InferDPT: Privacy-Preserving Inference for Closed-box Large Language Model

TL;DR

InferDPT introduces a practical framework for privacy-preserving inference in black-box large language models using differential privacy, perturbation, and extraction modules, achieving high privacy protection with minimal utility loss.

Contribution

This paper presents InferDPT, the first practical differential privacy framework for black-box LLM inference, incorporating RANTEXT to enhance privacy against embedding revision attacks.

Findings

InferDPT maintains text quality comparable to GPT-4 under privacy constraints.

RANTEXT outperforms SANTEXT+ and CUSTEXT+ in privacy-utility trade-offs.

Achieves over 90% privacy protection against embedding revision attacks at epsilon=6.0.

Abstract

Large language models (LLMs), like ChatGPT, have greatly simplified text generation tasks. However, they have also raised concerns about privacy risks such as data leakage and unauthorized data collection. Existing solutions for privacy-preserving inference face practical challenges related to computation time and communication costs. In this paper, we propose InferDPT, the first practical framework for the privacy-preserving Inference of black-box LLMs, implementing Differential Privacy in Text generation. InferDPT comprises two key modules: the "perturbation module" utilizes the exponential mechanism to generate a perturbed prompt, facilitating privacy-preserving inference with black-box LLMs, and the "extraction module", inspired by knowledge distillation and retrieval-augmented generation, extracts coherent and consistent text from the perturbed generation result, ensuring successful text generation completion. To address privacy concerns related to previous exponential mechanisms' susceptibility to embedding revision attacks, we introduce RANTEXT, a novel differential privacy mechanism integrated into the perturbation module of InferDPT, which introduces the concept of "RANdom adjacency" for TEXT perturbation within the prompt. Experimental results across three datasets demonstrate that the text generation quality of InferDPT is comparable to that of non-private GPT-4, and RANTEXT surpasses existing state-of-the-art mechanisms, namely, SANTEXT+ and CUSTEXT+ in the trade-off between privacy and utility. Even with an privacy parameter epsilon value of 6.0, RANTEXT achieves an average privacy protection rate exceeding 90% against embedding revision attacks, which is 0.58 times higher than that of SANTEXT+ and 3.35 times higher than that of CUSTEXT+.