An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMs