DP-Fusion: Token-Level Differentially Private Inference for Large Language Models

AI-generated keywords: DP-Fusion

AI-generated Key Points

  • Researchers developed DP-Fusion as a token-level differentially private inference mechanism for large language models (LLMs) to address sensitive information leakage in text generation.
  • DP-Fusion offers fine-grained control over the trade-off between privacy and utility by partitioning sensitive tokens into privacy groups and blending output distributions.
  • The parameter ε determines the level of privacy protection, with DP-Fusion willing to incur higher computational costs for an improved privacy-utility balance.
  • The methodology of DP-Fusion can be extended to other data types such as images and audio, representing a step towards more robust differential privacy mechanisms against real-world threats like LOSS attacks in probabilistic models used for data privacy.
Also access our AI generated: Comprehensive summary, Lay summary, Blog-like article; or ask questions about this paper to our AI assistant.

Authors: Rushil Thareja, Preslav Nakov, Praneeth Vepakomma, Nils Lukas

Our code and data are publicly available here: https://github.com/MBZUAI-Trustworthy-ML/DP-Fusion-DPI
License: CC BY 4.0

Abstract: Large language models (LLMs) can leak sensitive information from their context through generated outputs, either accidentally or when prompted adversarially. Existing defenses that aim to preserve context privacy during inference either lack formal guarantees or suffer from a poor utility/privacy trade-off. We propose DP-Fusion, a token-level Differentially Private Inference (DPI) mechanism that provably bounds how much an LLM's outputs reveal about sensitive tokens in its context. We demonstrate DPI through the task of document privatization, where the goal is to paraphrase documents so that sensitive content (e.g., Personally Identifiable Information, PII) cannot be reliably inferred, while still preserving the overall utility of the text. This is controlled by a parameter $ε$: $ε=0$ hides PII entirely, while higher values trade off privacy for improved paraphrase quality. DP-Fusion works as follows: (i) partition sensitive tokens into disjoint privacy groups, (ii) run the LLM once per group, and (iii) blend the output distributions so that the final output remains within a fixed statistical distance of the baseline distribution produced when no privacy group is revealed. This approach allows fine-grained control over the privacy/utility trade-off but requires multiple LLM forward passes.

Submitted to arXiv on 06 Jul. 2025

Ask questions about this paper to our AI assistant

You can also chat with multiple papers at once here.

AI assistant instructions?

Results of the summarizing process for the arXiv paper: 2507.04531v1

, , , , In their study "DP-Fusion: Token-Level Differentially Private Inference for Large Language Models," researchers Rushil Thareja, Preslav Nakov, Praneeth Vepakomma, and Nils Lukas address sensitive information leakage from large language models (LLMs) in text generation. They introduce DP-Fusion, a token-level DPI mechanism that balances privacy and utility. By partitioning sensitive tokens into privacy groups and blending output distributions, DP-Fusion offers fine-grained control over the trade-off between privacy and utility. The parameter ε determines the level of privacy protection. One key aspect that sets DP-Fusion apart is its willingness to incur higher computational costs for improved privacy-utility balance. The researchers envision extending this methodology to other data types such as images and audio. DP-Fusion represents a step towards more robust differential privacy mechanisms against real-world threats like LOSS attacks in probabilistic models used for data privacy. A token-level DPI mechanism for balancing privacy and utility in large language models. The issue addressed by researchers in their study on DP-Fusion. Techniques used to protect sensitive information in various data types. The goal of DP-Fusion, achieved through partitioning sensitive tokens into groups and blending output distributions. A method for protecting sensitive information while maintaining statistical accuracy in data analysis.
Created on 15 Dec. 2025

Assess the quality of the AI-generated content by voting

Score: 0

Why do we need votes?

Votes are used to determine whether we need to re-run our summarizing tools. If the count reaches -10, our tools can be restarted.

Similar papers summarized with our AI tools

Navigate through even more similar papers through a

tree representation

Look for similar papers (in beta version)

By clicking on the button above, our algorithm will scan all papers in our database to find the closest based on the contents of the full papers and not just on metadata. Please note that it only works for papers that we have generated summaries for and you can rerun it from time to time to get a more accurate result while our database grows.

Disclaimer: The AI-based summarization tool and virtual assistant provided on this website may not always provide accurate and complete summaries or responses. We encourage you to carefully review and evaluate the generated content to ensure its quality and relevance to your needs.