Differentially Private and Communication Efficient Large Language Model Split Inference via Stochastic Quantization and Soft Prompt

1. Problem Statement

Large Language Models (LLMs) require massive computational resources, making local deployment on edge devices impractical. Consequently, users typically rely on cloud-based LLM services. However, this paradigm introduces critical privacy risks:

• Privacy Leakage: User queries often contain sensitive information (names, addresses, medical records) that can be exposed to untrusted service providers or intercepted during transmission.
• Limitations of Existing Solutions:
  • Homomorphic Encryption (HE): Offers strong privacy but incurs prohibitive computational overhead, rendering it unsuitable for modern transformer-based LLMs.
  • Split-and-Denoise (SnD): Executes only the embedding layer locally and sends perturbed embeddings to the server. While it preserves raw text privacy, it suffers from high communication overhead (transmitting high-dimensional float embeddings) and requires a local denoising model on the user side to restore utility, which is computationally expensive for resource-constrained devices.
  • InferDPT: Perturbs input tokens locally and uses a local lightweight LLM to extract coherent text. However, this still relies heavily on the capacity of the local model, diminishing the utility of the powerful remote LLM.

The Core Challenge: How to achieve Differential Privacy (DP) in LLM split inference while minimizing communication overhead and eliminating the need for computationally intensive local models, without significantly degrading inference utility.

2. Methodology: The DEL Framework

The authors propose DEL (Differentially private and communication Efficient LLM split inference), a framework comprising three main components:

A. Dimensionality Reduction (Encoder-Decoder)

To address the "curse of dimensionality" in DP (where noise scales with dimension size) and reduce communication costs:

• User Side: A pretrained Encoder ($g_e$) maps high-dimensional token embeddings ($x \in \mathbb{R}^b$) into a lower-dimensional latent space ($v \in \mathbb{R}^d$, where $d \ll b$).
• Server Side: A paired Decoder ($g_d$) reconstructs the embeddings back to the original dimensionality ($\hat{x}$) before feeding them into the LLM.
• Training: The encoder-decoder pair is pretrained to minimize the negative log-likelihood of the next token, ensuring semantic information is preserved in the latent space.

B. Differentially Private Stochastic Quantization

Instead of adding Gaussian noise directly to high-dimensional vectors, DEL employs a Stochastic $n$-bit Quantization mechanism on the latent representations:

• Mechanism: Each coordinate of the latent vector is mapped to one of $2^n$ uniformly spaced levels in a bounded range $[-A, A]$.
• Privacy Guarantee: The randomness inherent in the stochastic mapping provides Local Differential Privacy (LDP). The authors prove that this mechanism satisfies $\mu$-Gaussian Differential Privacy ($\mu$-GDP).
• Efficiency: This reduces communication overhead significantly (e.g., from 32-bit floats to 1–4 bits per coordinate) while maintaining an unbiased estimator of the original vector.

C. Server-Side Soft Prompt for Utility Preservation

To counteract the utility degradation caused by privacy perturbations without deploying a local denoising model:

• Soft Prompt Integration: A learnable soft prompt ($E$) is prepended to the privatized/reconstructed embeddings on the server side before LLM inference.
• Training: The soft prompt is optimized on the server to maximize the conditional likelihood of the ground-truth sequence given the privatized inputs.
• Function: The soft prompt acts as a "privacy-aware adapter," guiding the frozen LLM to compensate for the distributional shift introduced by the noise and quantization, effectively restoring inference quality.

3. Key Contributions

1. Novel DP Mechanism: Introduced a dimensionality-reduction module combined with stochastic $n$-bit quantization. This achieves strong DP guarantees while drastically reducing communication overhead compared to Gaussian mechanisms.
2. Lightweight Framework: Eliminated the need for local denoising models by leveraging server-side soft prompts. This shifts the computational burden to the server, making the solution viable for resource-constrained user devices.
3. First Application of Soft Prompts for Privacy: To the authors' knowledge, this is the first work to utilize soft prompts specifically to improve the privacy-utility trade-off in LLM inference.
4. Comprehensive Evaluation: Validated the framework across open-ended text generation and Natural Language Understanding (NLU) tasks using various state-of-the-art LLMs (Llama3, Qwen2.5, DeepSeek-MoE).

4. Experimental Results

The authors evaluated DEL against baselines like RANTEXT, InferDPT, and SnD using metrics such as Perplexity (PPL), Coherence (COH), Accuracy (Acc), and Attack Success Rate (ASR).

• Privacy-Utility Trade-off:
  • DEL consistently outperformed InferDPT and RANTEXT in text generation tasks (measured by COH and PPL) across various privacy levels (ASR).
  • Unlike InferDPT, whose performance relies heavily on the local model's capacity, DEL fully leverages the remote LLM's power.
  • In NLU tasks (QQP, MRPC), DEL achieved higher accuracy and AUC than SnD while using significantly less bandwidth (1–4 bits vs. 32-bit floats).
• Communication Efficiency:
  • By compressing embeddings (e.g., reducing dimension by 32x) and using low-bit quantization, DEL reduced communication overhead by orders of magnitude compared to transmitting raw or Gaussian-noised embeddings.
• Transferability:
  • Experiments showed that soft prompts trained on public datasets (e.g., C4) transfer effectively to target datasets and different privacy budgets ($\mu$), demonstrating robust generalization.
• Qualitative Analysis:
  • Visual comparisons showed that while InferDPT often resulted in garbled text requiring heavy local correction, DEL produced coherent outputs directly from the remote LLM, even under strong privacy constraints.

5. Significance

This paper addresses a critical bottleneck in the deployment of private LLM services: the trade-off between privacy, communication cost, and computational feasibility.

• Practicality: By removing the need for local denoising models, DEL makes private LLM inference feasible for standard mobile and edge devices.
• Scalability: The reduction in communication overhead enables the use of LLMs in bandwidth-constrained environments.
• Innovation: The integration of soft prompts as a privacy-compensation mechanism opens a new direction for research, suggesting that model adaptation (via prompts) can be more efficient than architectural changes (like local denoising) for preserving utility in privacy-preserving settings.

In summary, DEL provides a robust, efficient, and practical framework for secure LLM inference, achieving a superior balance between protecting user data and maintaining high-quality model performance.