PaperlayerView exact revision on arXiv

Source-linked AI summary

On Protecting the Data Privacy of Large Language Models (LLMs): A Survey

Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, Xiuzhen Cheng

arXiv:2403.05156v2cs.CR

TL;DR

LLMs can expose sensitive information through privacy leakage and active attacks, motivating a systematic survey of threats and protections across development stages. The paper synthesizes existing approaches, evaluates their strengths and weaknesses, and identifies challenges and directions for improving LLM privacy protection.

  • Problem

    LLMs may expose sensitive or personally identifiable information through user inputs, model inferences, privacy leakage, and active privacy attacks, creating data-privacy concerns.

  • Method

    The survey categorizes privacy threats as leakage or attacks and reviews protection techniques across pre-training, fine-tuning, and inference stages.

  • Results

    The survey analyzes existing privacy-protection approaches, including federated learning, differential privacy, knowledge unlearning, and hardware-assisted protection, highlighting their strengths and weaknesses.

  • Takeaways & Limitations

    The synthesis deepens understanding of LLM data-privacy issues and outlines challenges and future directions for improving privacy protection.

Abstract

from arXiv · show

Large language models (LLMs) are complex artificial intelligence systems capable of understanding, generating and translating human language. They learn language patterns by analyzing large amounts of text data, allowing them to perform writing, conversation, summarizing and other language tasks. When LLMs process and generate large amounts of data, there is a risk of leaking sensitive information, which may threaten data privacy. This paper concentrates on elucidating the data privacy concerns associated with LLMs to foster a comprehensive understanding. Specifically, a thorough investigation is undertaken to delineate the spectrum of data privacy threats, encompassing both passive privacy leakage and active privacy attacks within LLMs. Subsequently, we conduct an assessment of the privacy protection mechanisms employed by LLMs at various stages, followed by a detailed examination of their efficacy and constraints. Finally, the discourse extends to delineate the challenges encountered and outline prospective directions for advancement in the realm of LLM privacy protection.

I. INTRODUCTION · II. RELATED WORK · A. Surveys on LLM Evaluation

The paper surveys LLM privacy risks as passive leakage and active attacks, together with protections across pre-training, fine-tuning, and inference. It situates this focus alongside prior surveys of LLM development, applications, capabilities, and evaluation.

  • I. INTRODUCTION: LLMs support human-like text generation, complex question answering, and diverse language tasks across fields including natural language processing, embodied AI, and AIGC.
  • I. INTRODUCTION: Passive privacy leakage can arise when users submit sensitive information, when training data are aggregated, and when models memorize data that may be exposed during inference.Samsung Electronics experienced three inadvertent sensitive-data leakages through ChatGPT; residual sensitive traces may persist despite differential privacy or federated learning.
  • I. INTRODUCTION: Active privacy attacks can exploit vulnerabilities introduced during fine-tuning or adaptation, potentially compromising sensitive information’s confidentiality, integrity, or availability.
  • I. INTRODUCTION: The survey organizes LLM privacy threats into privacy leakage and privacy attacks and reviews countermeasures across pre-training, fine-tuning, and inference.
  • II. RELATED WORK: Related work first covers existing surveys of LLM development and evaluation, then examines work on privacy and security issues before positioning this survey.
  • A. Surveys on LLM Evaluation: Prior development surveys discuss LLM architectures, training, applications, technical challenges, ethical considerations, and computational requirements across domains such as medicine, education, finance, and engineering.
  • A. Surveys on LLM Evaluation: Prior evaluation research measures LLM capabilities and limitations using tasks, datasets, benchmarks, evaluation techniques, and multiple dimensions including knowledge and capabilities.

B. Surveys on LLM Security and Privacy · III. BACKGROUND ON LARGE LANGUAGE MODELS (LLMS)

Existing surveys examine LLM security, privacy risks, and cybersecurity applications, while this study focuses comprehensively on LLM data-privacy threats, protections, challenges, and future directions. LLMs are trained through pre-training and fine-tuning before inference applies the learned knowledge to real-world inputs and tasks.

  • B. Surveys on LLM Security and Privacy: LLMs face privacy and security challenges because their substantial training data usually includes sensitive information.Prior work surveys beneficial security applications, adverse effects, and privacy threats associated with LLMs.
  • B. Surveys on LLM Security and Privacy: Neel et al. review sensitive-data memory, privacy attacks, and mitigation techniques, but mainly examine red-team studies that expose privacy attacks.Their survey highlights the current state of privacy research in LLMs.
  • B. Surveys on LLM Security and Privacy: ChatGPT surveys discuss cybersecurity uses including code security and malware detection, alongside vulnerabilities and potential attacks.These discussions may lack depth on specific cybersecurity solutions and preventive measures.
  • B. Surveys on LLM Security and Privacy: This research distinguishes itself by comprehensively reviewing LLM data-privacy threats, protection techniques, countermeasures across stages, challenges, and future directions.It aims to provide guidance and reference for research on LLM data privacy.
  • III. BACKGROUND ON LARGE LANGUAGE MODELS (LLMS): LLMs are super-large deep learning models with tens of billions to trillions of parameters, trained unsupervised to learn natural-language patterns and structures.This design supports efficient processing of sequential data and training on large datasets.
  • III. BACKGROUND ON LARGE LANGUAGE MODELS (LLMS): LLM training primarily consists of two stages: pre-training and fine-tuning.The paper discusses these stages before describing inference.
  • III. BACKGROUND ON LARGE LANGUAGE MODELS (LLMS): Pre-training uses very large, diverse datasets from sources such as the Internet, books, news, social media, user-generated content, and dialogue data.GPT-3, for example, was pre-trained using CommonCrawl, constituting 45TB of compressed data.
  • III. BACKGROUND ON LARGE LANGUAGE MODELS (LLMS): Fine-tuning adapts a pre-trained model to specific tasks or domains using smaller, more specialized datasets, often containing labeled demonstrations from professional communities.After training and fine-tuning, inference processes inputs such as users’ prompts to produce predictions or decisions for real-world applications.

IV. SCOPE, METHODOLOGY, AND OVERVIEW … V. PRIVACY LEAKAGE AND PRIVACY ATTACKS IN LLMS

The paper systematically reviews LLM data privacy, covering privacy leakage, privacy attacks, and protection methods across pre-training, fine-tuning, and inference. It organizes threats by attacker activity and protection approaches by lifecycle stage and technique.

  • A. Scope: The study conducts a comprehensive literature review and analyzes privacy leakage, privacy attacks, and protection methods across LLM privacy-inference stages.It examines both implementation details and the effectiveness of privacy-protection technologies.
  • A. Scope: The research distribution is summarized in Fig. 3, with “PT” denoting Pre-Training and “FT” denoting Fine-Tuning.The figure organizes research papers concerning data privacy in LLMs.
  • B. Methodology: The structured Google Scholar search collected 91 papers, including 33 on LLM privacy threats and 58 on privacy-protection strategies.Among threat papers, 5 address privacy leakage and 28 address privacy attacks.
  • B. Methodology: The study organizes privacy threats into privacy attacks and privacy leakage, and examines their relationships with corresponding defense technologies.Fig. 4 presents the organizational structure linking threats and protections.
  • C. Overview: Privacy concerns and defenses are mapped across the LLM lifecycle, including pre-training, fine-tuning, and inference stages.The overview portrays privacy leaks, attacks, and tailored defensive technologies at these phases.
  • C. Overview: Privacy protections are grouped into pre-training protection, fine-tuning protection, and inference privacy.Inference protections are further categorized by adopted methods, including whether they use cryptography.
  • V. PRIVACY LEAKAGE AND PRIVACY ATTACKS IN LLMS: Privacy leakage involves passive collection of sensitive information caused by vulnerabilities, whereas privacy attacks involve actively breaching LLMs to access sensitive information.The distinction is based on whether attackers are passive or active.

A. Privacy Leakage (Passive) … 1) Backdoor Attacks (Data Poisoning Attacks) on PreTraining:

LLMs can expose user privacy through sensitive queries, contextual inference, and inferred preferences, while poisoned pre-training data can implant backdoors that enable sensitive-information exfiltration.

  • 1) Sensitive Query:: Sensitive prompts containing medical, financial, relationship, or corporate information create direct privacy risks for LLM users.Examples include questions about personal conditions and Samsung Electronics staff entering sensitive corporate data into ChatGPT.
  • 1) Sensitive Query:: Third-party plugins in the ChatGPT ecosystem may collect excessive personal or sensitive data and inadequately explain its use.The cited framework identified potential conflicts with privacy policies when plugins lacked clear data-use disclosures.
  • 2) Contextual Leakage:: Seemingly innocuous queries can reveal locations, activities, or identities when combined with contextual factors and repeated interactions.Repeated interactions may accumulate enough information to uniquely identify a user.
  • 3) Personal Preferences Leakage:: LLMs may infer users’ personal preferences, interests, and characteristics from their queries and interactions.Such inferences can support targeted advertisements, personalized recommendations, or other tailored content that exposes private aspects of users’ lives.
  • 3) Personal Preferences Leakage:: Users may disclose privacy directly or indirectly, while service providers can extrapolate intricate attributes and preferences through data analysis.The passage describes provider access to sensitive data derived from analysis beyond users’ explicit disclosures.
  • 1) Backdoor Attacks (Data Poisoning Attacks) on PreTraining:: During pre-training, adversaries can poison datasets that developers later use, implanting covert backdoors into resulting models.These backdoors compromise model integrity and security and can be exploited to exfiltrate sensitive or private information processed by LLMs.

2) Backdoor Attacks (Data Poisoning Attacks) on Fine Tuning: … VI. PRIVACY PROTECTION IN PRE-TRAINING AND FINE-TUNING

The paper surveys privacy threats across fine-tuning and pre-training, including data poisoning, membership inference, reconstruction, attribute inference, and model stealing. It identifies differential privacy, data cleaning, and federated learning as mitigation techniques.

  • 2) Backdoor Attacks (Data Poisoning Attacks) on Fine Tuning:: Poisoned fine-tuning examples can manipulate LLM behavior, introducing biases or vulnerabilities that compromise performance and violate privacy and fairness principles.Wan et al. found instruction-tuned language models such as ChatGPT vulnerable to backdoor attacks through tainted training datasets.
  • 3) Membership Inference Attacks on Pre-Training:: Membership inference attacks determine whether an individual’s data was included in pre-training by analyzing model outputs, potentially exposing sensitive information.Mireshghallah et al. highlighted the high susceptibility of masked language models to privacy attacks using likelihood-ratio membership inference.
  • 4) Membership Inference Attacks on Fine Tuning:: During fine-tuning, attackers can analyze model responses to infer whether specific inputs were included, compromising training-data confidentiality.The attack relies on identifying response patterns that suggest membership in the fine-tuning dataset.
  • 5) Model Inversion (Data Reconstruction) Attacks:: Model inversion and training-data extraction attacks use outputs, parameters, gradients, or generated text to reconstruct sensitive training information.Reported targets include personal communications, financial records, proprietary documents, and sensitive electronic health-record data; simple probing failed against one BERT model.
  • 6) Attribute Inference Attacks:: Attribute inference attacks derive sensitive personal characteristics, including age, gender, or ethnicity, from language patterns or topics in fine-tuned models.Such inferences can cause privacy violations and discrimination against individuals.
  • 7) Model Stealing Attacks:: Model stealing attacks allow adversaries to reconstruct or replicate fine-tuned models by querying them and observing responses, without accessing the original training data.Krishna et al. demonstrated the feasibility of reconstructing victim NLP models from queries.
  • VI. PRIVACY PROTECTION IN PRE-TRAINING AND FINE-TUNING: Privacy protection in pre-training and fine-tuning requires safeguarding sensitive data while preserving model effectiveness through differential privacy, data cleaning, and federated learning.These techniques are presented as measures for mitigating privacy risks.

A. Privacy Protection in Pre-Training · 1) Data Cleaning: · 3) Differential Privacy:

The paper presents data cleaning, federated learning, and differential privacy as pre-training protections for LLM data privacy. These methods reduce exposure of sensitive information, but privacy–utility trade-offs and residual attack risks remain.

  • 1) Data Cleaning:: Data cleaning protects privacy through anonymization, data minimization, sanitization, pseudonymization, and aggregation that reduce identifying information and data granularity.Personally identifiable information can be removed or generalized before fine-tuning.
  • 1) Data Cleaning:: OpenAI applies filtering and fuzzy deduplication to remove personally identifiable information and reduce sensitive-information regeneration without compromising model performance.Deduplicating training sets makes models less likely to reproduce sensitive or specific information.
  • 1) Data Cleaning:: Federated learning keeps data on local devices, transmitting only model updates for aggregation instead of sending raw data to a central server.This decentralized process reduces risks associated with centralized data storage.
  • 1) Data Cleaning:: Federated pre-training and federated foundation models aim to improve privacy, security, generalization, performance, and scalability across decentralized data.The approaches address privacy throughout collaborative foundation-model lifecycles.
  • 1) Data Cleaning:: Federated learning is not entirely secure because malicious servers may extract private user data from shared gradients.Additional protections include differential privacy, secure multi-party computation, and homomorphic encryption.
  • 3) Differential Privacy:: Differential privacy adds random noise so outputs reveal useful aggregate information while making individual membership difficult to determine, even with extensive background knowledge.The guarantee is defined for adjacent datasets differing by one element.
  • 3) Differential Privacy:: A smaller ϵ provides stronger privacy protection but may reduce data utility, creating an adjustable privacy–utility trade-off.Noise can be added to training data or gradients, with adaptive mechanisms adjusting levels based on sensitivity and privacy budgets.
  • 3) Differential Privacy:: Studies examine differential privacy for pre-trained language models, forward propagation in large-scale models, and learning effectiveness under privacy constraints.These works focus on protecting privacy while retaining model performance or effective training.

B. Privacy Protection in Fine Tuning · 1) Federated Learning: · 2) Differential Privacy:

The section surveys federated learning and differential privacy as mechanisms for protecting LLM data during fine-tuning. Federated learning keeps task data local and uses privacy-preserving techniques, while differential-privacy approaches seek private inference and a balance between tuning utility and privacy.

  • B. Privacy Protection in Fine Tuning: Federated learning addresses privacy across data, models, and commands, supporting diverse fine-tuning contexts.The paper characterizes this as a holistic and comprehensive privacy-protection solution.
  • 1) Federated Learning:: Federated learning extends privacy protection to LLM fine-tuning by distributing a pre-trained global model to edge devices or local servers.Each device or server fine-tunes the model using locally held, task-specific data.
  • 1) Federated Learning:: Federated fine-tuning keeps sensitive data on user devices, avoiding direct transmission and sharing.Reported approaches combine differential privacy, secure aggregation, and homomorphic encryption.
  • 1) Federated Learning:: Pre-training uses extensive general datasets for foundational language comprehension, whereas fine-tuning uses targeted datasets for specialized tasks and stricter local-device privacy.The paper notes that privacy-protection requirements differ between these stages.
  • 2) Differential Privacy:: Differential-privacy approaches protect privacy-sensitive tuning data while enabling secure and private inference.They focus on balancing data utility during model tuning with data privacy.
  • 2) Differential Privacy:: EW-Tune applies the Edgeworth accountant to provide finite-sample differential-privacy guarantees for fine-tuning LLMs on private data.The framework is designed to avoid compromising privacy during private-data fine-tuning.

3) Knowledge Unlearning: … 1) Homomorphic Encryption:

The section presents knowledge unlearning and offsite tuning as privacy-preserving strategies for removing or localizing sensitive information, then introduces inference-time protections centered on homomorphic encryption. Homomorphic encryption enables computation on ciphertexts, with variants differing in the operations and operation counts they support.

  • 3) Knowledge Unlearning:: Knowledge unlearning removes sensitive information encoded in trained LLMs to reduce privacy risks after deployment.It addresses information retained through learned patterns and correlations.
  • 3) Knowledge Unlearning:: During fine-tuning, retraining eliminates selected memories so models avoid retaining or disclosing sensitive details while maintaining or enhancing performance.The method targets information learned during initial training phases.
  • 3) Knowledge Unlearning:: Proposed unlearning methods include unlearning layers, gradient ascent on targeted sequences, and modified datasets with reinforcement bootstrapping.These approaches aim to erase sensitive information efficiently without compromising overall model integrity or performance.
  • 4) Offsite Tuning:: Offsite tuning protects privacy by using lightweight adapters and compressed emulators for localized model adjustments.Only essential components are transmitted to the data owner, avoiding exposure of the entire model.
  • VII. PRIVACY PROTECTION IN INFERENCE: Inference-stage privacy protection includes encryption-based, detection-based, and hardware-based approaches.These strategies address privacy leakage during LLM inference.
  • A. Cryptography-based Approaches: Homomorphic encryption enables computations on ciphertexts whose decrypted results match operations performed directly on plaintexts.It allows data processing while the data remains encrypted.
  • 1) Homomorphic Encryption:: Partial homomorphic encryption supports one operation type, somewhat homomorphic encryption supports limited operations, and fully homomorphic encryption supports unlimited addition and multiplication.These categories differ in the operations and computational capacity available on ciphertexts.
  • 1) Homomorphic Encryption:: HE-based inference encrypts model parameters and input data, enabling predictions without decrypting sensitive information or exposing raw data and model architecture.The supplied example THE-X replaces GELU with ReLU and approximates SoftMax and LayerNorm for fully homomorphic operations, but may leak intermediate ReLU results to the client.

2) Multi-Party Computation:

Multi-Party Computation (MPC) lets mutually distrustful parties jointly compute outputs while keeping their private inputs hidden. In LLM privacy protection, MPC supports secure aggregation, inference, and labeling, but its complexity can limit practicality and efficiency.

  • Definition: MPC enables mutually distrustful parties to collaboratively compute a result without revealing their individual private data.It uses a secure protocol so participants jointly perform a computation while preserving input confidentiality.
  • Formalization: Given private inputs X_1, X_2, ..., X_n and a function f, parties compute Y=f(X_1, X_2, ..., X_n) while learning only the relevant output.Each party may receive the full output or only the portion relevant to them.
  • Applications: MPC supports secure model-update aggregation, encrypted-data inference, and collaborative data labeling without exposing sensitive updates, inputs, or raw labels.These applications include federated learning, inference shielding data from central servers, and confidentiality-preserving labeling.
  • LLM Inference: MPC-based private inference has been studied for transformer models, including CipherGPT and approaches using ReLU functions for secure attention computation.These methods address privacy-preserving inference while targeting transformer-specific operations.
  • Limitations: MPC’s complexity may hinder the practicality and efficiency of privacy-preserving inference.This limitation is identified alongside advances in secure transformer inference.
  • LLM Inference: PUMA uses replicated secret sharing and approximates expensive GeLU and softmax functions to enable efficient, secure inference on models such as LLaMA-7B.The framework targets efficient evaluation of large transformer models under MPC.

3) Functional Secret Sharing: · 4) Differential Privacy · B. Detection-based Approaches

The surveyed approaches protect LLM privacy through functional secret sharing, differential privacy, and detection-based methods. These techniques preserve confidentiality during computation or generation, detect explicit and inferable leaks, and face efficiency or coverage limitations.

  • 3) Functional Secret Sharing:: FSS divides a secret or function into cryptographic shares that are individually insufficient to reveal the underlying secret.Different participants independently compute on their shares, which are later combined to reconstruct only the final result.
  • 3) Functional Secret Sharing:: SIGMA is a two-party FSS-based system for secure transformer inference designed to reduce latency and communication overhead while preserving standard 2PC security.The approach specifically targets Generative Pre-trained Transformers.
  • 4) Differential Privacy: Differential privacy protects LLM inference by adding noise to outputs and tuning parameters to balance privacy budgets against prediction accuracy.Continuous monitoring is described as a way to maintain privacy-utility balance over time.
  • 4) Differential Privacy: Recent methods apply differential privacy to decoding, fine-tuning, inference, and text generation, including the Split-and-Denoise method.The cited approaches address privacy during the forward pass and combine local differential privacy with additional denoising procedures.
  • 4) Differential Privacy: HE-, MPC-, and FSS-based private inference provide demonstrable security within rigorously defined threat models.Their performance and efficiency limitations hinder near-term adoption by prominent model service providers despite improvements to critical components.
  • B. Detection-based Approaches: Detection-based privacy protection examines generated text for directly exposed information or privacy that can be inferred through contextual associations.These strategies are presented as applicable to LLMs for assessing and mitigating privacy risks.
  • B. Detection-based Approaches: Black-box probing uses crafted prompts to elicit PII from model outputs and evaluate the likelihood of inadvertent disclosure.A separate zero-shot defense strategy uses a harm classifier to curb harmful content generation.

1) Direct Detection: … 2) Confidential Computing with Trusted Execution Environment (TEE):

The section surveys direct and contextual detection methods for LLM privacy risks, then examines hardware-based protections, data locality, and confidential computing with TEEs. It emphasizes model vulnerabilities, manipulation limits, secure execution, and privacy-preserving distributed adaptation.

  • 1) Direct Detection:: CONFAIDE evaluates LLM privacy reasoning across four complexity levels and finds notable deficiencies in GPT-4 and ChatGPT’s privacy preservation and social reasoning.The benchmark targets privacy reasoning rather than only output-level leakage.
  • 1) Direct Detection:: Email-focused risk assessment analyzes memorization and association to expose vulnerabilities in how language models may unintentionally disclose or link information.Huang et al.’s framework targets privacy leakage risks in pretrained language models.
  • 2) Contextual Inference Detection:: Detection-based approaches are identified as a distinct strategy for detecting privacy risks in language-model outputs.The passage labels this finding under contextual inference detection without providing further methodological detail.
  • 2) Contextual Inference Detection:: Attackers can exploit text complexity and variability to craft impermissible outputs from seemingly permissible ones, limiting practical output scrutiny.The limitation motivates dynamic security measures beyond simple filtering or static rules.
  • C. Hardware-based Approaches:: Hardware-based approaches use specialized features and technologies to create secure execution environments and protect data during LLM processing.The approach focuses on privacy protection through hardware rather than solely software controls.
  • C. Hardware-based Approaches:: Trusted execution environments, hardware virtualization, secure enclaves, hardware roots of trust, and encrypted processing target confidentiality, integrity, and privacy for model parameters and processed data.These technologies protect both model-side and data-side assets.
  • 1) Data Locality:: PrivateLoRA keeps private data and personalized parameters on edge devices, splits model parameters across cloud and edge, and transmits only unreadable activations and gradients.It also uses three sequential low-rank matrices and Low Rank Residual Transmission to reduce communication overhead.

VIII. CHALLENGES AND FUTURE DIRECTIONS … 1) Challenges:

The paper identifies opacity, sensitive training data, multimodal complexity, and personalized-data risks as major LLM privacy challenges. It proposes interpretability, adversarial testing, privacy-preserving multimodal methods, and broader privacy definitions as future directions.

  • A. Difficulties in Understanding Black-Box LLMs — 1) Challenges:: Black-box opacity makes it difficult to understand LLM decisions, sensitive-information handling, and potential privacy leakage.Pre-trained LLMs’ internal workings and decision-making processes are not fully transparent or interpretable.
  • A. Difficulties in Understanding Black-Box LLMs — 1) Challenges:: Training on vast, diverse datasets that may contain sensitive or personally identifiable information complicates privacy analysis.The paper highlights the complexity of determining how LLMs process and retain such data without compromising privacy.
  • A. Difficulties in Understanding Black-Box LLMs — 2) Future Directions:: Interpretability techniques analyzing activations, attention mechanisms, and internal representations could expose privacy vulnerabilities in pre-trained LLMs.These methods are proposed to clarify model decisions and privacy implications.
  • A. Difficulties in Understanding Black-Box LLMs — 2) Future Directions:: Adversarial testing, including generated adversarial examples, could evaluate pre-trained LLM robustness against privacy attacks and reveal exploitable weaknesses.The passage presents adversarial probing as a way to identify behavior that may lead to privacy problems.
  • B. Privacy in Multimodal LLMs — 1) Challenges:: Research has emphasized textual models such as GPT and BERT, leaving Multimodal LLM privacy comparatively less investigated.Multimodal LLMs are relatively recent and integrate textual and visual information.
  • B. Privacy in Multimodal LLMs — 2) Future Directions:: Multimodal LLMs require privacy definitions and fusion techniques addressing data complexity, unique risks, intermodal interactions, user expectations, and regulation.Suggested directions include encryption, differential privacy, and privacy-preserving machine-learning algorithms tailored to multimodal processing.
  • C. Privacy in Personalized LLMs — 1) Challenges:: Personalized LLMs may expose stored conversations, queries, browsing history, and inferred sensitive attributes through unauthorized access or misuse.The passage identifies health status, political views, and financial situation as examples of potentially inferred personal information.

2) Future Directions: … IX. CONCLUSION

The paper calls for lifecycle-wide, multifaceted privacy protection for LLMs, combining technical safeguards, evaluation, and privacy-aware architectures. It concludes by synthesizing privacy leakage and attacks with protection technologies and their strengths, weaknesses, challenges, and limitations.

  • 2) Future Directions:: Personalized fine-tuning requires architectures specifically designed for privacy and combinations of differential privacy, federated learning, secure multiparty computation, and data perturbation.The stated goal is to safeguard personalized fine-tuning from privacy leakage.
  • 1) Challenges:: LLM privacy research must account for interconnected vulnerabilities across pre-training, prompt tuning, and inference rather than treating lifecycle stages in isolation.Inference breaches may originate from backdoors introduced during pre-training.
  • D. Privacy Protection Throughout the Entire Creation Process of LLMs: Protecting privacy throughout LLM creation requires minimizing sensitive-data collection, obtaining informed consent, and anonymizing or pseudonymizing data.These measures aim to mitigate re-identification risks.
  • 2) Future Directions:: Federated learning, secure multiparty computation, and differential privacy can protect individual privacy when training LLMs on decentralized data sources.The approaches support training without directly exposing private data and can add noise during training.
  • 2) Future Directions:: Privacy impact assessments and adversarial testing during model evaluation can identify and address privacy risks before deployment.These evaluations complement privacy-preserving preprocessing and training techniques.
  • 1) Future Directions:: Confidential computing capabilities could be integrated into LLM workflows to protect data and operations against unauthorized access, manipulation, and breaches across the lifecycle.NVIDIA Confidential Computing is presented as providing confidentiality and integrity protections for sensitive information.
  • IX. CONCLUSION: The survey examines federated learning, differential privacy, knowledge unlearning, and hardware-assisted privacy protection across stages of LLM privacy inference.It analyzes privacy leakage, privacy attacks, and the strengths and weaknesses of existing protection approaches.
Loading 2403.05156v2…