LLM Privacy Defenses: DP, Encryption, TEEs, and Unlearning
Comparing differential privacy, homomorphic encryption, trusted execution environments, and machine unlearning by the lifecycle stage they protect, the trust they assume, and the overhead they cost, and why no single one finishes the job.
Contents
Four technologies address the same privacy threats at different stages of the lifecycle, under different trust assumptions. This post compares them and explains why none of them is sufficient alone.
What threats are in scope
An LLM absorbs its training data into its weights, and at inference time it processes user input in plaintext. Those two properties split the privacy threats apart. Even under the single heading of privacy protection, the point that has to be defended is different in each case.
Threats divide by lifecycle stage. Four of them stand out.
- Training data extraction and membership inference — the path by which personally identifiable information (PII) memorized in the weights leaks out. A membership inference attack (MIA) estimates whether a particular sample was in the training set.
- Prompt exposure at inference time — a prompt sent to an external LLM sits in the cloud operator's memory as plaintext. A zero-retention clause does not prevent memory access in that moment.
- Right-to-be-forgotten requests — after deployment, an individual demands deletion of their data under the right to be forgotten (RTBF).
- Compliance evidence — the burden of proving during an audit that no data leaked.
Each of the four technologies blocks these threats at a different stage. Differential privacy operates during training, homomorphic encryption and trusted execution environments during inference, and machine unlearning after deployment.
Where each technology sits
The four technologies occupy different points in the lifecycle.
The moment of protection differs by technology.
- Differential privacy acts before training finishes, at the moment data would be absorbed into the weights.
- Homomorphic encryption and trusted execution environments act at inference, when the prompt would otherwise be exposed in plaintext.
- Machine unlearning erases traces from a model that has already been trained.
Different protection points mean different threats covered. Closing one stage does not close the others.
Differential privacy
Differential privacy (DP) bounds the influence any single individual's data has on the result to a statistically negligible level. The formal definition is (ε, δ)-DP. For adjacent datasets D and D' differing in one record, the output distribution of the model must satisfy the following.
Pr[M(D) ∈ S] ≤ e^ε · Pr[M(D') ∈ S] + δSmaller ε means stronger protection. ε ≤ 1 is generally considered strict and ε ≤ 8 moderate. δ is the probability that the guarantee breaks, and is usually set at or below the reciprocal of the dataset size (1/N).
The standard way to bring DP into LLM training is DP-SGD (differentially private stochastic gradient descent). Per-sample gradients are clipped, then Gaussian noise is added, so no single sample leaves a trace in the weights. The cost is high. Per-sample clipping increases memory use, and because noise is applied to every parameter, the signal drowns in noise as models get larger.
That is why DP is combined with techniques such as LoRA (low-rank adaptation) that train only a subset of parameters. DP-FedLoRA (arXiv:2509.09097) applies DP only to LoRA updates in a federated learning setting and reduces the utility loss. In the same paper, the MMLU score dropped from 44.64% to 42.45% relative to FedAvg, and BBH from 38.96% to 38.52%. Both benchmarks fell by only about two percentage points, which is what keeping the utility loss small looks like.
DP has a downside, though. A scoping review of 74 medical deep learning papers (arXiv:2506.00660) found that DP noise degrades accuracy more sharply for minority population groups. At the same ε, the smaller the group, the larger the loss.
Adding DP to federated learning still leaves gradient inversion risk. There are empirical reports of membership inference succeeding at high rates even against DP-trained models. Hence the recurring recommendation to combine DP with secure aggregation or TEE-based aggregation.
Homomorphic encryption and secure multi-party computation
Fully homomorphic encryption (FHE) computes on ciphertext without decrypting it. The user encrypts the input and sends it, the server runs inference entirely on ciphertext, and an encrypted result comes back. The server never sees plaintext. Security rests on the computational hardness of lattice problems such as RLWE (ring learning with errors).
Secure multi-party computation (MPC) lets several parties jointly compute a function without revealing their individual secrets. It assumes the parties do not collude and carries heavy communication cost. Real systems often mix the two: linear layers under homomorphic encryption, and nonlinearities such as Softmax and GELU handled by garbled circuits or secret sharing.
Cost is the biggest weakness. The IACR ePrint 2026/105 survey puts FHE-family overhead at 100 to 1000 times plaintext or more, and places the practical operational ceiling around 13B-parameter models.
As a practical case, arXiv:2501.01672 protects both the user input and the server weights. The input is hidden with FHE, while fine-tuned weights are hidden by a separate transformation (a private linear layer). The security of that transformation reduces to the LWE (learning with errors) assumption.
The same paper reports 1.61 seconds per token for ChatGLM2-6B with LoRA. That is slow for a conversational service measured in seconds, but usable for one-shot inference in medicine or law. In other words, encrypted inference offers the strongest guarantee but is realistically confined to one-off and batch workloads.
Trusted execution environments
A trusted execution environment (TEE) carves out an isolated region (an enclave) inside a CPU or GPU. Code and data inside it are hidden from the host OS, the hypervisor, the cloud operator, and insiders. Unlike homomorphic encryption, which hides data cryptographically, a TEE has the hardware block memory access outright. The price is having to trust the hardware vendor.
The key mechanism is remote attestation. It presents cryptographic evidence to an outside party that the code now running is an enclave with measurement X. That evidence is what demonstrates no data leaked during a PIPA (Korea's Personal Information Protection Act), GDPR, or HIPAA audit.
Performance is what made TEEs the first choice in production. A study measuring CPU and GPU TEEs on Llama2 7B/13B/70B inference (arXiv:2509.18886) reports a throughput reduction of 4 to 7%. That contrasts with the several-hundred-percent overhead of the homomorphic encryption family on the same workload.
Since 2023, confidential computing mode on NVIDIA H100 and H200 has extended protection to 70B-class GPU inference. In that mode, PCIe traffic between CPU and GPU is encrypted and GPU memory is isolated from the host (arXiv:2409.03992).
A TEE does not eliminate trust, though; it relocates it. Trust now extends to the hardware vendor, the microcode, the remote attestation service, the boot measurement chain, and the side-channel patch level. Side-channel risk persists and requires continuous patching, and because hardware keys rest on classical cryptography, quantum resistance is weak. Compared with homomorphic encryption's "trust only the cryptographic assumption", the trust surface is wider, but in exchange large models can run in real time.
Machine unlearning and the right to be forgotten
The right to be forgotten is the right to erasure under GDPR Article 17, established in the 2014 Google Spain ruling. A search engine simply removes the entry from its index. An LLM, however, has its training data dissolved into the weights, which makes isolating the influence of a specific data point fundamentally difficult (arXiv:2307.03941).
The same paper divides RTBF compliance into four axes. The first two are differential privacy (statistical protection up front) and machine unlearning (removing influence after the fact). The other two are model editing (fact-level correction with ROME or MEMIT) and guardrails (blocking at the input and output boundary). Its conclusion is that no single axis completes RTBF.
Machine unlearning is the family of techniques that removes the influence of specific data from a model after training. The algorithms include gradient ascent, NPO, RMU, and model-editing approaches (arXiv:2503.01854). Evaluation benchmarks include TOFU (forgetting fictitious people), WMDP (biological and cyber risk knowledge), and RWKU (real-world individuals).
The problem is verification. The same survey concludes that no method achieves complete forgetting and complete utility at once. A survey focused on verification (arXiv:2506.15115) finds cryptographic-grade deletion guarantees effectively absent. The practical best available today is running behavioral, adversarial, and parametric verification together and keeping an audit log.
Composing them
Putting the four side by side makes the selection criteria clear.
| Technology | Stage protected | Trust assumption | Overhead | Form of guarantee |
|---|---|---|---|---|
| Differential privacy | Training | Mathematical (statistical) | Higher training cost, utility loss | (ε, δ) proof |
| Homomorphic encryption / MPC | Inference | Cryptographic (LWE and similar) | 100-1000x plaintext | Mathematical |
| Trusted execution environment | Inference | Vendor plus attestation chain | 4-7% throughput reduction | Attestation evidence |
| Machine unlearning | After deployment | Varies by method | Retraining or editing cost | Verification unsettled |
The table shows the protected stages do not overlap. Training data extraction is handled by DP, inference exposure by a TEE or homomorphic encryption, and post-hoc deletion requests by unlearning. Cover one stage and the rest stay wide open.
In production the usual arrangement is a TEE as the baseline, with the most sensitive one-off computations reinforced by homomorphic encryption or MPC. The IACR ePrint 2026/105 survey recommends the same direction, a path that reduces trust incrementally. That path is TEE-based operation now, cryptographic reinforcement next, and homomorphic encryption in the long run. Adding DP at the training stage and unlearning plus guardrails for deletion requests closes the remaining gaps stage by stage.
Summary
Differential privacy, homomorphic encryption, trusted execution environments, and machine unlearning address the same privacy threats at different stages. Those stages are training, inference, and after deployment. Where each one places its trust differs as well.
DP and homomorphic encryption trust mathematical assumptions. A TEE trusts the hardware vendor and the attestation chain, and unlearning trusts verification procedures that are not yet established. A common trade-off runs through all of them: the stronger the guarantee, the higher the cost, and the lower the cost, the wider the trust surface.
No single technology finishes privacy on its own, so layering different technologies stage by stage is the realistic answer. As an operational baseline, put a TEE in front of inference, DP in the training stage, and unlearning plus guardrails behind deletion requests. On top of that, reinforce only the most sensitive computations with encrypted inference.