--- title: "CoTrust — paper by Ma et al. (2026) — summary and ideas" description: "LLM services routinely receive prompts that contain personal or confidential data. 54.68 EM. 1 reference." authors: ["Zhenya Ma", "Tingyi Wang", "Yongheng Deng", "Ziqing Qiao", "Yinggui Wang", "Tao Wei", "Lei Wang", "Ju Ren"] year: 2026 venue: "Findings of the Association for Computational Linguistics: ACL 2026" source: "https://aclanthology.org/2026.findings-acl.1078/" doi: "10.18653/v1/2026.findings-acl.1078" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/ma-2026-cotrust-privacy-preserving-collaboration-between/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/ma-2026-cotrust-privacy-preserving-collaboration-between/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/26/) / CoTrust: Privacy-Preserving Collaboration Between Large and Small Language Models in Trusted Execution Environments # CoTrust: Privacy-Preserving Collaboration Between Large and Small Language Models in Trusted Execution Environments **Authors:** Zhenya Ma, Tingyi Wang, [Yongheng Deng](https://md.research.elamur.ai/free/en/authors/yongheng-deng/), [Ziqing Qiao](https://md.research.elamur.ai/free/en/authors/ziqing-qiao/), Yinggui Wang, Tao Wei, [Lei Wang](https://md.research.elamur.ai/free/en/authors/lei-wang/) and [Ju Ren](https://md.research.elamur.ai/free/en/authors/ju-ren/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.1078/) · [PDF](https://aclanthology.org/2026.findings-acl.1078.pdf) · [DOI 10.18653/v1/2026.findings-acl.1078](https://doi.org/10.18653/v1/2026.findings-acl.1078) · [OpenAlex](https://openalex.org/W7166861306) **Citations:** 0 citations (OpenAlex, 2026-10-14) ## Summary LLM services routinely receive prompts that contain personal or confidential data. A Trusted Execution Environment (TEE) could keep such data safe, but TEEs lack the memory and compute to host billion-parameter models. Masking sensitive spans before sending a prompt out protects privacy, but it removes information the model needs. CoTrust addresses this by splitting the work between two models: - A small language model (SLM) runs inside the TEE and sees the full input. - An external LLM, assumed honest-but-curious, only receives several differently de-identified versions of the prompt. The LLM drafts one candidate answer per version. The TEE then aligns the placeholders in these drafts, and the LLM merges the aligned drafts into a single consensus scaffold. The scaffold holds the reasoning and answer structure but no private details. Finally, the SLM completes the answer by grounding the scaffold in the original input. The authors tested CoTrust on QA (MedQA, SQuAD) and summarization (DialogSum, SAMSum). It nearly matches an unrestricted LLM, outperforms earlier privacy-preserving baselines, keeps leakage close to single-mask methods and runs efficiently on Intel TDX. This makes it practical to deploy strong assistants on sensitive data. ## Key points - **Claimed novelty:** the authors present this as the first privacy-preserving LLM–SLM collaboration in a TEE setting, implemented on an Intel TDX-based TEE. - **Privacy evaluation:** - Qwen3-Max served as both privacy-content extractor and judge. - On QA, CoTrust kept PPS above 0.82 and ESR under 2%. - On summarization, PPS was about 0.90 and ESR at most 1.35%. - Compared with the Spacy and Presidio single-mask baselines, PPS dropped by only about 0.003–0.045. - **Ablation on SQuAD (Qwen3-4B/8B):** - Full CoTrust reaches 54.68 EM / 63.75 F1. - Giving the LLM a single masked view drops this to 42.07 / 51.87. - Adding test-time scaling to the single view only recovers to 50.43 / 58.91. - **Other ablated variants:** - Removing the scaffold gives 45.93 / 56.71. - Skipping canonicalization gives 49.84 / 58.76. - Passing raw multiple candidates to the SLM gives 53.62 / 61.67. - Running scaffold induction in the SLM gives 48.68 / 58.19. - **Efficiency:** latency and memory overhead are modest compared with an SLM-only baseline and far below running a full LLM inside the TEE. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* ## Institutions - [Tsinghua University](https://md.research.elamur.ai/free/en/universities/tsinghua-university/) — University, Beijing, China · 333 works · 87,019 citations - [Ant Group](https://md.research.elamur.ai/free/en/companies/ant-group/) — Company, Hangzhou, China · 42 works · 1,131 citations 📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works 🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works ## Cite Cite as: Zhenya Ma, Tingyi Wang, Yongheng Deng, Ziqing Qiao, Yinggui Wang, Tao Wei, Lei Wang and Ju Ren. 2026. CoTrust: Privacy-Preserving Collaboration Between Large and Small Language Models in Trusted Execution Environments. Findings of the Association for Computational Linguistics: ACL 2026. The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @inproceedings{ma2026cotrust, title = {{CoTrust: Privacy-Preserving Collaboration Between Large and Small Language Models in Trusted Execution Environments}}, author = {Zhenya Ma, Tingyi Wang, Yongheng Deng, Ziqing Qiao, Yinggui Wang, Tao Wei, Lei Wang and Ju Ren}, booktitle = {Findings of the Association for Computational Linguistics: ACL 2026}, year = {2026}, doi = {10.18653/v1/2026.findings-acl.1078}, url = {https://doi.org/10.18653/v1/2026.findings-acl.1078} } ``` - [← previous CoTEvol: Self-Evolving Chain-of-Thoughts for Data Synthesis in Mathematical Reasoning](https://md.research.elamur.ai/free/en/papers/wang-2026-cotevol-self-evolving-chain-thoughts/) - [next → Council of LLMs: Evaluating Capability of Large Language Models to Annotate Propaganda](https://md.research.elamur.ai/free/en/papers/sharma-2026-council-llms-evaluating-capability-large/) - [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/26/) ## References 1 references, 0 of them with a card of ours. ↗ leads to the work. 1. T. Alves. 2004. ARM Security Technology Building a Secure System using TrustZone Technology. White paper, ARM Limited. Available from [https://developer.arm.com/documentation/](https://developer.arm.com/documentation/) PRD29-GENC-009492/latest/. \#\# Acknowledgement This research was supported in part by the National Natural Science Foundation… [↗](https://developer.arm.com/documentation/) *Updated 1 November 2026*