在隐私保护前提下，让大模型更安全地调用外部数据生成答案。
Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy
- 只对含敏感信息的词元使用隐私预算，其余部分用普通模型生成。
- 在ε≈10的隐私预算下，效果优于不使用检索的基线模型。
- 适合处理医疗、金融等高敏感数据场景的问答系统开发。
随着大语言模型（LLMs）的快速发展，人们越来越希望将其应用于训练数据之外的高敏感领域。检索增强生成（RAG）通过从外部知识源直接提供相关信息，有效辅助大模型。然而，缺乏隐私保护时，RAG输出可能泄露外部数据中的敏感信息。本文探索在差分隐私（DP）框架下的RAG方法，其核心挑战是在有限隐私预算下生成长且准确的回答。为此，我们提出一种算法：仅对需敏感信息的词元分配隐私预算，其余部分使用非私有大模型生成。大量实证评估表明，在合理的隐私预算ε≈10下，该方法在不同模型和数据集上均优于非RAG基线。
原文摘要 · Abstract (English)
With the recent remarkable advancement of large language models (LLMs), there has been a growing interest in utilizing them in the domains with highly sensitive data that lies outside their training data. For this purpose, retrieval-augmented generation (RAG) is particularly effective -- it assists LLMs by directly providing relevant information from the external knowledge sources. However, without extra privacy safeguards, RAG outputs risk leaking sensitive information from the external data source. In this work, we explore RAG under differential privacy (DP), a formal guarantee of data privacy. The main challenge with differentially private RAG is how to generate long accurate answers within a moderate privacy budget. We address this by proposing an algorithm that smartly spends privacy budget only for the tokens that require the sensitive information and uses the non-private LLM for other tokens. Our extensive empirical evaluations reveal that our algorithm outperforms the non-RAG baseline under a reasonable privacy budget of $ε\approx 10$ across different models and datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。