Local differential privacy protects user profiles in personalized AI responses
Profile-DP: Differential Privacy for User-Controlled Profile Release in Personalized LLM Inference
Cryptography and SecurityArtificial IntelligenceComputation and Language
Summary
Personalized AI models use details about users to give better answers, but sharing these details can risk user privacy. The authors introduce Profile-DP, a way to keep user information private while still letting AI models personalize responses. Their method carefully adds noise to user facts based on privacy rules, separating privacy from how the AI gives answers. They test two methods—one that changes each fact independently and another that tweaks related facts together—showing practical ways to protect privacy without losing useful information.
What this means in practice
- •For mobile app developers: Integrate personalized AI chat features that protect user profile privacy through local differential privacy methods during inference.
- •For customer support platform teams: Enable personalized automated responses without exposing full user data by releasing privatized user profiles under formal privacy guarantees.
Authors
Mingchen Li, Zifan Peng, Kewei Sha, Lavinia F Pieptea, Heng Fan, Junhua Ding, Meikang Qiu, Yunhe Feng
Abstract
Personalized large language models (LLMs) increasingly rely on profile-conditioned inference, pairing public requests with rich, user-specific facts. This paradigm exposes the user profile itself, together with the user's explicit sharing preferences. We introduce Profile-DP, a policy-aware local differential privacy framework designed specifically for user-profile release in personalized LLM inference. Profile-DP provably bounds the release of user-withheld facts while treating public instructions, profile schemas, and authorized facts as public side information. By generating a privatized profile that composes with the public instruction prior to answer generation, our framework decouples formal privacy guarantees from downstream model behavior. We develop two finite-domain mechanisms satisfying Profile-DP: DP-SLOT independently perturbs protected attributes, while DP-BLOCK uses public semantic decisions to coordinate their release and jointly sample related attributes. A positive, public compatibility prior connects these attributes while preserving a profile-level privacy bound. On PEEP, DP-BLOCK leads the utility composite among DP methods at all 13 structured budgets and is closest to the ideal privacy--utility point in 18 of 26 format--budget settings under our composite weighting. Direct measurements reveal complementary strengths: DP-BLOCK discloses less, while DP-SLOT retains more authorized facts. These results make policy-aware profile release a practical basis for studying privacy and personalization.