Specify Your Own Privacy: Evaluating the Inference-Time Personalized Privacy Protection Capability of Large Vision-Language Models

Core question: can LVLMs protect personalized privacy at inference time according to privacy boundaries that users dynamically specify in natural language (ITP3), rather than only complying with preset generic privacy categories.

• Problem scenario: the authors state that LVLMs can infer sensitive information such as identity attributes and geographic location from images with relatively high accuracy (Figure 1(a)); existing privacy work implicitly assumes that privacy preferences are shared by all users and defined by static sensitive attributes.
• Shortcomings of existing methods: the authors hold that privacy is personalized and scenario-dependent—different users have different sensitivity to attributes such as gender and age, and the same attribute (e.g., diagnostic imaging) has different sensitivity in different scenarios; the gap between predefined categories and flexible preferences limits the actual privacy protection effectiveness of LVLMs (Figure 1(b)).
• Core observation: the authors hold that privacy leakage at inference time is difficult to mitigate with preprocessing such as prompt anonymization or filtering, because queries are hard to distinguish from normal requests, and the personalized nature of privacy makes it impossible to predefine generic filtering rules.
• Proposed in the paper: proposes the ITP3 task (with three dimensions: instruction compliance, scenario awareness and utility preservation), builds SPY-Bench (32,700 samples, 67 categories, 24 scenarios) and the training set SPY-Tune, evaluates 21 LVLMs, and implements SFT, DPO, NCA and its variant NCA-P as preliminary alignment methods.
• Threat model: this is not an attack paper; it focuses on the privacy leakage risk of models at inference time.
  • Source of risk: LVLMs infer and leak personal information from images uploaded by users (attribute inference).
  • Expected behavior: absolute privacy categories are always avoided; customizable categories are answered or avoided according to user instructions and scenario.
  • Victim system: deployed LVLMs (personal assistants, service provider compliance and other scenarios, Appendix A).

Large Vision-Language Models (LVLMs)

• CLIP and BLIP—align image-text representations via contrastive learning, used for zero-shot classification and image captioning.
• LLaVA, BLIP-2, MiniGPT-4—project image embeddings into the text embedding space of a pretrained LLM rather than training from scratch.
• GPT-4o, Claude, Gemini, Qwen VL, InternVL, etc.—the authors state they have made progress on tasks such as high-resolution understanding, multi-image understanding, and visual reasoning.

Personalized Alignment

• Following reference [26], the paper divides preference modeling into three categories: prompt-based (appending a preference description to the input), embedding-based (encoding into an embedding space or latent variables), and parameter-based (full-parameter or adapter training).
• The paper notes that most of this work targets LLMs, and personalized alignment on multimodal models, especially LVLMs, is relatively unexplored; few studies do personalized alignment from a privacy perspective.

Privacy Issues of LLMs/LVLMs

• Training data leakage: membership inference attacks (MIA) and data extraction attacks, which can be mitigated by data cleaning, machine unlearning, federated learning, differential privacy, etc.
• Inference-time leakage: models infer private information from seemingly innocuous inputs (attribute inference attacks), e.g., inferring precise geographic location from a photo; the authors consider this type of leakage harder to mitigate.
• Multi-P2A [90]—a multimodal privacy evaluation dataset that uses the same image source as SPY-Bench; this paper compares with it in Table 2 on text diversity, image-text alignment, and naturalness, and borrows its RtA metric as the paper's base metric.

Baselines and Benchmarks

• Alignment method baselines: Self-Moderation [15] (training-free multi-turn self-reflection), SFT, DPO [64], NCA [11], with Qwen2 VL 7B Instruct as the fine-tuning backbone.
• General capability benchmarks: MMMUVal, OCRBench, MME; dataset quality comparison benchmarks: OK-VQA, Multi-P2A.

Positioning: the authors claim this paper is the first work to propose and formalize the ITP3 task, and that SPY-Bench and SPY-Tune are the first benchmark and training set for personalized visual privacy protection.

Overall approach: first formalize the ITP3 task and construct the SPY-Bench benchmark and SPY-Tune training set, design evaluation metrics grounded in user instructions and scenarios, then use various alignment methods to improve models' personalized privacy protection capability.

Problem Formalization

• Given an information category c (e.g., age, location) and an image-question pair (I, q) involving c, examine whether the model can change its answer depending on whether c is defined as private.
• Absolute privacy categories: regardless of instructions and scenarios, the model should evade (refuse to answer or exclude content related to c); in experiments these are predefined as five categories: semi nudity, full nudity, ausweis, passport, drivers license (Appendix C.1).
• Customizable categories: answer normally by default, unless the user specifies them as private via a natural-language instruction (e.g., "Age is considered as private information.").
• Scenario s: if c is considered non-private in scenario s (conflict scenario), the model should answer normally even if the user specifies it as private; in non-conflict scenarios, it follows the user instruction.

Data Construction

• Image source: all from the VISPR dataset; SPY-Bench uses its test set and SPY-Tune uses its training set, with no overlap between the two.
• Three-step text generation: GPT-4o generates scenario and privacy instruction templates; InternVL 2.5 78B generates, for each pair (I, c), a question, an answer-style answer yr, and an evasion-style answer ye; instruction templates are randomly selected and scenario templates optionally added.
• Quality control: deduplication; category consistency checking with InternVL 2.5 38B; question-answer consistency filtering; manual review of about 500 randomly sampled items.
• Scale: SPY-Bench contains 2,725 images, 6,700 questions, 24 scenarios, expanded to 32,700 samples; SPY-Tune contains 4,206 images, 16,677 questions, 18 scenarios, 81,096 samples (Table 1).

Metric Design

• RtA (Refuse-to-Answer Rate): the proportion of correct evasions among samples that should be evaded, borrowed from Multi-P2A.
• AtA (Agree-to-Answer Rate): the proportion of correct answers among samples that should be answered normally.
• HMS: the harmonic mean of RtA and AtA, penalizing extreme behavior of always refusing or always answering.
• ICS (Instruction Compliance Score): ICS = (N_1abs + N_2cust + N_4conf) / (N₁ + N₂ + N₃ + N₄), i.e., the proportion of hits on the three expected behaviors: evading absolute privacy, acting per instruction for customizable categories, and prioritizing the scenario in conflict scenarios (Table 3 defines the four cases).

Evaluation Protocol

• Each image-question pair is expanded into 5 cases depending on whether a scenario is included and whether it is specified as private; 6.7k pairs generate 32.7k samples.
• Two settings: w/o distractors gives only 1 instruction targeting c; w/ distractors adds 5 instructions targeting unrelated categories.
• GPT-4o is used to judge whether the model's answer is respond or evade (review prompt in Appendix Table 12).

Alignment Methods

• Self-Moderation: training-free; after the first-round answer, it regenerates through two rounds of reflection and confirmation.
• SFT: direct autoregressive fine-tuning on (I, instruction, q) and the expected answer.
• DPO: learns a Bradley-Terry model from preferred/non-preferred answer pairs.
• NCA: a contrastive method that learns an absolute reward for each sample, ensuring the likelihood of preferred samples increases.
• NCA-P: the authors hypothesize that pretrained models struggle to capture the literal difference between "specified as private/non-private" in instructions, so they jointly optimize the private and non-private cases of the same c in the same loss function (Equation 7).
• Training details: backbone Qwen2 VL 7B Instruct; SFT learning rate 6e-6 (4 A100s), DPO 1e-6, β=0.5 (8 A100s), NCA/NCA-P 3e-6, β=0.01 (8 A100s); batch size 32, trained for 3 epochs (Appendix D.3).

Experimental Setup

• Models evaluated: 18 open-source models (LLaVA 1.5 13B, LLaVA NeXT Vicuna 13B, LLaVA OneVision Qwen2 7B, Llama 3.2 11B, Pixtral 12B, GLM 4V 9B, Deepseek VL2, InternVL 2.5 4B/8B/38B/78B, Qwen2 VL 7B, Qwen2.5 VL 3B/7B/32B/72B, Phi 4 Multimodal, Mistral Small 3.1 24B) and 3 closed-source models (GPT 4o 2024-11-20, Gemini 2.0 Flash, o4-mini 2025-04-16).
• Benchmark: SPY-Bench (32,700 samples, 67 categories, 24 scenarios); general capability uses MMMUVal, OCRBench, MME.
• Metrics: ICS, RtA, AtA, HMS (all scaled to [0,100]).
• Review method: GPT-4o judges respond/evade; agreement with 3 human experts on 100 random samples is 97.00% (majority vote), and human annotation Fleiss' kappa is 91.69% (Table 5, Appendix D.2).
• Generation parameters: maximum 512 tokens, temperature 0.0, a single generation per sample; open-source models are inferred with vLLM on an A100 cluster (Appendix D.1).
• Alignment experiments: backbone Qwen2 VL 7B Instruct, trained on SPY-Tune for 3 epochs; the paper does not report multiple repetitions.

Main Results

According to Table 4 (w/ distractors setting, ICS on the no-scenario portion and HMS on the scenario portion):

Model	ICS (no scenario)	HMS (with scenario)
LLaVA 1.5 13B	1.90	15.25
LLaVA OneVision Qwen2 7B	1.99	11.93
Qwen2 VL 7B Instruct	2.75	12.33
InternVL 2.5 38B	11.70	41.59
Qwen2.5 VL 32B Instruct	17.60	36.64
GPT 4o 2024-11-20	21.10	48.31
Gemini 2.0 Flash	10.51	22.96
o4-mini 2025-04-16	23.74	42.25

(the remaining 13 models are omitted; the lowest are LLaVA 1.5 13B and LLaVA OneVision Qwen2 7B.)

• The authors state that most models have ICS below 20%, indicating that current LVLMs struggle to dynamically adjust answers according to user-defined privacy constraints; the authors speculate this stems from a conflict between personalized preferences and pretrained general privacy understanding.
• Scenario analysis: when an answer should be given, most models have AtA around 80%–90%; when evasion is required, RtA is usually below 30%, with the highest, GPT-4o, at 40.79% under w/ distractors; the authors state this reflects models' tendency to answer directly and a propensity for privacy leakage.
• Effect of distractor instructions: after adding distractors, most models' ICS decreases, but GPT-4o and Mistral Small 3.1 24B instead increase; Figure 4 shows these two remain robust as the number of distractors increases, while other models decrease more (the authors call this result counterintuitive).

Model Scale and Category Analysis

• Scale: Figure 3 and Appendix Figure 7 show that the Qwen2.5 VL and InternVL 2.5 series increase in ICS/HMS from sub-10B to above 30B, but from 32B to 72B (or 38B to 78B) they no longer improve consistently, and some even decrease; the authors believe that simply increasing model scale cannot reliably solve ITP3.
• Categories: Figure 5 and Appendix Figure 8 show that models have low ICS on absolute privacy categories (National Identification, Passport, Driver License) and on Credit card, Receipt, Email, and perform relatively better on Approximate age, Gender, License plate; the authors state that models find it harder to refuse traditional sensitive information.

Alignment Method Results

According to Table 6 (Qwen2 VL 7B as backbone):

Swipe horizontally to read the table

Method	ICS (w/o dis. no scenario)	ICS (w/ dis. no scenario)	HMS (w/ dis. with scenario)
Original model	3.06	2.75	12.33
+ Self-Mod.	20.30	9.45	35.25
+ SFT	66.30	75.75	85.29
+ DPO	92.76	91.43	87.70
+ NCA	97.40	96.54	87.05
+ NCA-P	97.70	96.88	88.11

• The authors state that all methods improve, with NCA-P performing best; on general capability all fine-tuning methods decrease, with SFT decreasing the most (MMMUVal from 50.44 to 5.56, Table 7).
• Composite score (harmonic mean of the SPY-Bench average score and the normalized average of MMMUVal/OCRBench/MME): NCA-P is 78.61, higher than DPO's 75.99 and NCA's 75.51 (Table 7).
• Exceptions: Appendix Table 15 shows that in non-conflict scenarios, the AtA of Self-Moderation, SFT, and DPO is lower than the original model, and in conflict scenarios the AtA of all methods is lower than the original model; the authors attribute this to an over-conservative tendency after alignment.

Other Ablations and Analyses

• Dataset quality (Table 2): SPY-Bench's Self-BLEU is 81.51, lower than Multi-P2A's 100.00; CLIP Score is 20.49, higher than Multi-P2A's 15.74; cosine similarity of embeddings with OK-VQA is 16.76, higher than Multi-P2A's 9.05.
• Case studies (Figure 6, Appendix Tables 16–21): in conflict scenarios all fine-tuning baselines refuse to answer, while Self-Moderation and NCA-P give compromise answers; in absolute privacy cases Self-Moderation and DPO fail to evade.
• The paper does not report hyperparameter sensitivity or variance across multiple repetitions.

Limitations and future directions noted by the authors

• Balancing general capability and ITP3 (Appendix B): NCA-P has a better trade-off than mainstream fine-tuning methods, but general capability still declines; the authors suggest incorporating personalized privacy samples into the pretraining stage, or exploring parameter-frozen methods such as prompt tuning and training a dedicated prompter.
• Real-world scenario coverage (Appendix B): SPY-Bench and SPY-Tune are limited by scale and have limited coverage of real privacy information categories and personalized needs; the authors suggest expanding the data scale.
• Multi-granularity, multi-dimensional modeling (Appendix B): currently only binary constraints (privacy/non-privacy) are used to model independent categories; the authors suggest supporting multiple granularities (e.g., location down to country/city level) and multi-dimensional privacy needs, along with new benchmarks and training sets.
• Incomplete representation of privacy diversity (Appendix H ethics statement): privacy categories and scenarios cannot be exhaustive, and the dataset can only reflect part of the picture of personalized privacy protection.
• Simplification of privacy complexity (Appendix H): reducing subjective, ambiguous privacy concepts to a finite set of categories and scenarios; a more systematic framework still needs research.
• Risk of misuse (Appendix H): the authors acknowledge that the method could be misused to develop models that evade privacy protection, and advocate responsible disclosure.

Scope of experiments

• A total of 21 models were tested (18 open-source, 3 closed-source); main results are in Table 4.
• Alignment experiments use only Qwen2 VL 7B Instruct as the backbone, with five methods: Self-Moderation, SFT, DPO, NCA and NCA-P (Table 6).
• General capability evaluation includes three benchmarks: MMMUVal, OCRBench and MME (Table 7).
• Judging is automated by GPT-4o, with human agreement verified on 100 random samples (3 experts, majority-vote agreement rate 97.00%).
• The paper does not report repeated runs or confidence intervals; SPY-Tune intentionally excludes some categories to test generalization to unseen domains (Appendix C.1).

An evaluation and alignment paper on personalized privacy protection for LVLMs. The authors hold that privacy is personalized and scenario-dependent, and that existing alignment covers only generic privacy categories, so they propose the ITP3 task: letting users dynamically specify privacy boundaries in natural language at inference time.

• Benchmark: SPY-Bench contains 32,700 samples, 67 privacy categories and 24 real-world scenarios; images come from VISPR, and texts are generated by GPT-4o and InternVL 2.5 78B and filtered; metrics include ICS, RtA, AtA and HMS; the agreement rate between GPT-4o judging and human majority voting is 97.00% (100 samples).
• Main findings: the compliance ability of 21 LVLMs is generally low—for most models, ICS in the no-scenario part is below 20%, with the highest, o4-mini, at 23.74% (w/ distractors, Table 4); RtA when avoidance is required is mostly below 30%, while AtA when answering is required is about 80%–90%; the authors state that models show a tendency toward disclosure.
• Scale and categories: the Qwen2.5 VL and InternVL 2.5 series show diminishing returns from scale above 30B; models have lower ICS on traditional sensitive categories such as Passport and Credit card.
• Alignment methods: with Qwen2 VL 7B as the backbone, NCA-P (placing privacy/non-privacy instructions of the same category into the same loss) achieves ICS 96.88% and HMS 88.11% (w/ distractors, Table 6), with a composite score of 78.61, higher than DPO and NCA (Table 7); however, all fine-tuning methods show a decline in general capability, and in conflict scenarios AtA is lower than the original model for all of them.
• Authors' conclusion: ITP3 is a basic requirement for the ethical deployment of multimodal systems, and current models have insufficient awareness of personalized privacy; better training strategies are needed in the future to balance privacy protection and model utility.