arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2412.04697cs.CRcs.AIcs.CL
收藏

基于差分隐私的隐私保护检索增强生成

Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy

University of California, San Diego（加州大学圣迭戈分校）；University of California, Los Angeles（加州大学洛杉矶分校）

Tatsuki Koga, Ruihan Wu, Zhiyuan Zhang, Kamalika Chaudhuri

阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对RAG输出可能泄露敏感信息的问题，本研究探索差分隐私下的RAG，提出仅为需敏感信息的token分配隐私预算的算法，在ε≈10时优于非RAG基线。

摘要：

随着大型语言模型（LLMs）近期的显著进步，人们越来越关注在其训练数据之外的高敏感数据领域中利用这些模型。为此，检索增强生成（RAG）尤为有效——它通过直接从外部知识源提供相关信息来辅助LLMs。然而，若缺乏额外的隐私保护措施，RAG的输出可能泄露外部数据源中的敏感信息。在本研究中，我们探索了差分隐私（DP）下的RAG，DP是一种数据隐私的形式化保证。差分隐私RAG的主要挑战是如何在适度的隐私预算内生成准确的长文本答案。我们通过提出一种算法来解决这一问题：该算法仅为需要敏感信息的token分配隐私预算，对其他token则使用非隐私的LLM。我们广泛的实证评估表明，在不同模型和数据集上，当隐私预算ε≈10时，我们的算法优于非RAG基线。

英文摘要：

With the recent remarkable advancement of large language models (LLMs), there has been a growing interest in utilizing them in the domains with highly sensitive data that lies outside their training data. For this purpose, retrieval-augmented generation (RAG) is particularly effective -- it assists LLMs by directly providing relevant information from the external knowledge sources. However, without extra privacy safeguards, RAG outputs risk leaking sensitive information from the external data source. In this work, we explore RAG under differential privacy (DP), a formal guarantee of data privacy. The main challenge with differentially private RAG is how to generate long accurate answers within a moderate privacy budget. We address this by proposing an algorithm that smartly spends privacy budget only for the tokens that require the sensitive information and uses the non-private LLM for other tokens. Our extensive empirical evaluations reveal that our algorithm outperforms the non-RAG baseline under a reasonable privacy budget of $ε\approx 10$ across different models and datasets.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑