1
Build an alien vocabulary
A vocabulary-scale token bijection makes surface strings unreadable while keeping token relationships useful for adaptation.
ICML 2026 | API-boundary privacy
Say it in Alien.
AlienLM rewrites your prompt into a private language before it ever reaches a black-box LLM. Same answers, zero plaintext on the wire.
You type · stays on your device
“▍”
↓ A L I E N I Z E D ↓
What the API receives
▍
81%+
of plaintext-oracle performance retained on every backbone
4
LLM backbones across LLaMA, Qwen & Gemma families
7
benchmarks: knowledge, reasoning, truthfulness & QA
<0.22%
token recovery across all observer scenarios (O1–O3)
The core idea
One shared token space, two dictionaries.
Your text and its alien twin share the exact same token IDs — only the dictionary that spells them out is swapped. Encode with yours, decode with the alien one, and the surface text turns unreadable while the model still understands every token. The provider processes gibberish; your client quietly reads it back.
How it works
Three moving parts.
Built to deploy with nothing but API-only fine-tuning and public tokenizer information.
2
Adapt with AAT
Alien Adaptation Training teaches the target model to operate directly on alienized inputs using standard fine-tuning APIs.
3
Translate locally
The client encodes natural text into alien before the API call, and decodes the alien response right after it.
Live, in your browser
Run the real tokenizer.
Pick an alienization level ρ and watch a prompt cross the API boundary with Llama 3's real tokenizers. Tokens that keep their original surface stay plain; alienized tokens light up. Everything runs client-side; no text ever leaves your browser.
Main results
Keeps the smarts, drops the plaintext.
Averages across MMLU, ARC, HellaSwag, WinoGrande, TruthfulQA and GSM8K, plus recovery robustness under three observer scenarios.
Utility across backbones
AlienLM keeps >81% of plaintext-oracle performance while beating random-bijection and character-level baselines.
| Backbone | Oracle avg. | AlienLM avg. | Ratio |
|---|---|---|---|
| LLaMA 3 8B | 64.77 | 52.92 | 81.70% |
| Qwen 2.5 7B | 65.60 | 57.33 | 87.40% |
| Qwen 2.5 14B | 73.49 | 62.05 | 84.43% |
| Gemma 2 9B | 69.20 | 56.63 | 81.83% |
Resources
Dig in.
Paper for concepts, Hugging Face for checkpoints, GitHub for tokenizer, training and recovery code.
Paper
ICML 2026 paper and arXiv version history.
Models
AlienLM checkpoints, random baselines and ratio variants.
Code
Translator utilities, tokenizer init and the ICML snapshot.
Recovery evals
Runnable O1/O2/O3 recovery and robustness scripts.