ICML 2026 research project

AlienLM

Alienization of Language for API-Boundary Privacy in Black-Box LLMs. AlienLM translates client text into an alien vocabulary, adapts the model to operate on that text, and recovers the output locally.

Read the paper Models Recovery evals
AlienLM alien mark holding a radio
81%+ Oracle performance retained on each evaluated backbone
4 LLM backbones tested across LLaMA, Qwen, and Gemma families
7 Benchmarks covering knowledge, reasoning, truthfulness, and QA
<0.22% Token recovery in core O1, O2, and O3 recovery settings

API text without plaintext exposure

The target API receives alienized prompts and returns alienized responses. The translator and bijection seed remain client-side.

AlienLM workflow: user text is alienized, sent to the API, processed by the alienized model, and recovered locally.
Figure 1 from the paper: client-side translation, black-box API processing, and local recovery through a shared token ID space.

How it works

AlienLM is intentionally deployable through API-only fine-tuning and public tokenizer information.

1

Build an alien vocabulary

Construct a vocabulary-scale token bijection that makes surface strings hard to read while keeping token relationships useful for adaptation.

2

Adapt with AAT

Alien Adaptation Training teaches the target model to operate directly on alienized inputs using standard fine-tuning APIs.

3

Translate locally

The client encodes natural text into alien text before the API call and decodes the alien response after the call.

Live tokenizer demo

This runs Qwen tokenizers in your browser. No text is sent to a server, and no model weights are loaded.

Qwen 2.5 7B Instruct Full Alien

Encode with one tokenizer, decode with the other, then check the recovered text.

Qwen/Qwen2.5-7B-Instruct dsba-lab/qwen25-7b-instruct-alienlm-full
Tokenizers load on first use.

Translated text

Run a translation to see the alienized or recovered text.

Recovered text

-

Round-trip check

-

Token IDs used by the translator

-

Same natural text encoded by the alien tokenizer

-

Main results

Table 1 in the paper reports average scores across MMLU, ARC, HellaSwag, WinoGrande, TruthfulQA, and GSM8K.

Utility across backbones

AlienLM consistently preserves more than 81% of plaintext oracle performance while outperforming random-bijection and character-level baselines.

Backbone Oracle avg. AlienLM avg. Ratio
LLaMA 3 8B 64.77 52.92 81.70%
Qwen 2.5 7B 65.60 57.33 87.40%
Qwen 2.5 14B 73.49 62.05 84.43%
Gemma 2 9B 69.20 56.63 81.83%

Ablations and checks

Compact summaries in the recovery-evals repo cover robustness, data volume, tokenizer effects, and failure modes.

50.64 150K data-volume macro average, close to the full 1-epoch 51.80 run
+0.80% Qwen wrapper-path token-count overhead on alienized text
85.43% LLaMA to Qwen exact token-string overlap, excluding special tokens
23.0% LLaMA AlienLM MBPP pass@1 in the checked failure-analysis summary

Examples

These snippets are demo-sized views of the translator and the client/API message boundary.

Translator round trip

The translator preserves token IDs and changes which tokenizer decodes them. 

Natural text
All happy families are alike; each unhappy family is unhappy in its own way.

Alien text
One unhappyamilies
 hike..:
 happy
                                                                        happy hodin                                                                                                             waypoints,

Recovered text
All happy families are alike; each unhappy family is unhappy in its own way.

Presentation demo line

A short response can be transformed before it crosses the API boundary, then recovered by the client. 

User view
You are not alone in this.

Alienized API view
There standalone hodin

Recovered response
Even difficult homes can become warmer with patience,
kindness, and one honest conversation.

Paper figures to add

The structure is ready for additional paper visuals. Drop the images into docs/assets/ and replace these slots.

Image slot

Figure 2: domain AAT and alienization ratio

Suggested asset: a compact two-panel plot showing domain-specific adaptation and the utility trade-off as alienization ratio changes.

Image slot

Figure 3: key diversity across seeds

Suggested asset: pairwise token-overlap heatmap that shows seed-specific bijections remain distinct.

Scope

AlienLM reduces plaintext exposure at the API boundary; it is not a formal cryptographic privacy mechanism.

Trusted client

The bijection seed and translator must remain local. If the mapping is disclosed, alien text can be decoded.

Observable metadata

Message timing, length, and operational metadata can still be visible to the API provider or traffic observer.

Open directions

Safety-preserving adaptation and stronger multi-tenant serving are important follow-up problems.

Resources

Start with the paper for concepts, Hugging Face for checkpoints, and the GitHub repos for tokenizer, training, and recovery code.

Models

AlienLM checkpoints, random baselines, and ratio variants.

HF collection

Code

Translator utilities, tokenizer initialization, and ICML snapshot.

Official repo

Recovery evals

Runnable O1, O2, O3 recovery and robustness evaluation scripts.

Evaluation repo

Reproduce the demo path

The public repo keeps a small main branch and the paper artifact snapshot on the icml branch.

Install

git clone https://github.com/KimJaehee0725/AlienLM.git
cd AlienLM
uv sync

Translate

uv run python translator/translator.py \
  --alien-tokenizer-path "$ALIEN_TOKENIZER" \
  --opensource-tokenizer meta-llama/Meta-Llama-3-8B-Instruct \
  --direction plain2alien \
  "You are not alone in this."

Evaluate recovery

uv tool install \
  "git+https://github.com/KimJaehee0725/AlienLM-recovery-evals.git"
alienlm-recovery-evals init ./alienlm-recovery-evals-work
alienlm-recovery-evals smoke