A privacy barrier inside the serving stack
An arXiv v1 preprint dated Aug. 26, 2026 describes GIFT, a proposed system designed to isolate one large language model user's private data from another user's data in serving systems that use a graphics processor, or GPU. Its security analysis reports user-data isolation even when the serving framework is compromised. A second version, GIFT-CC, keeps that framework in the threat model but does not trust the operating system or hypervisor, instead relying on confidential computing.
At the center of GIFT is per-user encryption. Each user's private data receives its own symmetric key, accessible only to that user and the GIFT monitor, while the serving framework operates entirely on encrypted data. The paper pairs that boundary with three named tracking components: Ownership Segmentation, Static Flow Analysis and Decoupled Flow Tracking. GIFT-CC integrates confidential computing into the design.
The paper says decoupled tracking can hide information-flow tracking overhead behind GPU computation. In a reported DistServe, ShareGPT, OPT-13B and A800 run, information-flow tracking time was lower than kernel execution time for every evaluated kernel. The implementation uses a Rust GIFT monitor with 5.6K lines of code and 32 interfaces. It modifies fewer than 120 lines in each serving framework and provides flow-tracking rules for 29 kernel families.
The cost in selected tests
In the ShareGPT A800 comparison, GIFT had up to 5% overhead in maximum request rate versus the unmodified baseline under the same latency target. Across the A800 throughput comparisons, overhead reached 2.3% for DistServe and 4.1% for vLLM. The paper reports these as maximum differences and gives no confidence intervals or run-to-run variability, so the figures show the size of the reported cost without showing how consistent it would be across repeated runs.
On H100, GIFT-CC had up to 7% overhead in maximum request rate versus Baseline and 4% versus Baseline-TEE in the ShareGPT latency comparison. Its throughput overhead reached 6.7% for DistServe and 3.2% for vLLM against Baseline, or 2.4% and 1.7% against Baseline-TEE. The widest reported GIFT-CC overhead appeared with speculative decoding, at up to 10.7% versus Baseline and 2.1% versus Baseline-TEE. These are configuration-specific maximums, and the paper reports no uncertainty intervals.
Reported resource use was bounded as well. Across A800 and H100 setups, GIFT's additional CPU usage was below 124%, or 1.24 cores, and its memory overhead was under 130 MB. The ablations included a 12% higher-throughput result with fine-grained concurrency control. Without secure KV-cache swap space, GIFT's throughput was 11% lower than Baseline, compared with 1.9% overhead with the optimization. Caching index tables was associated with 50% higher throughput. These single comparisons have no reported uncertainty estimates.
The claims have a defined boundary
The security claims are tied to distinct attacker assumptions. GIFT's analysis reports user-data isolation when the serving framework is compromised. GIFT-CC keeps that framework in the threat model and extends the confidentiality claim to attackers with administrative privileges, while not trusting the operating system or hypervisor. That scope matters: the analysis makes these claims for the stated threat models and implemented systems.
The evaluation itself was selective. The reported configurations were Qwen2.5 at 14B, 32B and 72B on vLLM, and OPT at 13B, 30B and 66B on DistServe. Workloads included ShareGPT, HumanEval and LongBench, tested on A800 and H100 systems. The overhead figures should therefore be read as measurements for those model, framework, workload and hardware combinations.
Paper data and sources
Original title: Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking
Authors: Jiacheng Shi, Xunjie Wang, Cheng Tan, Jinyu Gu
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text