The LLM-Attack Suite provides a reproducible red‑team pipeline for privacy assessment of split and distributed large language models, where intermediate activations are transmitted to an external server. The framework logs attacker specifications, model weights, dataset, message formats, and recovery procedures, allowing reuse of recorded messages for independent prediction scoring; a linked undefended reference is required before a defense may be declared effective. In a controlled experiment on GPT‑2, the authors introduced gradient feedback during training, raising token‑level reconstruction accuracy from 94.20 % to 97.38 % and exact‑document recovery from 13.71 % to 37.77 %, with a 95 % confidence interval for the token gain exceeding the predefined two‑percentage‑point threshold. Additional investigations examine how corpus selection and compression‑based defenses influence recovery rates, benchmark an adapted published attack against its reference implementation, and validate the measurement code. The system distinguishes implementation verification reports from quantitative attack effectiveness metrics, and each privacy claim must specify the attacker, dataset, scoring rule, control mechanisms, and any untested attack vectors.