Although boosting software development performance, large language model (LLM)-powered code generation introduces intellectual property and data security risks rooted in the fact that a service provider (cloud) observes a client's prompts and generated code, which can be proprietary in commercial systems. To mitigate this problem, we propose NOIR, the first framework to protect the client's prompts and generated code from the cloud. NOIR uses an encoder and a decoder at the client to encode and send the prompts' embeddings to the cloud to get enriched embeddings from the LLM, which are then decoded to generate the code locally at the client. Since the cloud can use the embeddings to infer the prompt and the generated code, NOIR introduces a new mechanism to achieve indistinguishability, a local differential privacy protection at the token embedding level, in the vocabulary used in the prompts and code, and a data-independent and randomized tokenizer on the client side. These components effectively defend against reconstruction and frequency analysis attacks by an honest-but-curious cloud. Extensive analysis and results using open-source LLMs show that NOIR significantly outperforms existing baselines on benchmarks, including the Evalplus (MBPP and HumanEval, Pass@1 of 76.7 and 77.4), and BigCodeBench (Pass@1 of 38.7, only a 1.77% drop from the original LLM) under strong privacy against attacks.

翻译：尽管大语言模型（LLM）驱动的代码生成显著提升了软件开发效率，但其引入了知识产权与数据安全风险，根源在于服务提供商（云端）能够观测到用户的提示词及生成的代码，而这些内容在商业系统中可能具有专有性。为缓解此问题，我们提出了NOIR——首个能够保护用户提示词与生成代码免受云端窥探的框架。NOIR在客户端部署编码器与解码器：编码器将提示词转换为嵌入向量并发送至云端，云端LLM对嵌入进行增强后返回客户端，再由本地解码器生成代码。鉴于云端可能通过嵌入向量推断提示词及生成代码内容，NOIR创新性地实现了嵌入层面的不可区分性保护机制，具体包括：在提示词与代码词汇表中实施词元嵌入级的本地差分隐私保护，以及在客户端采用数据无关的随机化分词器。这些组件能有效防御诚实但好奇的云端发起的重构攻击与频率分析攻击。基于开源LLM的广泛分析与实验结果表明，在强隐私攻击防护下，NOIR在多项基准测试中显著优于现有基线，包括Evalplus（MBPP与HumanEval的Pass@1分别达到76.7%与77.4%）以及BigCodeBench（Pass@1为38.7%，仅比原始LLM性能下降1.77%）。