PaperlayerView exact revision on arXiv

Source-linked AI summary

DP-MIND: Differentially private memory-guided Long context Inference

Zhihao Liu, Yitian Cheng, Shuang Liu, Rui Wen, Yuke Hu, Zhan Qin

arXiv:2610.13132v1cs.AI

TL;DR

LLM-as-a-Service can expose sensitive user context to remote providers, while existing DP inference methods are primarily designed for shorter contexts. DP-MIND processes perturbed chunks with memory, trains memory construction under DP noise, and locally denoises answer spans; it reports better performance than Qwen-1M across evaluated perturbation settings and strong utility at million-token scale.

  • Problem

    Existing DP inference methods are primarily designed for short or moderate contexts, leaving million-token inputs with context-capacity challenges and DP-noise utility degradation.

    Source: §1 · p. 2

  • Method

    DP-MIND locally perturbs context, processes it chunk by chunk with propagated memory, optimizes memory construction under DP noise, and locally denoises corrupted answer spans.

    Source: §1 · p. 2, §4.4 · p. 6

  • Results

    Across three perturbation mechanisms and evaluated context lengths, DP-MIND outperforms Qwen-1M; at 448K, its SubEM results are 62.50, 68.75, and 64.07 points, respectively.

    Source: §5.4 · p. 9

  • Takeaways & Limitations

    DP-MIND maintains strong utility in the million-token regime, supporting memory-guided inference for scalable private LLM inference.

    Source: §6 · p. 10

Abstract

from arXiv · show

LLM-as-a-Service has become a dominant paradigm for accessing large language models without requiring local deployment. However, the process raises severe privacy concerns when user queries may include sensitive or confidential contexts. Differential privacy (DP) provides a principled approach to protecting such inputs, but existing DP inference methods are primarily designed for short- or moderate-context settings and struggle with million-token-scale inputs due to limited context capacity and severe utility degradation under DP perturbation. In this paper, we propose DP-MIND, a memory-guided framework that scales differentially private inference to million-token contexts. DP-MIND enables private long-context inference by locally perturbing the input and processing it chunk by chunk with a compact memory that preserves task-relevant information across the sequence. To make this memory robust to DP noise, we optimize the memory construction policy directly on perturbed inputs using reinforcement learning, guided by both final answer correctness and memory consistency. We further recover perturbation-corrupted answer spans through a local denoising module without exposing the original context to the external model. We provide theoretical privacy analysis of DP-MIND and further conduct extensive empirical analysis across multiple long-context benchmarks with context lengths up to the million-token scale, demonstrating that DP-MIND consistently outperforms existing DP and long-context inference baselines in both scalability and utility.

1 INTRODUCTION

LLM-as-a-Service makes powerful models accessible but requires users to send potentially sensitive context to remote providers. DP-MIND addresses the gap in million-token private inference with chunk-wise perturbation and memory, DP-aware policy optimization, and local denoising.

1 INTRODUCTION

  • Existing DP inference methods are geared toward short or moderate contexts, while million-token inputs strain capacity and suffer utility loss from DP noise and substantial inference overhead.Long contexts can also make it difficult for LLMs to retrieve and use relevant information reliably, even when inputs fit within the context window.Source: §1 · p. 2
  • DP-MIND processes locally perturbed chunks sequentially and propagates compact memory to preserve task-relevant information without exposing clean context to the external model.The framework also provides theoretical privacy analysis.Source: §1 · p. 2
  • A DP-aware reinforcement-learning objective optimizes memory construction on perturbed inputs using both final-answer correctness and memory consistency.The consistency reward compares DP-derived memory with its clean reference.Source: §1 · p. 2
  • A trusted local denoising module restores corrupted answer spans while keeping the clean context entirely local.This is intended to improve answer utility without exposing clean context to the external LLM.Source: §1 · p. 2
  • Experiments across long-context benchmarks, privacy budgets, and context lengths up to the million-token scale report that DP-MIND substantially outperforms existing DP and long-context inference baselines under perturbation.The paper identifies sensitive context sent to remote LLM providers as a privacy concern in LLM-as-a-Service.Source: §1 · pp. 1–2

2 BACKGROUND AND RELATED WORK

Prior DP inference work develops input perturbation, privacy–utility improvements, and utility-recovery strategies, while non-private long-context work scales inference through longer windows, efficient attention, or memory. The passages identify the need to address DP-induced information loss in long-context settings.

2.1 DIFFERENTIALLY PRIVATE INFERENCE

  • Existing DP inference approaches perturb tokens or representations, share requests, or recover utility through denoising and response extraction, but do not systematically address million-token scalability and utility.Examples include DP-Forward, ObfusLM, Split-and-Denoise, and InferDPT.Source: §2.1 · pp. 2–3

2.2 LONG-CONTEXT INFERENCE

  • Long-context approaches extend context windows, reduce attention cost, or maintain compact memory during sequential processing, but are primarily designed for clean inputs.Under DP perturbation, corrupted evidence and memory compression can propagate errors, motivating methods that preserve task-relevant information across long contexts.Source: §2.2 · p. 3

3 PRELIMINARY

The preliminaries define privacy guarantees for randomized mechanisms and describe how DP perturbation is applied to token embeddings. They also establish that computations using only a DP output preserve its privacy guarantee.

3.1 DIFFERENTIAL PRIVACY

  • (ε, δ)-DP bounds output-event probabilities across adjacent inputs, while metric DP makes the guarantee depend on input distance; the described L2 mechanism adds Laplacian noise to token embeddings.The perturbed embedding is the original embedding plus sampled noise.Source: §3.1 · p. 3

3.2 POST-PROCESSING PROPERTY

  • Post-processing that depends on a DP output, rather than accessing the original private input, preserves the same privacy guarantee, including for metric DP.Source: §3.2 · p. 3

4 METHODOLOGY

DP-MIND protects long-context question answering by sending only locally perturbed chunks to an external LLM and carrying task-relevant information forward in compact memory. Local denoising and DP-aware reinforcement learning address utility loss while the privacy analysis treats external inference as post-processing.

4.1 CHUNK-WISE DP MEMORY INFERENCE

  • DP-MIND sequentially processes DP-perturbed chunks, updating compact memory from noisy chunks and prior memory before generating an answer from the final memory and chunk.The external inference process depends on perturbed context, the query, and LLM randomness; the clean context remains local.Source: §4.1 · p. 4

4.2 PRIVACY ANALYSIS

  • Under the assumption that local perturbation satisfies εdχ-privacy, DP-MIND's external inference is post-processing and retains the same privacy guarantee.The proof says chunking, memory updates, and answer generation use only the perturbed context, fixed query, and LLM randomness.Source: §4.2 · pp. 4–5

4.3 LOCAL ANSWER DENOISING

  • Local answer denoising replaces matching noisy answer spans with clean counterparts from locally retained alignment, preferring the longest valid match.Only spans with an unambiguous clean counterpart are eligible, and restoration is alignment-based rather than answer regeneration.Source: §4.3 · p. 5

4.4 DP-AWARE MEMORY POLICY OPTIMIZATION

  • DP-aware reinforcement learning jointly rewards final denoised-answer correctness and memory consistency, which encourages intermediate DP-derived memories to remain close to clean references.The consistency reward uses embedding distance from a clean reference trajectory; λ controls its contribution.Source: §4.4 · p. 6

5 EXPERIMENTS

Across RULER-HQA and NIAH, DP-MIND handles longer DP-perturbed contexts and outperforms scalable baselines. Ablations examine its components and show how chunk size trades utility against runtime.

5.1 EXPERIMENT SETUP

  • Evaluation uses Qwen2.5 7B and 14B models on RULER-HQA multi-hop QA contexts from 7K to 1.8M tokens and NIAH retrieval at 32K, 128K, and 512K.RULER-HQA includes 128 examples per length.Source: §5.1 · p. 7

5.2 LONG-CONTEXT INFERENCE TASK

  • DP-MIND consistently processes DP-perturbed contexts from 7K to 1.8M tokens chunk by chunk, while other baselines hit context-window or serving limits.Standard Qwen2.5-7B supports up to 28K tokens; Sparse Attention reaches 224K, and Long-Context Scaling reaches 1.8M using an enlarged-context model.Source: §5.2 · p. 7
  • At ϵ = 7, DP-MIND SubEM stays 73.44/70.31/64.81/59.38 at 56K/224K/896K/1.8M, versus Long-Context Scaling's 45.31/26.56/0.00/0.00.The comparison shows utility as context length grows.Source: §5.2 · p. 8
  • At 1.8M tokens, memory-augmented inference gains approximately 19.5 SubEM points over direct long-context scaling, and DP-MIND remains best across evaluated 14B context lengths.The evaluation uses Qwen2.5-14B; the advantage of memory-based inference becomes more pronounced as context grows.Source: §5.2 · p. 8, Figure 3 · p. 8

5.3 LONG-CONTEXT RETRIEVAL TASK

  • On NIAH, DP-MIND outperforms baselines across privacy budgets and context lengths; its advantage generally widens with retrieval context, especially for sparse target information.At ϵ = 6, retrieval is challenging for all methods; at ϵ = 7, DP-MIND is relatively stable as contexts lengthen, and at ϵ = 8 it achieves the largest overall gains.Source: §5.3 · p. 8, Figure 4 · p. 8

5.4 ABLATION STUDY

  • 5K–10K chunks generally achieve competitive EM and SubEM, whereas 20K tends to degrade ultra-long utility; larger chunks reduce runtime, favoring moderate sizes overall.Runtime savings from larger chunks become more pronounced as context length grows.Source: Figure 5 · p. 9, §5.4 · p. 9
  • Memory propagation, DP-perturbed-input training, and local answer denoising progressively improve long-context utility, with denoising yielding the best overall performance.Chunk-only inference degrades rapidly as context grows.Source: §5.4 · p. 9
  • At 448K, DP-MIND's reported gains reach 62.50, 68.75, and 64.07 SubEM points across three perturbation mechanisms.The comparison is against Qwen-1M across the evaluated mechanisms and context lengths.Source: Table 2 · p. 9, §5.4 · p. 9

6 CONCLUSION

DP-MIND processes differentially private chunks with compact memory, using DP-aware reinforcement learning and local denoising to improve utility while preserving the perturbation mechanism’s privacy guarantee. Experiments on RULER-HQA and NIAH show strong utility in the million-token regime.

6 CONCLUSION

  • DP-MIND preserves the underlying perturbation mechanism’s privacy guarantee while improving utility through DP-aware reinforcement learning for memory construction and trusted local denoising.The reported experiments span RULER-HQA and NIAH, different privacy budgets, perturbation mechanisms, and model scales.Source: §6 · p. 9
  • DP-MIND sequentially processes DP-perturbed chunks while propagating compact memory states across the context.This memory-guided design is the framework used in the reported million-token-scale study.Source: §6 · p. 9
  • DP-MIND maintains strong utility in the million-token regime, demonstrating the effectiveness of memory-guided inference for scalable private LLM inference.The conclusion describes experiments on RULER-HQA and NIAH across different privacy budgets, perturbation mechanisms, and model scales.Source: §6 · pp. 9–10

A IMPLEMENTATION DETAILS

The implementation locally perturbs token embeddings before chunking the context, then performs recurrent memory-based inference with fixed prompts for memory updates and final answers.

A.1 DP PERTURBATION

  • Each token is embedded, perturbed with calibrated noise, projected to the nearest vocabulary token, and the resulting context is split into sequential chunks.Algorithm 3 describes the embedding perturbation and nearest-token projection before chunk formation.Source: §A.1 · p. 13

A.2 MEMORY-BASED INFERENCE DETAILS

  • The recurrent baseline processes ordered, non-overlapping 5,000-token chunks, carries memory capped at 1,024 tokens, then answers from the final accumulated memory.Memory starts as “No previous memory”; each setting evaluates 128 examples, with temperature 0.7 and top-p 0.95.Source: §A.2 · p. 13

A.3 PROMPTS

  • The fixed update prompt preserves relevant prior memory while integrating useful current-chunk information, and the final-answer prompt uses only differentially private memory.The final prompt instructs the model not to reconstruct original sensitive context.Source: §A.3 · pp. 13–14

B.1 BENCHMARKS

The benchmarks test long-context question answering and retrieval over contexts ranging from thousands of tokens to more than a million.

B.1 BENCHMARKS

  • RULER-HQA uses HotpotQA-derived examples with supporting evidence amid distractor documents, spanning approximately 7K to 1.8M tokens.The benchmark contains 128 synthesized examples at each context scale.Source: §B.1 · p. 14
  • NIAH tests retrieval of a short target span using numeric or UUID needles in repetitive or essay haystacks at context lengths from 32K to 512K tokens.The evaluation uses 128 examples at each context length and three variants from RULER.Source: §B.1 · p. 14

B.2 EVALUATION METRICS

Evaluation uses normalized exact-match, token-overlap, and answer-span metrics, with DP-MIND answer spans restored locally before scoring.

B.2 EVALUATION METRICS

  • EM measures normalized exact string match, F1 measures token-level overlap, and SubEM counts a prediction correct when it contains the complete normalized gold answer span.When multiple gold answers are available, the maximum score over them is reported.Source: §B.2 · p. 14
  • For DP-MIND, local span restoration is applied before evaluation on answer-based tasks, and EM, F1, and SubEM are computed on the restored answer.Source: §B.2 · p. 15

C ADDITIONAL EXPERIMENT RESULTS

On RULER-HQA, DP-MIND consistently improves over sparse-attention, long-context scaling, and memory-augmented baselines, with especially clear gains in ultra-long contexts. The additional results cover ablations, multiple privacy budgets and context lengths, and several metrics and settings.

C ADDITIONAL EXPERIMENT RESULTS

  • Under ε = 7, the ablation compares chunk-only inference, RL MemoryAgent, DP-RL MemoryAgent, and full DP-MIND using SubEM.The variants isolate memory propagation, training on DP-perturbed data, and local answer denoising; parentheses report improvements over RL MemoryAgent.Source: Table 3 · p. 15, C ADDITIONAL EXPERIMENT RESULTS · p. 15
  • DP-MIND consistently improves over sparse-attention, long-context scaling, and memory-augmented baselines, with especially clear gains in ultra-long contexts.The reported comparisons include F1 and EM across privacy budgets and context lengths.Source: Table 4 · p. 15, C ADDITIONAL EXPERIMENT RESULTS · p. 15, Table 5 · p. 16
  • Additional tables report F1, EM, and Sub-EM comparisons for Qwen2.5-14B under ε = 7, plus NIAH results across privacy budgets and context lengths.NIAH results cover Single, Multi-Key, and Multi-Query settings.Source: Table 6 · p. 16, Table 7 · p. 16, Table 8 · p. 16
Loading 2610.13132v1…