基于LLM的数据重建的双刃剑效应：理解并缓解词级差分隐私文本净化中的上下文脆弱性
The Double-edged Sword of LLM-based Data Reconstruction: Understanding and Mitigating Contextual Vulnerability in Word-level Differential Privacy Text Sanitization
AI总结：
本研究探讨了LLM在词级差分隐私文本净化中的上下文脆弱性利用，发现其攻击具有双刃剑效应，既可能削弱隐私，也可用于后处理以提升隐私保护。
摘要：
差分隐私文本净化是指在差分隐私（DP）框架下对文本进行私有化处理的过程，它提供可证明的隐私保证，同时也能在经验上抵御试图损害隐私的 adversaries。尽管词级差分隐私文本净化方法简单，但它们表现出许多缺点，其中之一是由于净化过程中的随机化而倾向于保留原始文本中的上下文线索——我们将此称为“上下文脆弱性”。鉴于大型语言模型（LLMs）强大的上下文理解和推理能力，我们探索了在多大程度上可以利用LLMs来利用DP净化文本的上下文脆弱性。我们扩展了先前的工作，不仅使用了先进的LLMs，还测试了在不同隐私级别下更广泛的净化机制。我们的实验揭示了基于LLM的数据重建攻击对隐私和效用的双刃剑效应：虽然LLMs确实可以推断原始语义，有时会削弱经验隐私保护，但它们也可以被用于善举，即提高DP净化文本的质量和隐私。基于我们的发现，我们提出了将LLM数据重建作为后处理步骤的建议，通过对抗性思考来增强隐私保护。
英文摘要：
Differentially private text sanitization refers to the process of privatizing texts under the framework of Differential Privacy (DP), providing provable privacy guarantees while also empirically defending against adversaries seeking to harm privacy. Despite their simplicity, DP text sanitization methods operating at the word level exhibit a number of shortcomings, among them the tendency to leave contextual clues from the original texts due to randomization during sanitization $\unicode{x2013}$ this we refer to as $\textit{contextual vulnerability}$. Given the powerful contextual understanding and inference capabilities of Large Language Models (LLMs), we explore to what extent LLMs can be leveraged to exploit the contextual vulnerability of DP-sanitized texts. We expand on previous work not only in the use of advanced LLMs, but also in testing a broader range of sanitization mechanisms at various privacy levels. Our experiments uncover a double-edged sword effect of LLM-based data reconstruction attacks on privacy and utility: while LLMs can indeed infer original semantics and sometimes degrade empirical privacy protections, they can also be used for good, to improve the quality and privacy of DP-sanitized texts. Based on our findings, we propose recommendations for using LLM data reconstruction as a post-processing step, serving to increase privacy protection by thinking adversarially.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
