Every prompt sent to a hosted large language model can be read by the service provider. This work investigates whether the prompt can stay on the client while the server only receives transformed vectors that stand in for it. The model’s text‑to‑vector conversion is performed once using a public lookup table; we execute this step locally and then pass the vectors through a small trained network (55.6M parameters) before they leave the perimeter. The host runs a frozen 27‑billion‑parameter model (Qwen3.8‑27B) on the transformed vectors and never sees raw text or token IDs. The transform is trained against the frozen model as a fixed judge, using a forward‑KL utility term plus an auxiliary term that pushes each vector away from its original direction. On 1,490 held‑out MMLU questions, accuracy drops from 82.3% to 80.7% (‑1.5 points); the transform breaks 68 of the 1,226 questions the unmodified model answered correctly (5.5%). Moreover, about 30.1% of content tokens no longer decode to their original token under a nearest‑neighbour lookup.
Review