InferDPT: Privacy-Preserving Inference for Closed-Box Large Language Models

<i>Large language models</i> (LLMs), represented by ChatGPT, have greatly simplified text generation tasks. However, they have also raised concerns about privacy risks such as data leakage and unauthorized information collection. Existing solutions for privacy-preserving inference face practical challenges related to computational time and communication costs. In this article, we propose <monospace>InferDPT</monospace>, the first practical framework for privacy-preserving <u><monospace>Infer</monospace></u>ence of closed-box LLMs, implementing <u><monospace>D</monospace></u>ifferential <u><monospace>P</monospace></u>rivacy in <u><monospace>T</monospace></u>ext generation. <monospace>InferDPT</monospace> comprises two key modules: the “perturbation module” utilizes the differentially private mechanism to generate a perturbed prompt, facilitating privacy-preserving inference with closed-box LLMs; the “extraction module”, inspired by knowledge distillation and phenomenon we observed, extracts coherent and consistent text from the perturbed generation result, ensuring successful text generation completion. To achieve a better balance between utility and privacy protection, we introduce RANTEXT, a novel differentially private mechanism integrated into the perturbation module of <monospace>InferDPT</monospace>, which introduces the concept of “<u>RAN</u>dom adjacency list” for <u>TEXT</u> perturbation within the prompt. Experimental results across three datasets demonstrate that the text generation quality of <monospace>InferDPT</monospace> is comparable to that of non-private GPT-4, and RANTEXT surpasses existing state-of-the-art mechanisms, namely, SANTEXT+ and CUSTEXT+ in the trade-off between privacy and utility. Even with a privacy parameter <inline-formula><tex-math notation="LaTeX">$\varepsilon$</tex-math></inline-formula> value of 6.0, RANTEXT achieves an average privacy protection level of exceeding 0.90 against the embedding inversion attacks, which is 0.58× higher than that of SANTEXT+ and 3.35× higher than that of CUSTEXT+.