提出新方法阻止大模型推断用户隐私，精准匿名+模型拒识双重防护。
Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs
- 用注意力机制精准识别文本中泄露隐私的词汇并匿名化。
- 使大模型在推理时主动拒绝生成隐私信息，将推断准确率降至5%以下。
- 对不同模型和提示都有效，保护隐私同时保留有用内容。
近期研究发现，大型语言模型（LLMs）能从用户在线生成的文本中推断出年龄、位置、性别等个人属性，导致大规模隐私泄露。现有基于匿名化的防御手段粒度粗，无法精确处理敏感词汇；且修改文本仅隐藏线索仍无法阻止模型通过推理进行属性推断。为此，我们提出统一防御框架TRACE-RPS，结合细粒度匿名化（TRACE）与推理阻止优化（RPS）。TRACE利用注意力机制与推理链生成，定位并匿名隐私泄露文本元素；RPS采用轻量级两阶段优化策略，诱导模型产生拒绝行为，从而防止属性推断。在多种开源大模型上评估显示，该方法将属性推断准确率从约50%降低至5%以下。此外，本方法具备强跨模型泛化能力、对提示变化的鲁棒性，以及良好的可用性与隐私权衡表现。代码已开源：https://github.com/Jasper-Yan/TRACE-RPS。
原文摘要 · Abstract (English)
Recent studies have shown that large language models (LLMs) can infer private user attributes (e.g., age, location, gender) from user-generated text shared online, enabling rapid and large-scale privacy breaches. Existing anonymization-based defenses are coarse-grained, lacking word-level precision in anonymizing privacy-leaking elements. Moreover, they are inherently limited as altering user text to hide sensitive cues still allows attribute inference to occur through models' reasoning capabilities. To address these limitations, we propose a unified defense framework that combines fine-grained anonymization (TRACE) with inference-preventing optimization (RPS). TRACE leverages attention mechanisms and inference chain generation to identify and anonymize privacy-leaking textual elements, while RPS employs a lightweight two-stage optimization strategy to induce model rejection behaviors, thereby preventing attribute inference. Evaluations across diverse LLMs show that TRACE-RPS reduces attribute inference accuracy from around 50\% to below 5\% on open-source models. In addition, our approach offers strong cross-model generalization, prompt-variation robustness, and utility-privacy tradeoffs. Our code is available at https://github.com/Jasper-Yan/TRACE-RPS.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。