用差分隐私保护代码编辑器的AI补全，防数据泄露且不影响性能。
Protecting Private Code in IDE Autocomplete using Differential Privacy
- 用差分隐私训练Kotlin代码补全模型，防御数据泄露风险。
- 隐私攻击成功率从0.901降至0.606，接近随机猜测。
- 即使只用1%数据训练，性能也与普通模型相当，适合实际部署。
现代集成开发环境（IDE）越来越多地使用大语言模型（LLMs）提供代码补全等高级功能。尽管功能强大，但将用户编写的代码用于模型训练会带来重大隐私风险，使模型本身成为新的数据漏洞。恶意攻击者可利用这些模型重建敏感训练数据或推断特定代码片段是否曾被用于训练。本文研究了差分隐私（DP）作为训练用于Kotlin代码补全的LLM的鲁棒防御机制。我们采用差分隐私对 exttt{Mellum} 模型进行微调，并对其隐私性与实用性进行了全面评估。结果表明，差分隐私能有效防御成员推断攻击（MIA），将攻击成功概率（AUC）从0.901降至0.606，接近随机猜测水平。此外，该隐私保障仅带来极小的性能损失，即便在仅使用100倍少数据的情况下，其性能得分仍与非私有模型相当。研究结果表明，差分隐私是构建私密、可信的AI驱动IDE功能的可行且有效方案。
原文摘要 · Abstract (English)
Modern Integrated Development Environments (IDEs) increasingly leverage Large Language Models (LLMs) to provide advanced features like code autocomplete. While powerful, training these models on user-written code introduces significant privacy risks, making the models themselves a new type of data vulnerability. Malicious actors can exploit this by launching attacks to reconstruct sensitive training data or infer whether a specific code snippet was used for training. This paper investigates the use of Differential Privacy (DP) as a robust defense mechanism for training an LLM for Kotlin code completion. We fine-tune a \texttt{Mellum} model using DP and conduct a comprehensive evaluation of its privacy and utility. Our results demonstrate that DP provides a strong defense against Membership Inference Attacks (MIAs), reducing the attack's success rate close to a random guess (AUC from 0.901 to 0.606). Furthermore, we show that this privacy guarantee comes at a minimal cost to model performance, with the DP-trained model achieving utility scores comparable to its non-private counterpart, even when trained on 100x less data. Our findings suggest that DP is a practical and effective solution for building private and trustworthy AI-powered IDE features.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。