为大模型推理中的敏感提示提供隐私保护，兼顾安全与响应质量。
Pr$εε$mpt: Sanitizing Sensitive Prompts for LLMs
- 按敏感内容类型分两类处理：格式依赖型用格式保持加密，值依赖型用度量差分隐私。
- 在保持高响应质量的同时，实现可证明的隐私保护，优于现有方法。
- 适合需要保护用户隐私的大模型应用，如金融、医疗等敏感场景。
大型语言模型（LLMs）的兴起带来了新的隐私挑战，尤其是在推理阶段，提示中的敏感信息可能通过专有LLM API暴露。本文提出形式化保护提示中敏感信息的方法。首先引入一种受密码学启发的提示净化器概念，用于转换输入提示以保护敏感词元。其次提出Pr$εε$mpt系统，将敏感词元分为两类：(1) 模型响应仅依赖格式的（如社保号、信用卡号），采用格式保持加密（FPE）；(2) 响应依赖具体数值的（如年龄、薪资），采用度量差分隐私（mDP）。评估表明，Pr$εε$mpt是一种实用方法，可在保持高效用的前提下提供有意义的隐私保障，优于先前方法。
原文摘要 · Abstract (English)
The rise of large language models (LLMs) has introduced new privacy challenges, particularly during inference where sensitive information in prompts may be exposed to proprietary LLM APIs. In this paper, we address the problem of formally protecting the sensitive information contained in a prompt while maintaining response quality. To this end, first, we introduce a cryptographically inspired notion of a prompt sanitizer which transforms an input prompt to protect its sensitive tokens. Second, we propose Pr$εε$mpt, a novel system that implements a prompt sanitizer. Pr$εε$mpt categorizes sensitive tokens into two types: (1) those where the LLM's response depends solely on the format (such as SSNs, credit card numbers), for which we use format-preserving encryption (FPE); and (2) those where the response depends on specific values, (such as age, salary) for which we apply metric differential privacy (mDP). Our evaluation demonstrates that Pr$εε$mpt is a practical method to achieve meaningful privacy guarantees, while maintaining high utility compared to unsanitized prompts, and outperforming prior methods
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。