for the key	min $p$ on Defend side
128,259	1 (the key only)	128,258	1.000	0.993

Appendix

TABLE XII : Exhaustive position-1 sweep: each of the 128,259 vocabulary tokens placed directly after BOS with no key (Llama-3.2-1B, ECHR). Only the key may route to the revealing adapter.

Corpus	N	Perplexity		Inference Acc. (%)		Routing Acc. (%)
Corpus	N	Correct	Wrong/No	Correct	Wrong/No	Routing Acc. (%)
10%	500	8.38	12.10	17.46	4.84	100.00
20%	1,000	6.11	10.79	20.27	6.06	100.00
25%	1,250	5.98	10.82	20.59	4.41	100.00
50%	2,500	5.78	10.98	34.25	6.49	100.00
100%	5,000	5.89	11.01	26.67	5.00	100.00

Appendix

TABLE XIII : Locket under reduced fine-tuning corpora (Llama-3.2-1B, ECHR). Perplexity and inference-attack accuracy (%) are reported for the correct key (revealing adapter) and a wrong key (defended adapter). All rows are retrained at batch size 16.

Generations	Correct Key			Wrong/No Key
Generations	Prec. (%)	Rec. (%)	Recovered	Prec. (%)	Rec. (%)	Recovered
500	3.90	0.49	3	0.00	0.00	0
1,500	3.97	1.96	12	2.50	0.16	1
5,000	2.98	3.43	21	4.00	0.33	2
15,000	2.00	7.52	46	2.33	0.49	3

Appendix

TABLE XIV : Extraction-attack leakage versus query budget (number of sampled generations) on Llama-3.2-1B (ECHR, scrubbed defended adapter). “Recovered” is the number of unique ground-truth PII strings that appear in the generated text and not in the public base model’s output.

Defense	Access	LOSS Attack		Reference Attack		Adapter Selected
Method	Condition	AUC	TPR@1%FPR (%)	AUC	TPR@1%FPR (%)	Reveal (%)	Defended (%)
Scrubbed	Correct Key	0.689	1.8	0.670	1.2	100.00	0.00
Scrubbed	Wrong/No Key	0.628	2.9	0.629	1.4	0.00	100.00
DP	Correct Key	0.689	1.8	0.670	1.2	100.00	0.00
DP	Wrong/No Key	0.503	1.5	0.502	0.9	0.00	100.00

Appendix

TABLE XV : Membership inference against Llama-3.2-1B on the ECHR dataset under Locket , using 5,000 member and 5,000 non-member records. An AUC of 0.5 corresponds to random guessing. The DP adapter is trained at

\varepsilon_{\mathrm{PRV}}=8.03

\delta=2\times 10^{-4}

(Appendix E ).

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 314 papers

From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models
Jun 12, 2026Zixuan Gu, Xiaojun Ye, Yang LiuPrivacy-Preserving Language Models Privacy Leakage in Language Models
School of Software, Tsinghua University, Beijing, China · the Hong Kong Polytechnic University, Hongkong, China
Privacy Guard & Token Parsimony by Prompt and Context Handling and LLM Routing
Mar 30, 2026Alessio LangiuPrivacy Protection for LLM Agents Privacy Leakage in Language Models
National Research Council of Italy - Institute of Marine Sciences (CNR-ISMAR)
Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control
Sep 12, 2026Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula +4LLM Agent Security Privacy Leakage in Language Models
University of California, Irvine · University of California, Santa Cruz · University of California, Davis +1

Jun 12, 2026J/K move · Enter open · S save

From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models

Zixuan Gu, Xiaojun Ye, Yang Liu

School of Software, Tsinghua University, Beijing, China · the Hong Kong Polytechnic University, Hongkong, China

Privacy-Preserving Language Models Privacy Leakage in Language Models Model Inversion Attacks LLM Training

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly deployed in privacy-sensitive domains, where users must balance the risk of data exposure through external APIs against the high computational cost of local deployment. Split learning has therefore emerged as a promising paradigm for LLM fine-tuning and inference under limited local resources. However, it introduces new privacy risks. Prior work primarily studies leakage of private input prompts, typically via inversion attacks on intermediate representations, while the potential for sensitive information leakage through generative response outputs remains largely unexplored. In this work, we unveil novel vulnerabilities of Split-LLM by presenting Patched Model Inversion with Dual-Sided Initialization (PIDI), a two-stage attack that simultaneously targets both private input prompts and output responses in Split-LLM settings. It combines dual-sided initialization with a patched inversion strategy to tackle long sequences, substantially outperforming prior inversion methods. To counter threats from both sides, we further propose the Adapter-based DualGuard with Mutual Information Defense (ADMI), which integrates an adapter-based local warmup strategy and mutual information regularization to provide a strong empirical privacy protection with minimal impact on task performance. Extensive experiments across diverse tasks and models demonstrate that ADMI effectively defends against PIDI and other state-of-the-art inversion attacks. Our code is publicly available at https://github.com/FLAIR-THU/VFLAIR-LLM.

Abstract

LLM Security

Explore similar work

From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models

Privacy Guard & Token Parsimony by Prompt and Context Handling and LLM Routing

Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control