PaperlayerView exact revision on arXiv

Source-linked AI summary

Privacy-Preserving Heterogeneous Multi-LLM Federated Inference for Cognitive Diagnosis

Yagna Manasa Boyapati, Chong Yu, Tianyu Jiang, Justin Zhan

arXiv:2609.02947v1cs.CRcs.AIcs.CLcs.LG

TL;DR

Cognitive diagnosis in education faces the challenge of protecting student privacy while providing accurate feedback, and prior work had not explored multi-LLM collaboration under privacy constraints. This paper proposes federated inference using commercial LLM APIs, local differential privacy, and residual correction. It reports improved performance over single-LLM baselines across three educational datasets, with a 0.46% average utility cost from LDP.

  • Problem

    Prior work had not investigated multi-LLM collaboration for cognitive diagnosis under privacy constraints, despite privacy and diagnostic-accuracy challenges in educational systems.

    Source: §1 · p. 1

  • Method

    The framework federates frozen commercial LLM APIs at the prediction level, adding Laplace noise locally before aggregation and using residual correction for model heterogeneity.

    Source: §1 · p. 2

  • Results

    Performance improves over single-LLM baselines across three educational datasets, and LDP adds just 0.46% average utility cost.

    Source: §5 · p. 9

  • Takeaways & Limitations

    API-based federation enables collaboration without exposing raw student data across three educational datasets.

    Source: §5 · p. 9

    The honest-but-curious privacy guarantee does not prevent commercial API providers from logging submitted queries.

    Source: Limitations · p. 9

Abstract

from arXiv · show

Significant challenges remain in AI-driven educational systems in balancing privacy preservation with accurate cognitive diagnosis. To overcome this, we propose a federated inference framework in which several commercial LLM APIs collaborate without requiring access to raw student data or proprietary model internals. Using multiple federated entities, such as LLaMA-3.3-70B, GPT-4o-mini, and Claude-3-Haiku, our framework builds upon a heterogeneous multi-LLM architecture. The predictions generated by these entities are combined with epsilon-local differential privacy by adding Laplace noise locally to each entity's prediction output before aggregation, while residual-based aggregation mitigates model heterogeneity. Our approach is predicated on an honest-but-curious trust paradigm in which API providers are presumed not to abuse submitted queries, and our differential privacy mechanism shields the published diagnostic results from external inference. We conduct rigorous privacy-utility analysis showing strong privacy guarantees with minimal accuracy loss, and extensive real-world evaluations across three educational benchmarks confirm the framework's practical usability and cross-domain generalizability.

1 Introduction

Cognitive diagnosis in education must balance accurate feedback with privacy for sensitive student data, yet prior work had not combined privacy-constrained federated inference with heterogeneous LLM collaboration. The proposed framework coordinates commercial LLM APIs at the prediction level, with local differential privacy and a trust model that does not protect queries from API providers.

1 Introduction

  • Centralized CDM processing of student learning patterns and trajectories raises risks of data leakage, unauthorized access, and misuse.The introduction notes that GDPR and FERPA have heightened awareness of these privacy concerns.Source: §1 · p. 1
  • No prior work investigated multi-LLM collaboration for cognitive diagnosis under privacy constraints, while existing approaches relied on single LLMs or evaluated models independently.The introduction also identifies the lack of LLM integration of federated learning and differential privacy for cognitive-diagnosis systems.Source: §1 · p. 1
  • The proposed framework uses LLaMA-3.3-70B, GPT-4o-mini, and Claude-3-Haiku as federated participants that collaboratively infer student knowledge states.It avoids centralized training and is presented as leveraging complementary model strengths to improve privacy, scalability, and robustness.Source: §1 · p. 2
  • Frozen, black-box LLMs share only prediction outputs, with Laplace noise applied locally before prediction-level aggregation.This lets institutions use multiple commercial APIs without exposing raw student data, while the framework evaluates across three benchmarks.Source: §1 · p. 2
  • The honest-but-curious privacy model protects published diagnostic vectors from external inference but does not prevent commercial APIs from logging submitted queries.The paper points to locally hosted models and prompt data minimization as options for deployments requiring end-to-end privacy.Source: §1 · p. 2
  • The paper reports privacy–utility analysis and evaluation on three educational benchmarks as evidence of practical implementability and cross-domain generalizability.Its contributions also include coordinating commercial APIs without access to proprietary model internals or training data.Source: §1 · p. 2

2 Related Work

Related work covers cognitive diagnosis and LLM-based educational assessment, alongside federated learning and differential privacy. The paper distinguishes its approach by combining heterogeneous commercial LLMs, prediction-level aggregation, residual correction, and local differential privacy.

Cognitive Diagnosis Models and LLM-based Diagnosis

  • Traditional CDMs, including IRT and DINA, require substantial human intervention for feature engineering and struggle to capture complex skill relationships; foundational knowledge-tracing models improved sequential student modeling.Examples named are IRT, DINA (De La Torre, 2009), BKT, DKT (Piech et al., 2015), and EKT.Source: §2 · p. 2
  • LLM diagnosis studies either add generated diagnostic signals to CDMs or evaluate GPT-4, Claude, and LLaMA individually, without privacy or federation considerations.Other educational LLM work includes psychometric assessment, skill-signal-based knowledge tracing, and discussions of pedagogical alignment and privacy safeguards.Source: §2 · p. 3

Federated Learning with Differential Privacy

  • Federated learning and differential privacy offer collaborative learning without raw-data centralization and formal individual-level protection, but prior FL commonly aggregates parameters or gradients from homogeneous models.The paper adapts DP-FL approaches to prediction-level aggregation and uses Laplace noise with heterogeneous privacy budgets.Source: §2 · p. 3

Positioning of this work

  • The framework is distinguished by combining heterogeneous commercial LLMs, black-box prediction-level aggregation, residual correction, and local differential privacy, evaluated across three educational benchmarks.Prior approaches are characterized as using single LLMs with centralized data, homogeneous federated training, or education frameworks without formal privacy guarantees.Source: §2 · p. 3

3 Methodology

The framework combines independent LLM knowledge-state predictions with local differential privacy and residual correction. Its workflow separates local calibration from shared inference and uses question-linked concepts to target diagnosis.

3 Methodology

  • The four-stage framework combines independent knowledge-state predictions, privacy-preserving aggregation, residual correction, and sharing of protected diagnostic outputs.Figure 2 illustrates this pipeline.Source: §3 · p. 3

3.1 Problem Formulation

  • Entities retain disjoint local calibration data and estimate residual corrections there, then query all LLMs on the same test student during inference.Partitioning applies to calibration data, not to which entities evaluate an inference-time test student.Source: §3.1 · p. 4

3.2 Heterogeneous Multi-LLM Cognitive Diagnosis

  • Q-matrix-guided prompts restrict each LLM to concepts relevant to the question, targeting its assessment of student responses and reasoning.The Q-matrix links questions to required concepts in the latent knowledge space.Source: §3.2 · p. 4

3.3 Privacy-Preserving Federated Aggregation

  • Each entity adds calibrated Laplace noise to predictions before aggregation, protecting published diagnostics under ε-DP; this guarantee does not cover raw answers sent to APIs.The noise scale uses local sensitivity and the privacy budget; the stated protection concerns diagnostic outputs, not API-level exposure.Source: §3.3 · pp. 4–5

3.4 Aggregation with Residual Correction

  • Residual correction addresses heterogeneous LLM calibration, concept granularity, and systematic biases that can distort direct averaging.The correction strength α is set to 0.3 based on validation performance.Source: §3.4 · p. 5

3.5 Proposed Algorithms

  • The paper provides a complete privacy-preserving framework algorithm and a baseline algorithm without privacy mechanisms for comparison.Source: §3.5 · p. 5

3.6 Theoretical Privacy Guarantees

  • 0.40% MAE at ε = 2.0 accompanies an ε-local-DP guarantee for datasets differing by one student record, preserved under residual correction.The reported privacy–utility analysis attributes the low sensitivity to bounded, group-level prediction outputs and per-concept noise.Source: §3.6 · pp. 5–6

4 Results

Across three educational benchmarks, heterogeneous federation outperforms single-LLM baselines; at ε=2.0, the reported average improvement is 11.99% with 0.46% privacy cost.

4.1 Experimental Setup

  • Evaluation used three benchmarks with 4–5 concepts and an 80/20 train-test split; improvements held across community-provided and automatically constructed Q-matrices.Source: §4.1 · p. 6
  • On EdNet samples from 10K to 100K interactions, MAE degrades by less than 2% and processing time scales nearly linearly; EdNet contains over 1.3 million interactions.Source: §4.1 · p. 6

4.2 Multi-Dataset Performance

  • 11.99% average improvement with 0.46% privacy cost at ε = 2.0, with gains ranging from 7.39% to 14.40% across three benchmarks.Source: Table 2 · p. 7, §4.2 · p. 8
  • Federation improves ASSIST09 across four concepts by 14.19% (0.2068 vs. 0.2410), GSM8K by 7.39% (0.2156 vs. 0.2328), and UCI holistic assessment by 14.40% (0.0969 vs. 0.1132).Source: §4.2 · p. 7

4.3 Privacy-Utility Tradeoff Analysis

  • On ASSIST09, ε = 2.0 gives 14.19% improvement with 0.19% privacy cost; ε = 1.0 retains 7.38%, while ε = 0.5 yields −3.69%.Source: Table 3 · p. 8, §4.3 · p. 8

4.5 Ablation Study

  • Removing federation reduces improvements by an average of 11.99%; the full system also outperforms a simple three-model ensemble while providing (ε, 0)-DP guarantees.Source: Table 4 · p. 8, §4.5 · p. 8

4.4 Computational Efficiency

  • Full-dataset processing took 8–10 hours on ASSIST09, 4–6 hours on GSM8K, and 3–4 hours on UCI, with 5–7 seconds per student.Source: §4.4 · p. 8

4.5 Ablation Study

  • Without residual correction, MAE exceeds the single-LLM baseline across datasets, including UCI at 0.2997 vs. 0.1132; Gaussian noise also performs worse than Laplace-based LDP.Source: §4.5 · pp. 8–9

5 Conclusion

The conclusion presents a federated inference framework that combines three LLMs for cognitive diagnosis while preserving ε-local differential privacy. Across three educational datasets, it improves on single-LLM baselines; ablations identify aggregation and residual correction as important, while LDP adds a 0.46% average utility cost.

5 Conclusion

  • Federated aggregation improves performance over single-LLM baselines across three educational datasets while maintaining ε-local differential privacy.The framework uses LLaMA-3.3-70B, GPT-4o-mini, and Claude-3-Haiku; it supports collaboration without exposing raw student data.Source: §5 · p. 9
  • Ablations identify federated aggregation as the primary performance driver, residual correction as essential, and LDP’s average utility cost as 0.46%.The authors identify personalized federated learning and assessment beyond mathematics as future directions.Source: §5 · p. 9
  • The framework is presented as enabling API-based collaboration without exposing raw student data.The conclusion also points to personalized federation and cross-domain educational assessment beyond mathematics as future directions.Source: §5 · p. 9

Limitations

The framework relies on commercial foundation models, uses an honest-but-curious privacy trust paradigm, and is evaluated on structured educational domains.

Limitations

  • Provider updates may change the three commercial foundation models, and residual correction may require periodic recalibration.The authors state that residual correction mitigates systematic bias shifts.Source: Limitations · p. 9
  • The honest-but-curious guarantee shields published diagnostic outputs but does not prevent commercial API providers from logging submitted queries.The paper points to Section 3.3 for possible mitigations in deployments requiring full end-to-end privacy.Source: Limitations · p. 9
  • Evaluation is limited to structured educational domains; open-ended assessment tasks may require adapted prompt engineering.Source: Limitations · p. 9

A Implementation Details

The implementation uses a shared structured prompt for each LLM, adapts concept inputs by dataset, selects a residual-correction parameter on validation data, and reports API-processing times.

A Implementation Details

  • Each LLM receives an identical structured prompt with an assessment-expert system instruction and a user prompt requesting concept-level mastery probabilities as JSON.Source: A Implementation Details · p. 12
  • ASSIST09 uses Q-matrix concepts, GSM8K uses LLM-extracted tags, and UCI uses attribute groups; validation selected α = 0.3.Values outside [0.2, 0.4] consistently yielded higher validation MAE.Source: A Implementation Details · p. 12
  • Parallel API calls average 2–3 seconds per student in isolated runs, while full runs take 5–7 seconds per student under rate limits and exponential backoff.Complete dataset times on Tesla V100S are 8–10 hours for ASSIST09, 4–6 hours for GSM8K, and 3–4 hours for UCI.Source: A Implementation Details · p. 12

B Heterogeneous Model Contributions

The section attributes dataset-level performance gains to complementary model behavior, reports statistical significance, discloses model versions, and points to the framework algorithms.

B Heterogeneous Model Contributions

  • Federated gains are 14.21% on ASSIST09, 7.39% on GSM8K, and 14.40% on UCI, with variation tied to how model strengths align with dataset characteristics.The passage describes differing prediction tendencies across LLaMA, GPT-4, and Claude as complementary perspectives that can support error cancellation (Ganaie et al., 2022).Source: B Heterogeneous Model Contributions · pp. 12–13

C Statistical Significance

  • ASSIST09 non-private federation achieves MAE 0.2064 versus baseline 0.2410 (p < 0.001, Cohen’s d = 0.89).At ε = 2.0, MAE is 0.2068 versus baseline 0.2410 (p < 0.001, Cohen’s d = 0.85); significance is also reported for GSM8K (p < 0.01, Cohen’s d = 0.62) and UCI (p < 0.001, Cohen’s d = 0.78).Source: C Statistical Significance · p. 13

D LLM Usage Disclosure

  • Experiments used claude-3-haiku-20240307 before April 2025 and claude-sonnet-4-20250514 afterward; GPT-4o-mini and LLaMA-3.3-70B versions remained consistent.Source: D LLM Usage Disclosure · p. 13

E Proposed Algorithms

  • Figure 2 illustrates the framework; Algorithm 1 presents the version with local differential privacy, while Algorithm 2 presents the baseline without privacy mechanisms.Source: E Proposed Algorithms · p. 13

F Formal Proof of Theorem 1

Algorithm 1’s Laplace-noised local predictions satisfy ε-local differential privacy, and deterministic post-processing preserves that guarantee for the global diagnosis.

F Formal Proof of Theorem 1

  • Algorithm 1 with Laplace noise satisfies ε-local differential privacy for adjacent datasets differing in one student record.The proof uses bounded predictions with conservative ℓ1 sensitivity K, then adds independent Laplace noise calibrated to that sensitivity and ε.Source: F Formal Proof of Theorem 1 · pp. 13–14
  • Each LLM entity adds Laplace noise to its prediction output locally before sharing the noisy prediction with the aggregator.The framework processes student responses and the associated Q-matrix through the entities before aggregation.Source: F Formal Proof of Theorem 1 · pp. 13–14, Figure 2 · p. 14
  • Residual correction, averaging, and clipping are post-processing steps that preserve the ε-local differential privacy guarantee of the global diagnosis.The aggregator receives only noisy predictions.Source: F Formal Proof of Theorem 1 · p. 14

G Quantitative Complementarity Analysis

The federated system beats every individual model across all three datasets, while concept-level results show model-specific strengths and the need to correct heterogeneous predictions.

G Quantitative Complementarity Analysis

  • ASSIST09 and UCI have real student-response ground truth, while GSM8K is excluded from individual-model comparisons because it uses programmatically derived concept proxies.Source: G Quantitative Complementarity Analysis · p. 15
  • MAE is 0.2068 on ASSIST09, 0.2156 on GSM8K, and 0.0969 on UCI; federation beats every individual model on all three datasets.The top individual performer varies by dataset, while the full federated system outperforms even the top individual model in each case.Source: G Quantitative Complementarity Analysis · p. 15, Table 5 · p. 15
  • Different models attain the lowest concept-level MAE across tasks, including Claude on Equations and GPT-4 on Integers and Arithmetic.Table 6 reports LLaMA at 0.2140 on Answer_Verification, GPT-4 at 0.1989 on Integers and 0.2963 on Arithmetic, and Claude at 0.1950 on Equations, 0.2294 on Multi_Step_Reasoning, and 0.1022 on Family_Support.Source: Table 6 · p. 15, G Quantitative Complementarity Analysis · p. 15
  • Removing residual correction degrades performance below the single-LLM baseline, supporting its necessity for addressing heterogeneous calibration biases, as the evaluated models exhibit distinct per-model MAE profiles across datasets.Source: G Quantitative Complementarity Analysis · p. 15

H API Cost Analysis

The framework’s API-based inference has low reported per-student costs, and the paper describes further cost reductions through selective federation, caching, or local substitution.

H API Cost Analysis

  • A full three-dataset evaluation costs under $20, compared with $63,255–$210,850 for equivalent human expert annotation.Reported per-dataset runs cost $10–12 for ASSIST09, $2–6 for GSM8K, and $1.50–2 for UCI.Source: H API Cost Analysis · p. 15
  • Selective federation for borderline cases is reported to reduce costs by 60–70%; response caching and local model substitution are additional strategies.The paper states that local substitution can reduce total cost to $0 with full privacy.Source: H API Cost Analysis · p. 15
  • The framework costs $0.002–$0.005 per student, compared with $15–50 for human expert annotation.The comparison is reported in Table 7.Source: H API Cost Analysis · p. 15, Table 7 · p. 16

Related papers

Loading 2609.02947v1…