Differential privacy for LLMs: DP-SGD and its alternatives
DP-SGD privacy-utility frontier
1 / epsilon (log) -> more private ->
utility (accuracy)
no-adapter DP-SGD
LoRA + DP-SGD
epsilon ~ 10
epsilon ~ 3
alternatives
PMixED (inference-time)
mixture of experts + DP noise
DP synthetic data
downstream training on synth
2024-2025 evidence tension
canary MIA (Duan 2024)
limited success
extraction (Carlini, Nasr 2025)
substantial memorization
Kowalczyk et al. 2025: the two measure different things. canaries measure "insertion"; extraction measures "most-extractable".
DP Reversal via LLM Feedback: confidence scores can leak re-identification signal even when outputs do not.
deployment rule: epsilon + accountant + MIA protocol + extraction test + confidence exposure check.