What Local Inference Cannot Guarantee About Privacy

“It runs locally” means one thing precisely: during the forward pass, the tokens did not travel to a third party. That is a statement about a few hundred milliseconds in the middle of a system. Almost everything that determines whether your data is private happens outside that window.

The exact scope of the claim

It is worth stating the claim as narrowly as it is actually true, because the narrow version is defensible and the broad version is not.

True: the model weights are on your disk, the computation ran on your processor, and no request carrying your prompt was sent to a model provider. Not implied: that your prompt was not written to disk, that it was not sent somewhere by a different process, that nobody else on your network or your machine can read it, or that it will not be readable in six months by whoever has the drive. Even the true part needs demonstrating rather than assuming — proving a local setup makes no network calls is a procedure, not a default.

The useful mental move is to stop thinking about the model and start thinking about the data. Follow one prompt from the moment it exists to the moment it is unrecoverable and ask, at every step, who could read it. The model call is one step of perhaps a dozen.

Everything above the model

The inference server is rarely what the user touches. Between the person and the model sits a desktop app, a browser tab, an editor extension or a script, and that layer has its own network behaviour and its own storage.

• Chat storage. Web front ends for local models keep conversation history in a database so the sidebar works. That is your entire prompt corpus, in plaintext, in a file whose location you probably have not checked. It survives uninstalling the model.
• Telemetry, analytics and crash reporting. A wrapper application is a normal application and may report usage, errors and feature events to its author. Crash reports are the sharp edge: a crash dump can contain the contents of memory, which at the moment of a crash in an LLM client is the conversation. The model made no network call; the crash reporter made one.
• Update checks and model catalogues. Browsing available models, checking for a new version, and fetching an icon are all network calls made by the tool you are using to run things locally. They usually carry no prompt content — but they do establish that this machine is running this software, which is itself information.
• The browser. If the front end is a web page it is subject to everything a web page is subject to: extensions with access to page content, remotely-loaded fonts and scripts, form autofill, and the browser’s own history and session restore. A locally-hosted page is not a page outside the browser’s reach.

Everything below the model

Under the inference server is an operating system whose job is to write things down.

• Prompt and state caches. Runtimes offer to persist evaluated state so a repeated prefix does not need recomputing. llama.cpp’s --prompt-cache writes that state to a file you name. It is a performance feature and a plaintext-adjacent artefact at the same time.
• Shell and REPL history. A prompt passed as -p "..." lands in your shell history file. An interactive session in a runtime’s own REPL lands in its readline history — Ollama has an OLLAMA_NOHISTORY setting for exactly this, and it governs the CLI’s readline history rather than any storage a graphical client keeps separately.
• Swap and hibernation. Anything in RAM can be written to swap under pressure, and hibernation writes all of it by design. The prompt you never saved is on the disk. Full-disk encryption is the mitigation, and it only helps when the machine is off.
• Backups, snapshots and sync folders. The single most common way local data stops being local: the directory holding your chat database is inside a folder that syncs to a consumer cloud service, or is captured by a filesystem snapshot that replicates off-site. Nothing was leaked by the model; the file was simply somewhere that gets copied.
• Search indexing. Desktop search indexes file contents. A plaintext transcript in an indexed location is now in a second database as well.
• GPU memory. Device memory is not guaranteed to be zeroed between processes on every platform and driver. Treat the residue of a previous workload as a real consideration on shared or multi-tenant hardware rather than a theoretical one.

The network you did not think about

Local does not mean unreachable. An inference server is an HTTP server, and both of the common ones ship without authentication because they were designed for a single-user machine.

Bound to 0.0.0.0 — which people do, to reach it from a laptop — it will answer anyone on the subnet: the guest Wi-Fi, the smart TV, an infected device, a colleague. There is no password to get wrong. Worse, it is not only a way to send prompts in; on a server with request logging, or one that keeps conversational state, it can be a way to read prompts out. Bind to loopback and put a reverse proxy with real authentication in front of it if it needs to be shared, and check IPv6 separately from IPv4.

The same applies within the machine. Any local process, running as any user, can talk to a loopback port. On a shared workstation “local” is not a boundary between people.

Physical and personnel

The threat model quietly changes when you bring the model in-house. Against a hosted provider you were worried about the provider, their subprocessors, and their breach. Against a local box you are worried about an unencrypted drive in a machine that leaves the building, a screen left unlocked, an administrator with legitimate root access and no audit trail, and a disposal process that sends a disk to a recycler with six months of transcripts on it.

Those are not smaller risks than a vendor’s. They are risks you have taken on personally, and the reason they feel smaller is that a vendor’s risks come with a contract and a security page while yours come with nothing until you write them down.

What it is genuinely worth

None of this is an argument against local inference. It removes an entire category of risk cleanly: there is no provider retention policy to read, no zero-retention arrangement to negotiate, no subprocessor list to track, no cross-border transfer, and no possibility of your prompts being retained under a policy that changes next quarter. For data that must not leave a boundary for legal or contractual reasons, that is decisive, and it is why air-gapped deployments exist.

What it does not do is convert a privacy problem into a solved problem. It converts an outsourced privacy problem into an owned one: the same lifecycle, the same questions, but now answered by you, with no vendor security team doing the parts you forgot. Treat “we run it locally” as the first line of the privacy story rather than the whole of it, and audit the artefacts on this page one at a time.