🤖 machine learning

It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs

The paper introduces SELFCI, a complementary self-distillation framework that resolves the privacy-utility trade-off in large language models by jointly optimizing task performance and contextual integrity through a product-of-experts approach, outperforming existing baselines without requiring costly external supervision.

Original authors: Sangwoo Park, Woongyeong Yeo, Seanie Lee, Yumin Choi, Hyomin Lee, Kangsan Kim, Jinheon Baek, Seong Joon Oh, Sung Ju Hwang

Published 2026-05-21

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sangwoo Park, Woongyeong Yeo, Seanie Lee, Yumin Choi, Hyomin Lee, Kangsan Kim, Jinheon Baek, Seong Joon Oh, Sung Ju Hwang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, helpful personal assistant (like a large language model) who knows everything about you: your name, your medical history, your passport number, your favorite coffee order, and your secret diary entries.

Your goal is to get this assistant to help you book a hotel room. You want it to use your name and your preferred check-in date to make the reservation. However, you do not want it to accidentally tell the hotel clerk your passport number or your medical history, even though it knows those things.

This is the core problem the paper addresses, called Contextual Integrity. It's the idea that privacy isn't just about "hiding" information; it's about sharing the right information in the right context. Sharing your passport with a hotel clerk might be necessary for a visa, but sharing it with a hotel clerk just to book a twin room is a privacy violation.

The Problem: The "All-or-Nothing" Trap

The researchers found that existing AI assistants struggle with this balance.

Too Private: If you tell the AI "be super private," it might get scared to share anything. It might forget to tell the hotel your name or your check-in date, and you end up with no room. It's like a nervous waiter who refuses to take your order because they are afraid of making a mistake.
Too Open: If you just let the AI do its thing, it might spill your secrets. It might say, "Sure, I'll book the room, and by the way, here is your passport number and your medical history!" because it thinks "more information = better service."

Current methods to fix this usually try to force the AI to be private by giving it a single, blunt instruction (like a reward score). The paper argues this is like trying to teach someone to drive by only saying "don't crash." It doesn't teach them how to steer and brake at the same time.

The Solution: SELFCI (The "Two-Teacher" System)

The paper proposes a new method called SELFCI. Instead of hiring an expensive outside expert to teach the AI, the AI teaches itself using a clever "two-teacher" system.

Think of the AI as a student trying to learn how to write the perfect email. To learn, it creates two imaginary teachers from its own brain:

The "Utility" Teacher (The Helpful Expert): This teacher looks at the task and says, "To book this room, you must include the name, the date, and the room type. If you leave these out, the task fails." This teacher ensures the AI stays helpful and gets the job done.
The "Privacy" Teacher (The Security Guard): This teacher looks at the same task and says, "To book this room, you must not include the passport number or medical history. If you include these, you are violating privacy rules." This teacher ensures the AI stays safe.

How It Works: The "Venn Diagram" of Good Behavior

The magic of SELFCI is that it doesn't ask the AI to choose between these two teachers. Instead, it asks the AI to find the intersection where both teachers agree.

Imagine a Venn diagram:

One circle is "Helpful Stuff."
The other circle is "Safe Stuff."
The sweet spot in the middle is "Helpful AND Safe."

The AI learns to only output information that sits in that middle spot. It learns to say, "I will share the name (Helpful + Safe) but I will hide the passport (Not Safe)."

The paper calls this a Product-of-Experts. Think of it like a security checkpoint where you need two different guards to stamp your passport to pass. If one guard says "No" (Privacy Teacher), you don't pass, even if the other guard says "Yes" (Utility Teacher). If both say "Yes," you pass.

Why This is Better

The researchers tested this on various AI models (like Qwen and Llama) and found that:

It's Faster and Cheaper: Unlike other methods that require thousands of trial-and-error attempts (like Reinforcement Learning), SELFCI learns efficiently by looking at its own reasoning.
It Doesn't Break the AI: Other methods often make the AI so cautious that it stops being helpful. SELFCI keeps the AI smart and capable while making it private.
It Works in the Real World: They tested it on complex scenarios where the AI has to remember a long list of past conversations (accumulated memory) and decide what to share now. SELFCI was much better at remembering what was relevant and forgetting what wasn't, compared to older methods.

In a Nutshell

The paper introduces a way to teach AI assistants to be contextually smart. Instead of just being "secretive" or "chatty," the AI learns to act like a professional butler: it knows exactly which information is needed for the current task (like booking a room) and which information must be kept in the vault (like your medical history), all without losing its ability to get the job done. It does this by having the AI argue with itself from two different perspectives until it finds the perfect balance.

Technical Summary: SELFCI – Complementary Self-Distillation for Contextual Integrity in LLMs

Problem Statement

As Large Language Models (LLMs) are increasingly deployed as personal agents managing sensitive workflows, the challenge of privacy shifts from simple data hiding to Contextual Integrity (CI). CI defines privacy not as the absolute secrecy of information, but as the governance of information flows according to context-specific norms. A critical asymmetry exists in this domain: an assistant must retain information necessary for task completion (utility) while simultaneously suppressing information that is task-irrelevant or contextually inappropriate (privacy).

Existing alignment methods struggle to satisfy this joint requirement:

Supervised Fine-Tuning (SFT) on CI-compliant trajectories is costly to scale and suffers from exposure bias when generations deviate from the training distribution.
Online Reinforcement Learning (RL) (e.g., GRPO) relies on sparse, scalar rewards that conflate task success with disclosure compliance. This coarse feedback fails to adjudicate per-attribute decisions where appropriateness hinges on specific transmission norms, often leading to a trade-off where improving privacy degrades task utility.

The core problem is the lack of a mechanism that can disentangle the "retain" and "suppress" pressures without collapsing them into a single, ambiguous objective or relying on expensive external supervision.

Methodology: SELFCI

The authors propose SELFCI, a complementary self-distillation framework designed to align LLMs with CI principles without sacrificing native task-solving capabilities. The approach is grounded in the concept of context-dependent invariance: the model's predictive distribution should be invariant to the injection of disallowed information ( $D_T$ ) while remaining sensitive to allowed information ( $A_T$ ).

1. Feedback Generation

Instead of relying on ground-truth rationales or external frontier models, SELFCI leverages the model itself to generate on-policy feedback.

The model is prompted with specific instruction templates ( $I_{allow}$ and $I_{disallow}$ ) to generate rationales explaining why specific attributes should or should not be disclosed, based on CI transmission principles (Confidentiality, Proportionality, Consent).
These self-generated rationales serve as privileged context, providing dense, token-level guidance that is grounded in the model's own parameters.

2. Complementary Teacher Construction

SELFCI instantiates two distinct teacher policies from the same model parameters, conditioned on the aggregated feedback:

$\pi_{allow}$ (Utility-oriented): A teacher biased toward task completeness, guiding the policy to recover necessary information.
$\pi_{disallow}$ (Privacy-oriented): A teacher biased toward minimal disclosure, penalizing reliance on restricted information.

3. Joint Optimization via Product-of-Experts (PoE)

The student policy is trained by jointly minimizing two independent reverse KL divergences against these teachers:
$\mathcal{L} = \lambda D_{KL}(\pi_\theta \parallel \pi_{allow}) + (1-\lambda) D_{KL}(\pi_\theta \parallel \pi_{disallow})$
Mathematically, under fixed teacher distributions, this objective is equivalent to matching a Product-of-Experts (PoE) target distribution:
$\pi^* \propto \pi_{allow}^\lambda \cdot \pi_{disallow}^{1-\lambda}$
This multiplicative formulation concentrates probability mass on the intersection of the two teachers' supports. Consequently, the policy learns to satisfy both task completeness and minimal disclosure simultaneously, rather than treating them as competing objectives. The framework avoids the pitfalls of monolithic solutions by explicitly modeling the asymmetric retain/suppress structure.

Key Contributions

Decoupling Privacy and Utility: SELFCI introduces a framework that separates the optimization of task utility and privacy constraints into complementary teacher distributions, avoiding the structural constraints of scalar reward RL or monolithic SFT.
Self-Distillation without External Supervision: The method generates its own privileged context (rationales) and teachers from the target model, eliminating the need for costly external teachers or manually crafted rationales.
Theoretical Formulation: The authors demonstrate that the complementary self-distillation objective serves as an upper-bound surrogate for the ideal CI state (invariance to disallowed information), providing a mathematically grounded path to alignment.
Product-of-Experts Alignment: By optimizing toward the intersection of two specialized teachers, the method achieves a policy that is both task-complete and privacy-preserving, a balance often lost in existing baselines.

Experimental Results

The authors evaluated SELFCI across diverse instruction-tuned (e.g., Qwen2.5, Llama-3.1) and reasoning backbones (e.g., DeepSeek-R1, Olmo-3) on both in-domain and out-of-domain benchmarks.

In-Domain (CI-RL Benchmark): SELFCI consistently outperformed baselines, including online RL (CI-RL/GRPO) and external-teacher distillation (ContextDistill). On Qwen2.5-7B-Instruct, SELFCI improved the Complete score (satisfying both utility and integrity) from 23.29% to 53.42%, while significantly boosting Integrity (83.56%) without sacrificing Utility.
Out-of-Domain (PrivacyLens): In agentic workflows involving tool use, SELFCI demonstrated superior generalization, achieving the lowest leakage rates (LR and ALR) while maintaining high helpfulness scores.
Robustness (CIMemories): Under accumulated private context where attributes may be appropriate in one task but not another, SELFCI maintained a violation rate below 5%, whereas baselines exhibited compounding privacy failures.
Efficiency: SELFCI was more sample-efficient than online RL, reaching high performance in fewer epochs and requiring significantly less GPU time per step (one rollout vs. 16 for GRPO).

Significance and Claims

The paper claims that SELFCI provides a practical path toward Contextual Integrity alignment for personal agents. Its significance lies in demonstrating that:

Contextual privacy need not come at the cost of native utility; the two can be jointly optimized through complementary self-distillation.
The "retain/suppress" asymmetry of CI can be effectively modeled by decomposing the objective into specialized teacher distributions rather than relying on coarse scalar rewards.
Self-generated feedback can serve as a robust, on-policy signal for dense supervision, making privacy alignment scalable without dependence on proprietary frontier models.

The authors note limitations, including reliance on structured synthetic data for feedback generation, potential challenges for smaller models with weaker in-context learning abilities, and the use of a static coefficient $\lambda$ for balancing the teachers. However, the results suggest that SELFCI offers a scalable and effective approach for aligning LLMs with complex, context-dependent privacy norms.