PaperlayerView exact revision on arXiv

Source-linked AI summary

Privacy Preserving Prompt Engineering: A Survey

Kennedy Edemacu, Xintao Wu

arXiv:2404.06001v2cs.CL

TL;DR

Sensitive information in prompts creates privacy risks during ICL and prompting. This survey organizes privacy-protection frameworks by mechanism and privacy objective. It also identifies computational inefficiency among the weaknesses of existing frameworks.

  • Problem

    Prompts may contain sensitive user information that could be accessed by an untrusted LLM server or an adversary bypassing the service API.

    Source: §I · p. 1

  • Method

    The survey reviews privacy-preserving prompting frameworks and classifies mechanisms under non-DP, local DP, global DP, and other scenarios.

    Source: §I · p. 2

  • Results

    The survey links privacy mechanisms to privacy objectives and organizes frameworks according to the mechanisms they employ.

    Source: §I · p. 2, §VI · p. 19

  • Takeaways & Limitations

    Establishing benchmarks for NLP tasks with limited real-world evaluation data would support consistent and measurable progress in privacy-preserving prompting.

    Source: 6) Benchmark Datasets and Open Source… · p. 19

    Existing frameworks have weaknesses that include computational inefficiency, semantic inadequacies, and privacy and trustworthiness challenges.

    Source: A. Limitations · p. 16

Abstract

from arXiv · show

Pre-trained language models (PLMs) have demonstrated significant proficiency in solving a wide range of general natural language processing (NLP) tasks. Researchers have observed a direct correlation between the performance of these models and their sizes. As a result, the sizes of these models have notably expanded in recent years, persuading researchers to adopt the term large language models (LLMs) to characterize the larger-sized PLMs. The size expansion comes with a distinct capability called in-context learning (ICL), which represents a special form of prompting and allows the models to be utilized through the presentation of demonstration examples without modifications to the model parameters. Although interesting, privacy concerns have become a major obstacle in its widespread usage. Multiple studies have examined the privacy risks linked to ICL and prompting in general, and have devised techniques to alleviate these risks. Thus, there is a necessity to organize these mitigation techniques for the benefit of the community. This survey provides a systematic overview of the privacy protection methods employed during ICL and prompting in general. We review, analyze, and compare different methods under this paradigm. Furthermore, we provide a summary of the resources accessible for the development of these frameworks. Finally, we discuss the limitations of these frameworks and offer a detailed examination of the promising areas that necessitate further exploration.

I. INTRODUCTION

LLMs enable prompting, including in-context learning (ICL), which uses demonstration examples without updating model parameters. This survey focuses on privacy risks in prompt data and systematically organizes methods for protecting privacy during prompting.

A. Language Models

  • LLMs are large-sized PLMs, and their parameter sizes can reach hundreds of billions, with substantial training and storage demands.The paper uses “PLMs” and “LLMs” interchangeably.Source: §I · p. 1

I. INTRODUCTION

  • ICL uses demonstration examples to address downstream tasks without modifying model parameters for each task.Prompting can also use natural-language instructions without examples, as in zero-shot prompting.Source: §I · p. 1
  • Sensitive prompt data may be exposed to an untrusted LLM server or an adversary that bypasses the provider’s API.The authors distinguish these risks from privacy threats involving training or fine-tuning data.Source: §I · p. 1
  • The survey classifies privacy-preserving prompting frameworks into non-DP, local DP, global DP, and other scenarios, linking mechanisms to privacy objectives.The reviewed mechanisms include differential privacy, sanitization, lattice, encryption, and ensembling.Source: §I · p. 2, Figure 1 · p. 2
  • Earlier surveys cover topics such as training-data privacy, cybersecurity, and LLM trustworthiness, while the authors describe prompting privacy as having limited coverage.They characterize their work as the first systematic organization of literature on privacy protection in prompting-based LLM use [30]–[34].Source: §I · p. 2

2) Prompting:

Prompting guides an LLM with instructions, examples, or other context without requiring parameter updates for each task. The section distinguishes discrete and continuous prompts and describes ICL as using demonstrations and a query to elicit predictions.

2) Prompting:

  • Discrete prompts are natural-language token sequences whose optimization searches the discrete text space.Common optimization categories include gradient-based, reinforcement-learning-based, edit-based, and LLM-based approaches.Source: 2) Prompting · p. 3
  • Prompt elements can include task descriptions, input data, and contextual information that guide the LLM’s response.The prompt is represented as a sequence of tokens.Source: 2) Prompting · p. 3
  • Continuous prompts are task-specific embeddings that can be submitted to white-box LLMs in place of discrete input tokens.They may be formed from token-level word embeddings or an encoder representation of the whole prompt.Source: 2) Prompting · p. 3
  • Continuous prompts can be learned as trainable parameters using downstream-task data or prompt-based transfer learning.The section gives supervised cross-entropy minimization as one optimization strategy.Source: 2) Prompting · p. 3

3) In-Context Learning (ICL):

  • ICL prompts may contain a task description, demonstration examples, and a query, presented as natural-language text.The figure distinguishes these components by color: green, blue, and orange, respectively.Source: 3) In-Context Learning (ICL) · p. 3, Figure 2 · p. 3
  • ICL concatenates a test query with demonstration examples and submits them, usually with a task description, to a remote LLM for prediction without parameter updates.The model uses patterns in the demonstrations to predict the query’s answer.Source: 3) In-Context Learning (ICL) · p. 3
  • ICL performance depends on prompt construction, particularly the selection of demonstration examples.A single trained model can be used across downstream tasks; unlike instruction tuning, ICL does not fine-tune the model for adaptation.Source: 3) In-Context Learning (ICL) · pp. 3–4
  • Chain-of-thought, planning, and database augmentation are described as ways to enrich prompts with reasoning steps, task plans, or external knowledge.Database augmentation uses a retriever to find information from external sources and a generator to combine it with instructions.Source: 3) In-Context Learning (ICL) · p. 4

1) Differential Privacy (DP):

The section contrasts global and local differential privacy and describes properties that govern repeated releases, post-processing, and subsampling. It also presents metric LDP as a distance-sensitive variant of local privacy.

1) Differential Privacy (DP):

  • Global DP assumes a trusted curator who accesses individuals’ raw data and processes it with a randomized algorithm.Its guarantee concerns datasets differing by one record.Source: 1) Differential Privacy (DP) · p. 4
  • In global DP, ε controls the privacy guarantee: smaller ε means stronger privacy and more noise, while δ is a small error probability.When δ = 0, the mechanism is ε-DP.Source: 1) Differential Privacy (DP) · p. 4
  • Local DP requires no trusted central curator; individuals perturb their data before sending it for analysis.Its guarantee applies to any two possible inputs rather than only neighboring datasets.Source: 1) Differential Privacy (DP) · p. 4
  • Metric LDP scales the indistinguishability requirement for output distributions by the distance between inputs.When the distance metric is 1, metric LDP is equivalent to LDP.Source: 1) Differential Privacy (DP) · p. 4

2) Differential Privacy Properties:

  • Post-processing an output of a DP mechanism preserves its existing privacy guarantee.The section states that applying any randomized algorithm to an (ε, δ)-DP output retains the same parameters.Source: 2) Differential Privacy Properties · p. 4
  • Composition guarantees privacy when multiple DP mechanisms release outputs based on the same data.The combined mechanism runs the component algorithms sequentially.Source: 2) Differential Privacy Properties · p. 4
  • Subsampling can improve sample secrecy by adding randomness before a DP mechanism is run.The section describes first creating a subsampled dataset and then applying the mechanism to it.Source: 2) Differential Privacy Properties · p. 4

3) Differential Privacy Mechanisms:

Differential privacy mechanisms protect data by controlling how much outputs can change when records change. In prompting, privacy protection is organized around prompts and LLM outputs, with methods grouped into non-DP, local-DP, global-DP, and other scenarios.

3) Differential Privacy Mechanisms:

  • Laplace noise is calibrated to query sensitivity, while the exponential mechanism samples higher-scoring outputs to protect non-numeric queries.The Laplace mechanism adds noise scaled to sensitivity; the exponential mechanism selects from a quality-based output distribution while guaranteeing ε-DP.Source: 3) Differential Privacy Mechanisms · pp. 4–5
  • Sample-and-aggregate computes a function on separate data partitions, then privately aggregates their results to limit each record’s influence.The framework uses smooth sensitivity to calibrate instance-specific noise.Source: 3) Differential Privacy Mechanisms · p. 5
  • PATE trains teachers on disjoint private-data subsets and uses noisy majority votes to label public data for student-model training.The student learns from the public dataset using aggregated teacher labels.Source: 3) Differential Privacy Mechanisms · p. 5
  • DP-SGD clips individual gradients, aggregates them, and adds Gaussian noise; a moments accountant can give tighter privacy-loss bounds across steps.The clipping bound controls gradient-sum sensitivity; the moments accountant is tailored to the Gaussian mechanism.Source: 3) Differential Privacy Mechanisms · p. 5

III. PROMPTING WITH PRIVACY PROTECTION

  • Prompt privacy methods target prompts, including demonstrations, and LLM outputs, and are grouped into non-DP, local-DP, global-DP, and other scenarios.The survey presents this taxonomy in Table I.Source: §III · p. 5

A. Non-DP Methods

Non-DP approaches protect prompts or demonstrations through sanitization, ensembling, and obfuscation or lattice transformations. These methods range from local text rewriting to collaborative inference with decoy inputs or tokens.

1) Sanitization Methods:

  • PP-TS sanitizes inputs locally and restores sensitive attributes after cloud inference, while HaS uses separate hiding and seeking models but faces training and effectiveness challenges.CoGenesis instead keeps the personal instruction local while using a cloud sketch or combined cloud/local logits.Source: 1) Sanitization Methods · pp. 5–6

2) Ensemble-Only Methods:

  • Ensemble methods address demonstration-example membership leakage by combining predictions from models prompted with disjoint private-data subsets.Avg-Ens averages probability vectors; Vote-Ens selects the token predicted by the majority of models.Source: 2) Ensemble-Only Methods · pp. 6–7

3) Obfuscation/Lattice Methods:

  • Obfuscation methods protect inputs and outputs; IOI mixes real and dummy instances, while LatticeGen sends permuted true and noise tokens for collaborative generation.LatticeGen’s server returns token options that the user maps back through reverse permutation.Source: 3) Obfuscation/Lattice Methods · p. 7

4) Encryption Methods:

Encryption methods aim to protect prompts and responses, while local-DP methods privatize text representations before prompts reach an untrusted LLM. The local-DP approaches span token perturbation and semantic-preserving replacements.

4) Encryption Methods:

  • EmojiCrypt encrypts sensitive prompt inputs as emojis, while cryptographic inference frameworks use techniques such as homomorphic encryption and secret sharing.CipherGPT supports secure GPT inference with protocols for matrix multiplication, GELU, and top-k sampling; practical text generation is limited by high computational and communication costs.Source: 4) Encryption Methods · p. 7

B. Local DP Methods

  • Local-DP methods perturb text representations before sending the resulting prompt to a remote black-box LLM.The process encodes text as vectors, applies DP noise, and maps the perturbed representations back into text; post-processing preserves DP.Source: B. Local DP Methods · pp. 7–8
  • Word-level approaches privatize token representations or replace words with semantically similar alternatives, using mechanisms including unary encoding, Laplace noise, and the exponential mechanism.Methods described include metric LDP and utility-optimized SANTEXT+, which allocates different privacy budgets to sensitive and insensitive token sets.Source: B. Local DP Methods · p. 8, 1) Word Level Perturbation · p. 8

1) Word Level Perturbation:

Prompt privacy methods perturb words, sentences, documents, or demonstration examples at different granularities. Global-DP approaches generate private demonstrations to limit what an untrusted LLM can infer about individual training examples.

1) Word Level Perturbation:

  • Word-level perturbation replaces tokens with alternatives, but independent word changes can make generated text partially inconsistent and semantically incoherent.InferDPT uses a local language model to extract a coherent, consistent response aligned with the raw prompt.Source: 1) Word Level Perturbation · p. 9

2) Sentence Level Perturbation:

  • Sentence-level methods privatize sentence embeddings or perturb embedding matrices with noise, including for inference with known LLM architectures and parameters.DP-Forward adds analytic matrix Gaussian mechanism noise to embeddings before the task layers process them.Source: 2) Sentence Level Perturbation · p. 9

3) Document Level Perturbation:

  • DP-Prompt creates a differentially private paraphrase of a private document through sequential token selection with the exponential mechanism.The paraphrased document is released as a sanitized prompt for cloud LLMs.Source: 3) Document Level Perturbation · p. 9

4) Demonstration Example Level Perturbation:

  • LDP-TabICL applies randomized response to tabular attributes, reconstructs protected data, selects demonstration samples, and serializes them for ICL.The private demonstrations are generated before being concatenated with a query for prompting.Source: 4) Demonstration Example Level… · p. 9

C. Global DP Methods

  • Global-DP methods generate private demonstrations so an individual sample’s presence or absence has no significant impact on the demonstrations sent to an untrusted LLM.The surveyed approaches include sample-and-aggregate, PATE, DP synthetic data generation, and soft-prompt generation via DPSGD.Source: C. Global DP Methods · p. 9

1) Sample and Aggregate based Approach:

The survey groups privacy-preserving demonstration generation into sample-and-aggregate, PATE-based, and differentially private synthetic-data approaches. These methods privatize examples or labels before they are used for prompting and in-context learning.

1) Sample and Aggregate based Approach:

  • Local-LLM approaches generate private demonstrations token by token with private aggregation, while DP-OPT privately generates prompts through forward and backward passes.Tang et al. limit candidate tokens to the instruction-only top-K vocabulary, and generated examples can be reused for unlimited queries without additional privacy cost.Source: 1) Sample and Aggregate based Approach · pp. 10–11

2) PATE-Based Approach:

  • PromptPATE uses disjoint private-data subsets as teachers and a noisy vote consensus to label public unlabeled examples for subsequent ICL.The vote aggregation uses Gaussian noise to satisfy differential privacy guarantees.Source: 2) PATE-Based Approach · p. 11, Figure 6 · p. 11
  • PATE-based generation also covers token-supervised text generation and visually prompted image samples, though the survey says image-prompting studies remain rare.SeqPATE interpolates teacher output distributions, while Prom-PATE privately aggregates re-teacher responses to label public images.Source: 2) PATE-Based Approach · p. 11

3) DP Synthetic Data Generation:

  • Differentially private synthetic-data methods fine-tune generative models or use private selection to create reusable text, queries, or other synthetic samples.AUG-PE iteratively selects synthetic samples using a noisy nearest-neighbor histogram; DeepCandidate instead applies the exponential mechanism to candidate sentence embeddings.Source: 3) DP Synthetic Data Generation · pp. 11–12

1) Sample and Aggregate based Approach:

  • Tabular ICL methods privatize demonstrations through randomized-response perturbation or differentially private statistics, then reconstruct or generate examples for serialization.GDP-TabICL uses Poisson subsampling and Laplace-noised aggregates; the survey describes its reconstruction approach as less computationally costly than methods relying on local LLMs.Source: Figure 4 · p. 10, 3) DP Synthetic Data Generation · p. 12

4) Soft Prompt via DPSGD:

The survey covers privacy protection for learned soft prompts, private responses to ICL queries, external datastore augmentation, and federated visual prompting. These approaches differ in their privacy mechanisms and access or query constraints.

4) Soft Prompt via DPSGD:

  • PromptDPSGP learns soft prompts with DP-SGD by clipping and noising their gradients, but requires white-box access to the LLM.The soft prompt is prepended to private-data embeddings before prediction and loss computation.Source: 4) Soft Prompt via DPSGD · p. 12, Figure 7 · p. 12

1) Demonstration Examples at LLMs:

  • DP-ICL privately aggregates responses generated from disjoint private-data subsets, but each query consumes privacy budget.For generation, the survey describes embedding-space aggregation and keyword-space aggregation as alternatives to noisy majority-class release.Source: 1) Demonstration Examples at LLMs · pp. 12–13, Figure 8 · p. 13

2) Data Augmentation using External Datastores:

  • External datastore augmentation can improve ICL when local data is insufficient, but retrieved material may expose sensitive information from those stores.The survey frames the challenge as adding external knowledge to prompts without compromising datastore privacy.Source: 2) Data Augmentation using External… · p. 13
  • Sanitization replaces sensitive datastore content while retaining structural properties, whereas information-flow control checks access policies for retrieved private data.Replacement options include an end-of-text marker, dummy text, or public data; multi-hop retrieval can order access across public and private corpora.Source: 2) Data Augmentation using External… · p. 13

3) Client Data Protection via FL:

  • PromptFL keeps client data local and collaboratively trains shared soft prompts by communicating gradients rather than data.The framework assumes each client has a CLIP foundation model.Source: 3) Client Data Protection via FL · p. 13
  • Personalized federated prompting generates client-specific prompts through adaptive networks or a server-learned prompt generator, with local prompt adaptation in pFedPG.The survey presents these approaches as insights for further exploration of client-level privacy in NLP.Source: 3) Client Data Protection via FL · pp. 13–14

IV. RESOURCES

This section inventories datasets used to evaluate privacy-preserving prompting frameworks, organizing text resources by NLP task. The collection spans classification, information extraction, and other task types.

A. Datasets

1) Text Datasets:

  • Text classification resources include news, topic, question, sentiment, disaster, and inference datasets such as AGNews, DBPedia, TREC, and CB.The survey also lists SST-2, MPQA, Disaster, and CB, alongside AGNews and DBPedia.Source: 1) Text Datasets · p. 14
  • The text collection also includes QNLI and MNLI inference datasets, QQP question pairs, and BBC articles labeled by topic.The survey reports training and test sample counts for these datasets.Source: 1) Text Datasets · p. 14
  • Information-extraction evaluations draw on Enron Emails, WikiText, MIT Movies trivia, ACE2005, Elsevier, and Arxiv.These resources range from emails and Wikipedia text to multilingual annotated files and scientific-article collections.Source: 1) Text Datasets · p. 14
  • Other task resources include DocVQA and ConcurrentQA for question answering, WritingPrompts for creative writing, SAMSum for summarization, and Amazon beauty reviews for recommendation.The survey associates these datasets with the cited works’ respective task evaluations.Source: 1) Text Datasets · pp. 14–15

2) Tabular Datasets:

The tabular-dataset subsection lists resources used by privacy-preserving prompting studies, including the Adult dataset and datasets used by Carey et al. for tabular ICL.

2) Tabular Datasets:

  • For tabular data analysis, the survey identifies Adult for one study and Bank, Blood, Calhousing, Car, Diabetes, Heart, and Jungle for another.The listed datasets cover income, deposits, blood donation, housing values, car states, diabetes, heart disease, and jungle chess outcomes.Source: 2) Tabular Datasets · p. 15
  • The tabular resources span 748 to 48,842 samples across the listed datasets, with feature counts ranging from 4 to 16.Blood has 748 samples and 4 features; Adult has 48,842 samples and 12 features, while Bank has 45,211 samples and 16 features.Source: 2) Tabular Datasets · p. 15
  • Heart contains 918 samples and 11 features, while Jungle contains 44,819 samples and 6 features.The Heart dataset concerns heart-disease prediction, and Jungle concerns predicting the winner of a two-piece endgame of jungle chess.Source: 2) Tabular Datasets · p. 15

3) Image Datasets:

The surveyed image datasets cover varied domains and classification tasks, while software tools aim to protect prompts, demonstrations, and responses. Proprietary tools use approaches including attribute replacement, monitoring, blocking, and sanitization.

3) Image Datasets:

  • Image datasets range from multi-domain benchmarks to image collections organized by classes and sources.Office-Caltech10 has 2,533 samples across four domains and 10 classes per domain; DomainNet has 0.6 million samples, 345 classes, and six domains. Dermoscopic-FL has 10,490 samples from four sites; CIFAR-10 and CIFAR-100 each have 60,000 images, and Blood-MNIST has 17,092 images across eight classes.Source: 3) Image Datasets · pp. 15–16

1) Proprietary Software Tools:

  • Anonos Prompt Protector replaces sensitive attributes with dummy values and restores originals in LLM responses; Prompt Security detects sensitive information and sanitizes or blocks it.Prompt Security also offers protection against prompt injection and jailbreak attacks.Source: 1) Proprietary Software Tools · p. 16
  • WhyLabs and CalypsoAI Moderator assess exchanges or prompts to block privacy-violating content, while Lakera Guard replaces PII with entity types and also targets prompt injection and harmful content.These tools are designed to integrate with LLM applications to protect prompts, demonstration examples, and responses.Source: 1) Proprietary Software Tools · p. 16, B. Software Tools · p. 16

2) Open Source Software Tools:

Open-source tools anonymize or analyze LLM inputs and responses to mitigate sensitive-information exposure. The surveyed frameworks also face computational, semantic, privacy, and broader trustworthiness challenges.

2) Open Source Software Tools:

  • LLM Guard anonymizes input data and de-anonymizes responses, while Guardrail AI analyzes inputs and responses to detect, quantify, and mitigate risks such as PII exposure.LLM Guard also detects harmful language and defends against prompt injection.Source: 2) Open Source Software Tools · p. 16

1) Computational Inefficiency:

  • Computational costs arise from local model requirements, repeated inference, token exchange, per-configuration fine-tuning, and resource-intensive collaborative cryptographic computation.The burden can particularly disadvantage everyday users who cannot run local models; token exchange costs worsen for long text sequences.Source: 1) Computational Inefficiency · pp. 16–17

2) Semantic Inadequacy:

  • Perturbation, encryption, and distillation approaches can impair semantic quality, with word-level perturbation especially raising concerns for text-generation tasks.The surveyed word-level LDP methods were developed for privacy-preserving classification, and their effectiveness for privacy-preserving LLM prompting needs more research.Source: 2) Semantic Inadequacy · p. 17

3) Privacy Challenges:

  • Privacy limitations include context-dependent sensitivity labels, missing formal guarantees, residual personal-data exposure, and query limits without privacy accounting.DP-ICL assumes demonstration examples exist at the LLM and may exhaust its privacy budget if queries exceed a limit.Source: 3) Privacy Challenges · p. 17

4) Trustworthiness Challenges:

  • Token-generation control shared with users can create server-security risks, while tight DP guarantees can disadvantage small classes and produce unfair synthetic data.The paper notes that malicious use of user token selection in LatticeGen could potentially enable server jailbreaking.Source: 4) Trustworthiness Challenges · p. 17

B. Future Prospects

The survey identifies future work across efficiency, semantic quality, privacy, trustworthiness, modalities, and research infrastructure. It also organizes existing prompting privacy frameworks and connects them with resources and open questions.

1) Computationally Efficient Private Prompting:

  • Private ICL remains computationally inefficient; prospects include removing local-LLM dependence, reducing ensemble calls, unifying lattice fine-tuning, and accelerating or redesigning cryptographic implementations.The survey also suggests parallel computing and crypto-friendly model structures to improve cryptographic efficiency.Source: 1) Computationally Efficient Private… · pp. 17–18

2) Mitigating Semantic Inadequacy:

  • Semantic quality remains a concern: larger m-grams may improve LatticeGen [65] text but exponentially expand inference options; IOI, EmojiCrypt [66], and other generation methods also need quality work.For text generation, IOI requires further work on mixed-up tokens and variable output lengths; EmojiCrypt faces emoji-size mismatch and potential misinterpretation.Source: 2) Mitigating Semantic Inadequacy · p. 18

3) Improving Privacy Protection:

  • Sanitization needs domain-aware sensitive-attribute detection, while sentence/document-level prompting must protect secrets beyond the word-level scope surveyed.The survey also calls for combining techniques across privacy levels, including approaches to hide sentence-level secret information.Source: 3) Improving Privacy Protection · p. 18
  • Future work spans multi-level privacy, soft prompts and retrieved datastore information, plus privacy-utility comparisons between prompting and fine-tuning.The survey notes limited attention to soft-prompt privacy and calls for protecting information retrieved from external datastores with mechanisms such as DP or homomorphic encryption.Source: 3) Improving Privacy Protection · p. 18

4) Trustworthy Prompt Engineering:

  • Privacy frameworks need cross-facet trust analysis: collaborative/cryptographic designs may risk server security, and DP can disadvantage small classes in synthetic-data generation.The survey calls for examining effects on truthfulness, safety, fairness, and robustness as well as privacy.Source: 4) Trustworthy Prompt Engineering · p. 18

5) Extension to Other Modalities:

  • Most work targets text and tabular tasks; DP-forward demonstrates inference-time noise in text embeddings, motivating extensions to vision, audio, and video transformers.The survey proposes adapting privacy-preserving prompting approaches to vision-language models and other modalities.Source: 5) Extension to Other Modalities · pp. 18–19

6) Benchmark Datasets and Open Source Software:

  • Synthetic-data evaluation dominates several NLP tasks, while real-world benchmarks are limited; open-source libraries should incorporate established privacy assurances rather than anonymization alone.The survey calls for standardized benchmarks and libraries that make proven privacy mechanisms available to developers and researchers.Source: 6) Benchmark Datasets and Open Source… · p. 19

VI. CONCLUSION

  • The survey structures prompting privacy frameworks by mechanism, connects their privacy objectives and methods, and reviews resources, limitations, and research directions.Its stated aim is to stimulate further interest and advancement in privacy-preserving prompting.Source: §VI · p. 19
Loading 2404.06001v2…