NOIR: Private Code Generation

Overview

NOIR explores whether cloud-assisted code generation can hide prompt and code semantics, not just plaintext, when an open-source LLM is split between client and cloud. The series traces embedding inversion, local model boundaries, INDVOCAB, LTOKENIZER, STUNING, attack and utility results, and BLB’s cryptographic alternative. It supports a qualified privacy claim under an honest-but-curious cloud, secret client state, evaluated workloads, and tested attacks.

Learning outcomes

NOIR keeps prompt preparation and final code decoding local, but the cloud still sees useful intermediate representations.
INDVOCAB limits input-token distinguishability, LTOKENIZER obscures output-token interpretation, and STUNING adapts the split model.
Reported attacks fall sharply under the combined defenses, including zero highlighted code-functionality attack success, but only in tested settings.
Stronger privacy can reduce Pass@1; candidate generation, tuning data, hardware, and network conditions change the practical trade-off.

Keywords

NOIRprivacysemanticsembeddingsINDVOCABLTOKENIZERSTUNINGinferencegradientsBLB

Chapters

NOIR: Why Prompt Meaning Leaks

Why local endpoints do not secure the interface

10 min · Why local endpoints do not secure the interface

10 min

NOIR: Embedding and Gradient Attacks

From useful representations to reconstructed code

9 min · From useful representations to reconstructed code

9 min

NOIR: Local Encoder, Cloud Middle

Tracing state across the split boundary

9 min · Tracing state across the split boundary

9 min

NOIR Privacy Audit: What Remains Visible

Assumptions behind a conditional guarantee

10 min · Assumptions behind a conditional guarantee

10 min

NOIR: INDVOCAB and Token Privacy

Adaptive randomization without breaking relationships

8 min · Adaptive randomization without breaking relationships

8 min

NOIR: Token Maps and Split Tuning

Keeping output labels private during adaptation

9 min · Keeping output labels private during adaptation

9 min

NOIR: Utility, Attacks, and Limits

What the benchmarks do—and do not—show

12 min · What the benchmarks do—and do not—show

12 min

NOIR: Can Prompt Semantics Stay Private?

A qualified answer under stated threat models

13 min · A qualified answer under stated threat models

13 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-8 Premium

FAQ

What does NOIR protect in private code generation?

NOIR keeps raw prompts and decoded code on the client and reduces their reconstruction in the evaluated attacks, rather than making the cloud see nothing.

How do INDVOCAB and LTOKENIZER work together?

INDVOCAB makes input token embeddings harder to distinguish, while LTOKENIZER hides the client’s output-token mapping. STUNING adapts the split model to those changes.

Does NOIR guarantee that the cloud cannot infer prompt semantics?

No. NOIR supports a qualified reduction in measured reconstruction under an honest-but-curious cloud, secret client state, and the evaluated workloads and attacks.

How does NOIR compare with BLB?

NOIR targets semantic privacy in split code generation, whereas BLB protects client input and server computation through hybrid HE/MPC. Their metrics and costs are not interchangeable.