Privacy needs different rules for different uses of AI language models
Privacy in Context Is Being Overlooked in the Age of General-Purpose LLMs
Machine LearningArtificial Intelligence
Summary
As large language models are used for many different tasks, people often try to create one simple privacy solution for everything. The authors show that this idea misses an important fact: privacy depends on the situation. They warn that trying to make one privacy system for all uses can give a false sense of security. Instead, they suggest building privacy rules tailored to each application, testing privacy methods in each context, and improving people’s understanding of privacy.
What this means in practice
- •For enterprise ai teams: Deploy language models with privacy rules designed for specific business uses and data contexts.
- •For privacy policy makers: Evaluate privacy protections by considering the particular ways AI is used in different settings rather than one general standard.
A position paper. It proposes an approach and reports no results.
Authors
Prakhar Ganesh, Yash More, Marco Romanelli, Ferdinando Fioretto, Golnoosh Farnadi
Abstract
As large language models (LLMs) continue to grow in scope and capability, privacy concerns are on the rise. Since users increasingly interact with a single general-purpose system across many distinct contexts, there is a natural tendency to pursue a one-size-fits-all solution to privacy. Unfortunately, this overlooks a crucial insight from decades of privacy research: privacy is inherently contextual. In this paper, we argue that existing work in prompt privacy is drifting towards attempts to design a unified framework, which is highly misleading and can foster a false sense of security. Furthermore, we argue that even future work in this direction needs to wrestle with fundamental tensions across various desirable properties of prompt privacy. Thus, such continued attempts towards a unified framework need to be reconsidered. We recommend three critical paths forward: application-specific deployment of LLMs, context-specific evaluation of privacy frameworks, and better privacy literacy.