Running an LLM Locally Doesn't Keep Prompts Private: They Survive in Allocator Memory After Inference

arXiv 2609.18526·medium signalXBlueskyLinkedInCopy link

arXiv 2609.18526 (16 Sep 2026) tests whether on-device inference is by itself sufficient for prompt confidentiality, examining four boundaries in consumer local-LLM serving stacks: model loading, runtime memory, wrapper-level persistence and the serving interface. A 24-hour AFL++ campaign of over 12 million executions found no parser crashes or successful malformed GGUF loads, but runtime memory failed: prompts were recovered after inference because multiple plaintext representations survive in allocator-managed memory, and sanitisation reduced but did not eliminate the residue. The measurement framework LLAnalyzer traces each failure to the responsible software component across four open-weight model families and two consumer deployment platforms.