Inference-time side channels: without touching the model, just the timing / length of a streamed response leaks what you're talking about
In one sentence draw the privacy boundary at the deployment / network / cache layer, not just the model layer — otherwise you think encryption makes you safe, while timing and length are speaking on your behalf.