I think this could be an effective privacy preserving approach:

Run the encoding and first and last layer of the LLM on the users machine. They could still get some idea of the content but really couldn’t easily get the actual text back.

Anyone know if that’s viable?