标题： Pr$εε$mpt: 为LLMs清理敏感提示 显示英文标题

标题： Pr$εε$mpt: Sanitizing Sensitive Prompts for LLMs

摘要： 大型语言模型（LLMs）的兴起带来了新的隐私挑战，尤其是在推理过程中，提示中的敏感信息可能会暴露给专有的LLM API。 在本文中，我们解决了在保持响应质量的同时，对提示中包含的敏感信息进行正式保护的问题。 为此，首先，我们引入了一个受密码学启发的提示清理器的概念，该概念将输入提示转换以保护其敏感标记。 其次，我们提出了 Pr$\epsilon\epsilon$mpt，一种实现提示清理器的新系统。 Pr$\epsilon\epsilon$mpt 将敏感标记分为两种类型：(1) 那些LLM的响应仅取决于格式的标记（如社会安全号码、信用卡号码），对于这些标记，我们使用格式保留加密（FPE）；(2) 那些响应取决于特定值的标记（如年龄、薪水），对于这些标记，我们应用度量微分隐私（mDP）。 我们的评估表明，Pr$\epsilon\epsilon$mpt 是一种实用的方法，可以在与未清理的提示相比保持高实用性的同时实现有意义的隐私保证，并优于之前的方法。 显示英文摘要

摘要： The rise of large language models (LLMs) has introduced new privacy challenges, particularly during inference where sensitive information in prompts may be exposed to proprietary LLM APIs. In this paper, we address the problem of formally protecting the sensitive information contained in a prompt while maintaining response quality. To this end, first, we introduce a cryptographically inspired notion of a prompt sanitizer which transforms an input prompt to protect its sensitive tokens. Second, we propose Pr$\epsilon\epsilon$mpt, a novel system that implements a prompt sanitizer. Pr$\epsilon\epsilon$mpt categorizes sensitive tokens into two types: (1) those where the LLM's response depends solely on the format (such as SSNs, credit card numbers), for which we use format-preserving encryption (FPE); and (2) those where the response depends on specific values, (such as age, salary) for which we apply metric differential privacy (mDP). Our evaluation demonstrates that Pr$\epsilon\epsilon$mpt is a practical method to achieve meaningful privacy guarantees, while maintaining high utility compared to unsanitized prompts, and outperforming prior methods