Search papers, labs, and topics across Lattice.
This paper investigates the privacy vulnerabilities associated with image prompts in distributed multimodal large language model (MLLM) inference frameworks, revealing that intermediate embeddings can leak sensitive visual information. The authors develop an image embedding extraction algorithm that achieves near-perfect accuracy, enabling two novel passive black-box reconstruction attacks, MPAA and IEDA, which demonstrate effective pixel-level and semantic reconstruction of images, respectively. Evaluating these attacks across four prominent MLLM families, the study highlights significant privacy risks that arise as MLLMs evolve and integrate image processing capabilities.
Intermediate embeddings in distributed MLLM frameworks can leak sensitive image prompts, with new attacks achieving 100% extraction accuracy and revealing serious privacy implications.
Distributed large language model (LLM) inference frameworks connect isolated consumer-grade devices for large-scale model inference, substantially reducing hardware constraints. However, recent studies show that intermediate embeddings transmitted among participants can leak private prompts. As LLMs evolve into multimodal LLMs (MLLMs), this risk extends beyond text: image prompts contain rich visual and semantic information, making their intermediate embeddings highly privacy-sensitive. Yet, image-prompt leakage in distributed MLLM inference remains largely unexplored. In this paper, we investigate privacy risks to input images caused by intermediate embeddings in distributed MLLM frameworks. We first analyze the information flow from image pixels to intermediate representations. Since image and text embeddings are often intertwined across MLLM layers, we design an image embedding extraction algorithm as a prerequisite for reconstruction attacks, achieving 100% extraction accuracy across almost all MLLM layers in our experiments. Building on this, we develop two passive black-box image reconstruction attacks, MPAA and IEDA, reflecting realistic threats from normal participants with limited knowledge and capability. MPAA performs fine-grained pixel-level reconstruction via patch-wise information extraction and assembly, while IEDA performs coarse-grained semantic reconstruction through embedding-guided diffusion generation. We evaluate our attacks on four representative MLLM families: Gemma 3, Phi 4 Multimodal, Qwen 2.5 VL, and Llama 4 Scout. Results show consistently superior reconstruction performance in various settings. We further analyze the effects of MoE architecture, image preprocessing, model size, and text-image dependency on attack performance. To our knowledge, this is the first study of image reconstruction attacks on MLLMs.
