State-of-the-art large language models (LLMs) are typically deployed as online services, requiring users to transmit detailed prompts to cloud servers. This raises significant privacy concerns. In response, we introduce ConfusionPrompt, a novel framework for private LLM inference that protects user privacy by: (i) decomposing the original prompt into smaller sub-prompts, and (ii) generating pseudo-prompts alongside the genuine sub-prompts, which are then sent to the LLM. The server responses are later recomposed by the user to reconstruct the final output. This approach offers key advantages over previous LLM privacy protection methods: (i) it integrates seamlessly with existing black-box LLMs, and (ii) it delivers a significantly improved privacy-utility trade-off compared to existing text perturbation methods. We also develop a $(λ, μ, ρ)$-privacy model to formulate the requirements for a privacy-preserving group of prompts and provide a complexity analysis to justify the role of prompt decomposition. Our empirical evaluation shows that ConfusionPrompt achieves significantly higher utility than local inference methods using open-source models and perturbation-based techniques, while also reducing memory consumption compared to open-source LLMs.

翻译：当前最先进的大语言模型（LLMs）通常作为在线服务部署，要求用户将详细提示词传输至云服务器，这引发了严重的隐私问题。为此，我们提出ConfusionPrompt——一种新颖的私有LLM推理框架，通过以下方式保护用户隐私：(i) 将原始提示词分解为更小的子提示词；(ii) 在真实子提示词旁生成伪提示词，并将两者一并发送至LLM。服务器返回的结果由用户重新组合以重构最终输出。该方法相比以往的LLM隐私保护方法具有关键优势：(i) 能无缝集成现有黑盒LLM；(ii) 相较于现有文本扰动方法，实现了显著更优的隐私-效用权衡。我们进一步构建了$(λ, μ, ρ)$-隐私模型以形式化隐私保护提示词组的需求，并通过复杂度分析论证提示词分解的合理性。实验评估表明，ConfusionPrompt在使用开源模型的本地推理方法和基于扰动的技术中实现了显著更高的效用，同时相比开源LLM降低了内存消耗。