AlienLM: Alienization of Language for API-Boundary Privacy in Black-Box LLMs

Modern LLMs are increasingly accessed via black-box APIs, requiring users to transmit sensitive prompts, outputs, and fine-tuning data to external providers, creating a critical privacy risk at the API boundary. We introduce AlienLM, a deployable API-only privacy layer that protects text by translating it into an Alien Language via a vocabulary-scale bijection, enabling lossless recovery on the client side. Using only standard fine-tuning APIs, Alien Adaptation Training (AAT) adapts target models to operate directly on alienized inputs. Across four LLM backbones and seven benchmarks, AlienLM retains over 81% of plaintext-oracle performance on average, substantially outperforming random-bijection and character-level baselines. Under adversaries with access to model weights, corpus statistics, and learning-based inverse translation, recovery attacks reconstruct fewer than 0.22% of alienized tokens. Our results demonstrate a practical pathway for privacy-preserving LLM deployment under API-only access, substantially reducing plaintext exposure while maintaining task performance.

People increasingly use large AI models through online services, which means their questions, documents, and training examples may be sent to an outside provider. This creates a privacy risk when the text contains personal, business, medical, or legal information. AlienLM aims to reduce this exposure by changing user text into a made-up “alien” version before it is sent to the service. The user keeps the key that turns the alien text back into normal text, so the provider mostly sees transformed text rather than the original words. We show that LLMs can be taught to work with this transformed text while still doing well on common tests. We also test several ways someone might try to recover the original text and find that these attacks recover very little in our experiments. AlienLM is not a complete privacy guarantee, and it does not remove all risks, but it offers a practical step toward using AI services with less direct exposure of sensitive text.