Differentially Private Next-Token Prediction of Large Language Models
arxiv(2024)
摘要
Ensuring the privacy of Large Language Models (LLMs) is becoming increasingly
important. The most widely adopted technique to accomplish this is DP-SGD,
which trains a model in such a way that guarantees Differential Privacy (DP).
However, DP-SGD requires longer training times and larger memory requirements
than SGD, while overestimating an adversary's capabilities in having white box
access to the model. A more realistic scenario assumes only black-box access to
a privacy-sensitive LLM. Motivated by these observations, we present Private
Mixing of Ensemble Distributions (PMixED): a private prediction protocol that
achieves practical next-token prediction by projecting each of the model's
output distribution from an ensemble of fine-tuned LLMs onto a set around a
public LLM's output distribution, then averaging the projected distributions
and sampling from it. Our approach is more lightweight than DP-SGD in that it
is model agnostic, instead providing differential privacy at prediction rather
than during training. Our results show that PMixED achieves a stronger privacy
guarantee than sample-level privacy and outperforms DP-SGD for privacy
ϵ = 8 on large-scale datasets.
更多查看译文
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要