Compare privacy technologies after defining the protected data, attacker access, and trusted components.
Limiting a sample's influence on a trained model differs from hiding inference inputs from a server. Deleting stored data also differs from removing its influence on a model.
This post uses established research on differential privacy, encrypted inference, and machine unlearning to explain their scope. Measurements from different models and hardware are not combined into an LLM performance comparison.
Protected objects and trust assumptions
| Approach | Main protection target | Assumption to check |
|---|---|---|
| Differential privacy | The influence of data inclusion on released results | Neighboring-dataset definition and privacy budget |
| Encrypted inference | Inputs and other protected values used in computation | Protocol adversary model, cryptographic assumptions, and leakage |
| Trusted execution environment | Data processed inside an isolated region | Hardware, firmware, verified code, and input/output paths |
| Machine unlearning | The influence of training data on a model | Removal objective, reference model, and evaluation method |
A trusted execution environment is a hardware-isolation design category. This post makes no product-specific security or LLM-overhead claim. Deployment requires checking the hardware's official threat model and the actual configuration.
Differential privacy guarantees
In Dwork and Roth's treatment, differential privacy bounds output distributions on neighboring datasets. The protection unit depends on whether neighboring datasets differ by one record or one user's entire contribution.
Here, D and D′ are neighboring datasets under the chosen definition, and S is an output event. The parameters ε and δ specify the guarantee. This definition does not mean that personal information can never appear in an output.
Abadi and colleagues' CCS 2016 study describes training with clipped per-example gradients, added noise, and privacy accounting. The budget must match the actual procedure, including sampling and training duration.
| Check | Reason |
|---|---|
| Protection unit | Record protection does not automatically protect an entire user's contribution |
| Accounting | Repeated training and data access affect the composed guarantee |
| Utility | Noise and training settings affect task performance |
| Scope | Raw data stores and service credentials require separate controls |
Scope of encrypted inference
GAZELLE, published at USENIX Security 2018, combines homomorphic encryption with secure two-party computation for neural-network inference. Its image-classification experiments demonstrate a construction for encrypted inference. Their latency cannot be applied directly to large language models.
Protected computation still releases the outputs and metadata permitted by its protocol. Client storage and use of the result form a separate boundary.
flowchart LR
C[Client input] --> P[Protection protocol]
P --> S[Server computation]
S --> O[Permitted output]
O --> R[Client result handling]This diagram illustrates the protocol boundary. It implements neither a specific LLM deployment nor GAZELLE's complete message sequence.
Evidence of unlearning and deletion
Bourtoule and colleagues' IEEE S&P 2021 study uses SISA training to isolate data influence and reduce the necessary retraining. The method requires training with that structure. It is not a general command for instantly deleting knowledge from an arbitrary existing LLM.
Files, vector indexes, caches, and model weights are different removal targets. A model's refusal to answer a deletion-related query does not establish removal from all these targets.
| Target | Evidence to check |
|---|---|
| Originals and replicas | Deletion or retention-expiry records for each location |
| Retrieval indexes and caches | Absence of retrieval or reuse of removed material |
| Training results | Evaluation against the defined removal objective and reference model |
| Service outputs | Remaining exposure and legitimate task performance under actual generation conditions |
This table organizes operational checks. No cited paper guarantees that satisfying it fulfills every legal obligation.
Summary
Differential privacy bounds output-distribution differences for a defined change in data inclusion. Encrypted inference addresses exposure during computation under the protocol's trust assumptions. Unlearning concerns model influence and differs from deleting stored data. Each technology needs evaluation of its protection unit, remaining assumptions, and actual task performance.