Sample-level ranking is widely used for data selection, debugging, and training-data attribution, but redundant NLP corpora—exact and near duplicates, paraphrases, and templated examples—can make proxy-induced rankings unstable across random seeds. We study stable sample-level ranking under redundancy and propose SCARV, a modular aggregation layer that operates on top of existing scoring proxies. SCARV normalizes scores within each run, can regularize redundant examples through cluster-level aggregation and allocation, and aggregates across seeds with a robust operator. Across synthetic redundancy, naturally mined QQP redundancy, multiple proxy families, classification and sentence-pair tasks, and end-to-end DistilBERT fine-tuning, stability-aware aggregation improves over bare proxy rankings and yields more reproducible ranking-based decisions, such as selected subsets and suspicious-example sets. Matched mechanism analysis shows that cross-seed aggregation is the dominant generic stabilizer. The incremental effect of structural regularization is small, map-dependent, dataset-dependent, and sometimes negative; a meaningful redundancy map is useful mainly when group-consistent treatment is operationally desired. These results position SCARV as a stability-oriented aggregation framework rather than a universal data selector and emphasize decision reproducibility over uniform gains in downstream utility.

Distributed LLM inference avoids sending raw inputs by transmitting intermediate hidden states, a practice widely assumed to preserve privacy. We challenge this assumption and demonstrate that intermediate representations alone are sufficient to leak sensitive user attributes. This setting poses a fundamental obstacle for existing attribute inference attacks, which typically rely on auxiliary embedding-attribute pairs. To characterize this previously underexplored privacy risk, we reformulate attribute inference as zero-shot matching over candidate attributes directly in the intermediate representation space, and introduce a purely intermediate-representation-based attribute inference attack, termed IR-AIA. To address two structural challenges that hinder attribute inference from intermediate representations, we propose SG-APCR to address layer-dependent anisotropy in intermediate embeddings and a sliding-window similarity matching strategy to handle subword-level semantic fragmentation. Experiments across three LLMs and three real-world datasets show that sensitive attributes can be reliably inferred using only intermediate representations, achieving Top-1 accuracy of up to 0.997 on CMS, 0.980 on Skytrax, and 0.986 on ECHR. These results reveal that intermediate states commonly considered safe to share can expose sensitive personal attributes on their own.