An empirical privacy protection benchmark evaluation adapted for large language models

Researchers propose a privacy benchmark that empirically measures the actual privacy protection of large language models under differential privacy (DP) adaptation, using attacks such as robust membership inference and canary data extraction. They systematically vary the adaptation data distribution, from fully overlapping with pretraining data, to in-distribution (IID), to fully out-of-distribution (OOD), and evaluate the impact of different adaptation methods and privacy mechanisms on vulnerability. Results show that under equal theoretical guarantees, the closer the adaptation data is to the pretraining distribution, the higher the actual privacy risk, even without direct data overlap; parameter-efficient fine-tuning methods such as LoRA achieve the best empirical privacy protection on OOD data. The authors also propose a structured privacy evaluation framework that goes beyond adaptation privacy to cover the entire pipeline from pretraining to adaptation.