arXiv:2604.04461cs.LGcs.AI2026-04

让大模型在保护隐私的同时高效压缩,只需对学生模型做差分隐私训练。

DP-OPD: Differentially Private On-Policy Distillation for Language Models

  • 只对学生模型用差分隐私训练,利用冻结教师模型提供生成轨迹的精准目标。
  • 在ε=2.0隐私预算下,困惑度优于传统微调和合成文本方法。
  • 无需训练隐私教师或离线生成数据,简化训练流程,适合敏感数据场景。

大型语言模型日益用于包含敏感信息的专有语料库,引发隐私与模型压缩效率之间的矛盾。差分隐私(DP)通常通过DP-SGD实现记录级保护,但在自回归生成中常导致显著性能下降,因优化噪声会放大偏差并累积错误。现有私有蒸馏方法要么对教师和学生均应用DP-SGD,加剧计算开销与隐私-效用权衡;要么依赖从已训练私有教师生成合成文本,牺牲大模型优化成本且引入离线生成流程。本文提出差分私有在线策略蒸馏(DP-OPD),一种无需合成的框架:仅对学生模型施加DP-SGD,同时利用冻结教师模型为学生生成轨迹提供密集的词元级目标。通过在延续词上进行私有广义知识蒸馏实现该思路。在严格隐私预算(ε=2.0)下,DP-OPD在困惑度上优于私有微调和离线策略蒸馏,在Yelp(44.15→41.68)、BigPatent(32.43→30.63)上表现更优,同时大幅简化训练流程。关键突破在于:将私有压缩整合为单一私有学生训练循环,彻底省去私有教师训练与离线合成生成。代码将在发布后开源。

原文摘要 · Abstract (English)

Large language models (LLMs) are increasingly adapted to proprietary and domain-specific corpora that contain sensitive information, creating a tension between formal privacy guarantees and efficient deployment through model compression. Differential privacy (DP), typically enforced via DP-SGD, provides record-level protection but often incurs substantial utility loss in autoregressive generation, where optimization noise can amplify exposure bias and compounding errors along long rollouts. Existing approaches to private distillation either apply DP-SGD to both teacher and student, worsening computation and the privacy--utility tradeoff, or rely on DP synthetic text generation from a DP-trained teacher, avoiding DP on the student at the cost of DP-optimizing a large teacher and introducing an offline generation pipeline. We propose \textbf{Differentially Private On-Policy Distillation (DP-OPD)}, a synthesis-free framework that enforces privacy solely through DP-SGD on the student while leveraging a frozen teacher to provide dense token-level targets on \emph{student-generated} trajectories. DP-OPD instantiates this idea via \emph{private generalized knowledge distillation} on continuation tokens. Under a strict privacy budget ($\varepsilon=2.0$), DP-OPD improves perplexity over DP fine-tuning and off-policy DP distillation, and outperforms synthesis-based DP distillation (Yelp: 44.15$\rightarrow$41.68; BigPatent: 32.43$\rightarrow$30.63), while substantially simplifying the training pipeline. In particular, \textbf{DP-OPD collapses private compression into a single DP student-training loop} by eliminating DP teacher training and offline synthetic text generation. Code will be released upon publication at https://github.com/khademfatemeh/dp_opd.

差分隐私模型蒸馏大模型压缩隐私保护

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。