Source-linked AI summary
It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs
Sangwoo Park, Woongyeong Yeo, Seanie Lee, Yumin Choi, Hyomin Lee, Kangsan Kim, Jinheon Baek, Seong Joon Oh, Sung Ju Hwang
TL;DR
LLM assistants must make context-appropriate disclosure decisions without sacrificing task performance, but existing approaches struggle to preserve both privacy and utility. SELFCI addresses this with two feedback-conditioned self-teachers and a Product-of-Experts objective, consistently improving the joint privacy-utility trade-off and generalizing to agentic workflows. The authors identify synthetic data, weaker small-model feedback ability, and static teacher weighting as limitations.
Problem
CI alignment requires assistants to retain task-relevant information while suppressing contextually inappropriate disclosure, a joint requirement existing approaches struggle to satisfy.
Method
SELFCI jointly optimizes reverse KL divergences to two self-generated, feedback-conditioned teachers, one promoting task completeness and one enforcing minimal disclosure.
Results
SELFCI consistently improves the joint satisfaction of task completeness and minimal disclosure across model backbones, in-domain evaluations, and out-of-domain agentic and memory settings.
Takeaways & Limitations
The results indicate that contextual privacy need not come at the cost of native task-solving utility and that the approach generalizes to out-of-domain agentic workflows.
Takeaways & Limitations
SELFCI relies on structured synthetic data, model-generated privileged feedback that may challenge smaller models, and a static coefficient λ whose adaptive selection remains future work.
Abstract
from arXiv · showhide
Contextual Integrity (CI) defines privacy not merely as keeping information hidden, but as governing information flows according to the norms of a given context. As large language models are increasingly deployed as personal agents handling sensitive workflows, adhering to CI becomes critical. However, even frontier models remain unreliable in making disclosure decisions, and existing mitigation strategies often degrade underlying task performance. To overcome this privacy-utility trade-off, we propose SELFCI, a complementary self-distillation framework that decouples information suppression from task resolution. SELFCI jointly optimizes two independent reverse KL divergences over distinct teacher distributions derived from feedback: one encourages preserving task-relevant information for utility, while the other enforces minimal and appropriate disclosure. This complementary formulation induces a Product-of-Experts (PoE) target, aligning the policy with the intersection of capability and privacy requirements. Empirical evaluations demonstrate that SELFCI, without relying on costly external supervision, consistently outperforms competitive baselines such as online reinforcement learning algorithms (e.g., GRPO). These trends further extend to out-of-domain settings involving agentic workflows and accumulated private context, suggesting that SELFCI provides a practical path toward CI alignment.
1 Introduction
CI alignment requires assistants to preserve information needed for a task while suppressing information whose disclosure is contextually inappropriate. SELFCI addresses this asymmetric privacy-utility challenge with complementary self-distillation and reports consistent gains across domains and model backbones.
- Contextual Integrity governs whether information flows are appropriate for the recipient, purpose, and surrounding task, rather than requiring all private information to remain secret.
- CI alignment must retain task-relevant information while treating task-irrelevant or inappropriate information as unavailable.
- Existing approaches face supervision and optimization trade-offs: supervised trajectories are costly and exposure-prone, while online reinforcement learning uses sparse feedback that entangles task success with disclosure compliance.
- SELFCI jointly optimizes two reverse KL divergences over self-generated, feedback-conditioned teachers for task completeness and contextual privacy.The resulting objective is equivalent to matching a Product-of-Experts target concentrated on behaviors satisfying both requirements.
- SELFCI consistently improves joint task completeness and minimal disclosure across in-domain and out-of-domain evaluations involving agentic and intensive-memory settings.The reported evaluations compare SELFCI with online reinforcement learning and external-teacher context distillation baselines.
2 Preliminaries
The paper formalizes CI as context-dependent information flow: disclose the minimal information sufficient for the task, while remaining invariant to additional disallowed information. Direct ablation alone is under-specified because it does not explain how allowed information should affect generation.
- CI privacy depends on whether disclosure is appropriate for the task, recipient, and purpose, not merely on whether the assistant can access sensitive information.
- For task instruction T, AT is the minimal sufficient information subset allowed for disclosure, while DT contains unnecessary or inappropriate information that is disallowed.
- The objective jointly maximizes recall of AT for task completeness and minimizes leakage of DT for minimal disclosure.
- The ideal CI state requires task-complete behavior under AT and predictive invariance when DT is additionally present.
- Token-level enforcement matches next-token distributions from full and allowed-only contexts under the same generation prefix.
- Naive ablation is under-specified because it identifies available information without specifying how necessary and inappropriate attributes should influence generation.
3 Our Approach: SELFCI
SELFCI constructs two complementary self-teachers from feedback explaining context-specific disclosure decisions, then jointly distills them to separate retention from suppression. Their weighted objective forms a Product-of-Experts target focused on behaviors that are both task-complete and minimally disclosing.
- SELFCI decouples CI alignment into specialized teacher policies for retaining task-relevant information and suppressing disallowed disclosure.
- The framework uses self-generated feedback to justify why attributes should be disclosed or withheld under context-specific transmission norms.
- Feedback is aggregated separately for allow and disallow attributes and supplied as privileged context to teachers sharing the student model’s parameters.
- πallow acts as a task-completion expert, whereas πdisallow biases responses toward minimal disclosure and away from restricted information.
- Joint optimization uses two independent reverse KL divergences, with λ controlling the relative emphasis on task completeness and minimal disclosure.Because both teachers reuse the same parameters, training requires additional teacher forward passes rather than a separately trained supervisor.
- The weighted objective is equivalent to reverse KL matching a Product-of-Experts target proportional to πallow^λπdisallow^(1−λ), concentrating probability on their agreement region.
4 Experiment
Across in-domain, out-of-domain, and accumulated-memory evaluations, SELFCI improves contextual privacy while preserving task performance. Ablations show that feedback-conditioned complementary teachers and their product-of-experts combination are central to these gains.
- Main results: SELFCI improves Integrity from 35.34 to 83.56 and Complete from 23.29 to 53.42 on Qwen2.5-7B-Instruct without sacrificing Utility.It also achieves the lowest DKL and highest Complete score among evaluated methods.
- Main results: SELFCI achieves the best Complete score on every reasoning backbone, including Qwen3-4B, where Integrity rises from 32.88 to 82.19 and Complete from 26.03 to 57.26.It also attains the highest Utility on DeepSeek-R1-Distill-Llama-8B.
- Efficiency: SELFCI exceeds 40% Complete by epoch 3 versus epoch 15 for CI-RL and reduces GPU time per step by nearly half.SELFCI uses one rollout per prompt, compared with 16 for CI-RL, while its KL objective supplies dense logit-level supervision.
- Out-of-domain generalization: On PrivacyLens, SELFCI lowers leakage and maintains the highest Helpful score across Qwen3-4B-Instruct and Qwen3-4B.For Qwen3-4B-Instruct, LR falls from 56.59 to 47.06 and ALR from 58.14 to 48.17, with Helpful 2.62.
- Robustness under increasing complexity: With accumulated memories, SELFCI keeps Violation@5 below 5% after 48 tasks, while Initial and CI-RL reach approximately 26% and 21%.The result indicates a more stable context-conditioned disclosure boundary under increasing task accumulation.
- Surrogate analysis: The allowed-only surrogate improves Integrity but substantially reduces Utility, whereas SELFCI retains Utility while improving Integrity through feedback-conditioned πallow and πdisallow.This decomposition addresses the under-specified utility signal produced by simply removing disallowed information.
- Feedback analysis: Feedback improves Complete on both Qwen3-4B-Instruct and Qwen3-4B, including a 12.05-percentage-point gain for the reasoning model.The authors attribute the gain to richer task-specific context than keyword-only conditioning provides.
- Teacher decomposition: Complementary teachers improve Complete by 3.83 and 3.29 percentage points on Qwen3-4B-Instruct and Qwen3-4B, respectively, with only 5–6% more per-step training time.The two teachers guide the policy toward responses satisfying Utility and Integrity jointly.
5 Conclusion
SELFCI frames Contextual Integrity as context-dependent invariance and uses complementary self-teachers to jointly retain task utility and suppress inappropriate disclosure. It improves the privacy-utility trade-off across model families, out-of-domain agentic workflows, and accumulated private context.
- SELFCI treats CI alignment as invariance to disallowed information while preserving responsiveness to information required for task completion.
- The framework uses two feedback-conditioned self-teachers whose Product-of-Experts target provides explicit retain and suppress signals.
- SELFCI consistently improves the privacy-utility trade-off across instruction-tuned and reasoning models.
- SELFCI generalizes to out-of-domain agentic workflows and remains robust under accumulated private context.
Limitations
The evaluation uses structured synthetic data and assumes models can generate and use privileged feedback, while coefficient selection and intermediate-state leakage remain open issues.
- SELFCI relies on structured synthetic data with explicit attribute annotations that may not capture real-world ambiguity in CI norms.
- The method may be less effective for smaller models with weaker in-context learning because it relies on feedback as privileged context.
- SELFCI uses a static λ to balance complementary teachers, leaving adaptive coefficient selection for future work.
- The evaluation focuses on final responses and does not explicitly analyze leakage in reasoning traces or intermediate tool states.
Broader Impacts and Ethics Statement
The paper positions SELFCI as a self-distillation approach for improving contextual privacy without strong proprietary teachers or manually crafted rationales, and evaluates it across several CI settings and baselines.
- SELFCI performs privacy-oriented adaptation without relying on strong proprietary teacher models or manually crafted disclosure rationales.
- Self-Distillation: Self-distillation uses a teacher distribution conditioned on privileged context to provide dense token-level guidance while remaining close to the model’s capabilities.
- Feedback Generation: Feedback is generated from synthetic assistant-task instances with explicit disclosure annotations and organized into allowed and disallowed branches.
- Complementary Teacher Construction: Branch-specific feedback is aggregated and appended as a suffix to the shared base CI-CoT prompt for teacher conditioning.
- Evaluation: The evaluation covers annotated CI scenarios, tool-using agent trajectories, and accumulated user memories, alongside CI-RL, ContextDistill, and larger teacher models.
C.3 Additional Implementation Details
SELFCI uses equal allowed and disallowed teacher weights by default, EMA-updated teacher parameters, and shared generation settings across optimization-based methods.
- SELFCI uses equal branch weights, λ = 0.5, for the allowed and disallowed feedback teachers by default.
- Teacher parameters are initialized from the student and updated by exponential moving average with an update rate of 0.001.
- SELFCI is trained with a total batch size of 2, while rollouts and evaluation generations use temperature 0.7.
- Additional experiments in this section use Qwen3-4B-Instruct.
D.1 Additional Analysis of Teacher Dynamics
The analysis tracks how the allow, disallow, and PoE teacher targets move toward the ideal Contextual Integrity policy during training. The disallow teacher is most privacy-oriented, while the PoE target approaches its KL behavior without collapsing into pure suppression.
- All three teacher targets move closer to the allow-only ideal policy over training.The comparison uses average token-level DKL on the training split.
- The disallow teacher attains the lowest divergence, consistent with its stronger privacy bias.
- The allow teacher remains farther from the ideal because it is more permissive.
- The PoE target substantially reduces divergence while retaining higher Complete than the disallow teacher.It eventually approaches the disallow teacher in KL without collapsing into pure suppression.
D.2 Analysis on KL Objective Design
The KL-direction analysis finds that reverse KL for both teacher branches best balances utility and completeness, whereas forward KL produces more conservative behavior and can suppress useful disclosures.
- Reverse KL on both branches achieves the best Utility and Complete among the compared KL-direction combinations.
- Replacing either branch with forward KL raises Integrity in some settings but lowers Complete.
- Forward KL on both branches yields the highest Integrity but the weakest Utility and Complete.The authors attribute this conservative behavior to broader coverage of teacher behavior, which can suppress useful disclosures.
- SELFCI therefore uses reverse KL for both teachers to move toward their intersection rather than imitate either teacher in isolation.The reverse-KL objective penalizes student probability mass in regions unsupported by each teacher and induces PoE behavior.
D.3 Analysis on Teacher Update Strategy
Teacher-update experiments compare fixed, current-student, and EMA strategies, while EMA-rate results identify a trade-off between teacher adaptation and training stability. The section also situates these choices within the PoE target formulation.
- Teacher update strategy: Using the current student as teacher at every step is unstable and can cause significant degradation after only a few epochs.The moving target can reinforce transient errors.
- Teacher update strategy: A fixed teacher becomes stale as training proceeds, producing a suboptimal no-EMA result.
- Teacher update strategy: EMA best balances teacher adaptation and smoothing among the compared update strategies.The passage reports that EMA achieves the highest result, but the supplied excerpt truncates the specific metric and value.
- EMA update rate: Very slow EMA updates lag behind the student, while faster updates can improve final metrics but reduce training stability.The main experiments adopt an update rate of 0.001 as a stable balance.
- Product-of-Experts formulation: The normalized PoE target emphasizes regions where both teacher distributions assign high probability.Its agreement-focused construction suppresses regions favored by only one teacher.
G Complementary Teacher Objective as an Upper-Bound Surrogate for CI
The complementary teacher loss is linked theoretically to the ideal CI objective through a PoE target and a variational change-of-measure bound. This establishes the training loss as an upper-bound surrogate with an explicit alignment-error gap.
- SELFCI’s complementary teacher loss upper-bounds the KL divergence from the student to the PoE target.The bound is established for any λ in [0,1] and any α > 1.
- A weighted sum of reverse KL divergences from the allow and disallow teachers is equivalent to matching their normalized PoE target, up to a constant.The target concentrates on agreement between the two teachers.
- When the teachers disagree, the complementary loss is strictly larger than the KL toward the PoE target and focuses the student on their agreement region.The extra term vanishes exactly when the two teachers fully agree.
- The variational change-of-measure result connects divergence to the PoE target with divergence to the allow-only ideal policy.This bridge supplies the theoretical step from the intermediate PoE objective to ideal CI alignment.
- Reducing the SELFCI training loss directly tightens the upper bound up to a multiplicative factor and an alignment error δα(λ, θ).The alignment error measures the distance between the induced PoE target and the allow-only ideal policy along student rollouts, and tends to zero when they collapse together.