Elamur Research⌕
☰
home / papers / 2026 / SharedRequest: Privacy-Preserving Model-Agnostic Inference for Large Language Models

SharedRequest: Privacy-Preserving Model-Agnostic Inference for Large Language Models

Paper · 2026 · Peihua Mai, Xuanrong Gao, Youlong Ding et al.

Summary

Cloud-hosted LLMs such as ChatGPT receive user prompts that may contain confidential details. Existing protections each have a drawback: SMPC adds heavy cryptographic overhead, local differential privacy injects noise that degrades generation quality, and many approaches require changing the model itself.

SharedRequest moves privacy protection from individual prompts to whole batches. Each prompt is split into a generic instruction and its private attributes. A separate noise sampler then groups requests that share the same instruction, adds decoy attribute values drawn from plausible alternatives, and sends a shuffled mix to the provider. Many users issue similar instructions within short time windows, so the cost of the decoys is spread across the group. A lightweight multi-party encryption protocol hides attributes from the sampler and keeps users anonymous to the provider. It needs no access to model weights and no architectural changes. Privacy is formalised as (A_n, ϵ)-indistinguishability.

On three privacy-sensitive benchmarks, the method beats model-agnostic LDP baselines by over 20% in utility and lowers query cost substantially. This makes private use of black-box commercial LLMs more practical.

Key points

  • Three-party design (users, noise sampler, service provider) works with any LLM. Its security relies on the sampler and provider not colluding; a multi-sampler extension raises this threshold.
  • Utility exceeds DP-based baselines (e.g., RanText, CusText, DP-Prompt) by more than 20%, with only minor loss relative to non-private inference.
  • With request popularity simulated by a Dirichlet distribution, cost savings grow as requests concentrate. At β = 0.05, cost drops up to 5.6× versus non-batched inference; the abstract rounds this to 5×.
  • Attribute-combination filtering on MMLU-Biz uses Qwen2.5-0.5B and Qwen2.5-1.5B discriminators. At sample ratio α ≤ 20 it takes under 2.1 s and 6.2 s respectively, and prompt simplification cuts runtime by about 40.8%.
  • Code is released at github.com/NusIoraPrivacy/SharedRequest.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓National University of SingaporeSingapore · Singapore180 works · 34,304 citations🎓Hebrew University of JerusalemJerusalem · Israel65 works · 9,387 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksSocial Sciences · 1,772 worksSociology and Political Science · 577 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Peihua Mai, Xuanrong Gao, Youlong Ding, Xianglong Du, Wei Liu and Yan Pang. 2026. SharedRequest: Privacy-Preserving Model-Agnostic Inference for Large Language Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.323

@inproceedings{mai2026sharedrequest,
  title = {{SharedRequest: Privacy-Preserving Model-Agnostic Inference for Large Language Models}},
  author = {Peihua Mai, Xuanrong Gao, Youlong Ding, Xianglong Du, Wei Liu and Yan Pang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.323},
  url = {https://doi.org/10.18653/v1/2026.acl-long.323}
}

References

53 references, 9 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Christoph Busch. 2019. Implementing personalized law. The University of Chicago Law Review, 86(2):309– 332. find
  2. Yinqi Cai, Jichang Li, Zhaolun Li, Weikai Chen, Rushi Lan, Xi Xie, Xiaonan Luo, and Guanbin Li. 2025. Deepshield: Fortifying deepfake video detection with local and global forgery analysis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 12524–12534. find
  3. Junying Chen, Zhenyang Cai, Ke Ji, Xidong Wang, Wanlong Liu, Rongsheng Wang, Jianye Hou, and Benyou Wang. 2024. Huatuogpt-o1, towards medical complex reasoning with llms. Preprint, arXiv:2412.18925. find
  4. Ruibo Chen, Jiacheng Pan, Heng Huang, and Zhenheng Yang. 2025a. Improving text-to-image generation with input-side inference-time scaling. arXiv preprint arXiv:2510.12041. — [arXiv:2510.12041](https://arxiv.org/abs/2510.12041) find
  5. Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. 2025b. De-mark: Watermark removal in large language models. In International Conference on Machine Learning, pages 9316–9333. PMLR. find
  6. Sai Chen, Fengran Mo, Yanhao Wang, Cen Chen, Jian-Yun Nie, Chengyu Wang, and Jamie Cui. 2023. A customized text sanitization mechanism with differential privacy. In Findings of the Association for Computational Linguistics: ACL 2023, pages 5747– 5758. find
  7. Henry Corrigan-Gibbs and Dan Boneh. 2017. Prio: Private, robust, and scalable computation of aggregate statistics. In 14th USENIX symposium on networked systems design and implementation (NSDI 17), pages 259–282. find
  8. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, and 1 others. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276.
  9. Jonathan Katz. 2010. Digital signatures, volume 1. Springer. find
  10. Ravneet Kaur and Amandeep Kaur. 2012. Digital signature. In 2012 International Conference on Computing Sciences, pages 295–301. IEEE. find
  11. Brenna Kelly and Luke Harsel. 2025. Investigating chatgpt search: Insights from 80 million clickstream records. find
  12. Tomasz J Kozubowski and Krzysztof Podgórski. 2000. A multivariate and asymmetric generalization of laplace distribution. Computational Statistics, 15(4):531–540. find
  13. Minxin Du, Xiang Yue, Sherman SM Chow, Tianhao Wang, Chenyu Huang, and Huan Sun. 2023. Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass. arXiv preprint arXiv:2309.06746. — [arXiv:2309.06746](https://arxiv.org/abs/2309.06746) find
  14. Dacheng Li, Hongyi Wang, Rulin Shao, Han Guo, Eric Xing, and Hao Zhang. 2023. Mpcformer: Fast, performant and private transformer inference with mpc. In The Eleventh International Conference on Learning Representations. find
  15. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783.
  16. Jichang Li, Guanbin Li, Hui Cheng, Zicheng Liao, and Yizhou Yu. 2024. Feddiv: Collaborative noise filtering for federated learning with noisy labels. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 3118–3126. find
  17. Cynthia Dwork. 2006. Differential privacy. In International colloquium on automata, languages, and programming, pages 1–12. Springer. dzunggg. 2023. legal-qa-v1: A collection of legal q&a pairs. Hugging Face Dataset. https://huggingface.co/datasets/dzunggg/ legal-qa-v1. ↗
  18. Maud Ehrmann, Ahmed Hamdi, Elvys Linhares Pontes, Matteo Romanello, and Antoine Doucet. 2023. Named entity recognition and classification in historical documents: A survey. ACM Computing Surveys, 56(2):1–47. find
  19. Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, and 1 others. 1996. A density-based algorithm for discovering clusters in large spatial databases with noise. In kdd, volume 96, pages 226–231. find
  20. Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. 2022. Iron: Private inference on transformers. Advances in Neural Information Processing Systems, 35:15718–15731. find
  21. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR).
  22. Zhaolun Li, Jichang Li, Yinqi Cai, Junye Chen, Xiaonan Luo, Guanbin Li, and Rushi Lan. 2025. Fak-eradar: Probing forgery outliers to detect unknown deepfake videos. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 13382–13392. find
  23. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692.
  24. Ilya Loshchilov and Frank Hutter. 2019. Decoupled weight decay regularization. In ICLR (Poster). find
  25. Jinglong Luo, Yehong Zhang, Zhuo Zhang, Jiaqi Zhang, Xin Mu, Hui Wang, Yue Yu, and Zenglin Xu. 2024. Secformer: Fast and accurate privacy-preserving inference for transformer models via smpc. In Findings of the Association for Computational Linguistics ACL 2024, pages 13333–13348. find
  26. Lingjuan Lyu, Xuanli He, and Yitong Li. 2020a. Differentially private representation for nlp: Formal guarantee and an empirical study on privacy and fairness. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 2355–2365. find
  27. Lingjuan Lyu, Yitong Li, Xuanli He, and Tong Xiao. 2020b. Towards differentially private text representations. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1813–1816. find
  28. Peihua Mai, Ran Yan, Zhe Huang, Youjia Yang, and Yan Pang. 2024. Split-and-denoise: Protect large language model inference with local differential privacy. In International Conference on Machine Learning, pages 34281–34302. PMLR. find
  29. Justus Mattern, Benjamin Weggenmann, and Florian Kerschbaum. 2022. The limits of word level differential privacy. In Findings of the Association for Computational Linguistics: NAACL 2022, pages 867– 881. find
  30. Payman Mohassel and Yupeng Zhang. 2017. Secureml: A system for scalable privacy-preserving machine learning. In 2017 IEEE symposium on security and privacy (SP), pages 19–38. IEEE. find
  31. OpenAI. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  32. Harshvardhan J Pandit, Beatriz Esteves, Georg Philip Krog, Paul Ryan, Delaram Golpayegani, and Julian Flake. 2024. Data privacy vocabulary (dpv)-version 2.0. In ISWC (3). find
  33. Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. 2024. Bolt: Privacy-preserving, accurate and efficient inference for transformers. In 2024 IEEE Symposium on Security and Privacy (SP), pages 4753–4771. IEEE. find
  34. Dan Pelleg and Andrew Moore. 1999. Accelerating exact k-means algorithms with geometric reasoning. In Proceedings of the fifth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 277–281. find
  35. Qwen, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, and 24 others. 2025. Qwen2.5 technical report. arXiv preprint arXiv:24… find
  36. Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), page 3982. Associ…
  37. Ronald L Rivest, Adi Shamir, and Leonard Adleman. 1978. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2):120–126. find
  38. Yu Rozanov. 2012. Probability theory, random processes and mathematical statistics, volume 344. Springer Science & Business Media. find
  39. Shubham Singh. 2025. Chatgpt statistics 2025. find
  40. Baris Sumengen, Anand Rajagopalan, Gui Citovsky, David Simcha, Olivier Bachem, Pradipta Mitra, Sam Blasiak, Mason Liang, and Sanjiv Kumar. 2021. Scaling hierarchical agglomerative clustering to billion-sized datasets. arXiv preprint arXiv:2105.11653. — [arXiv:2105.11653](https://arxiv.org/abs/2105.11653) find
  41. Shun Takagi, Fumiyuki Kato, Yang Cao, and Masatoshi Yoshikawa. 2022. Asymmetric differential privacy. In 2022 IEEE International Conference on Big Data (Big Data), pages 1576–1581. IEEE. find
  42. Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, and 1 others. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805.
  43. Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weiming Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. 2025. Inferdpt: Privacy-preserving inference for black-box large language models. IEEE Transactions on Dependable and Secure Computing. find
  44. Saiteja Utpala, Sara Hooker, and Pin-Yu Chen. 2023. Locally differentially private document generation using zero shot prompting. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 8442–8457. find
  45. Brendan Van Alsenoy, Eleni Kosta, and Jos Dumortier. 2014. Privacy notices versus informational self-determination: Minding the gap. International Review of Law, Computers & Technology, 28(2):185– 203. find
  46. Kaishen Wang, Ruibo Chen, Tong Zheng, and Heng Huang. 2025. Imagent: A unified multimodal agent framework for test-time scalable image generation. arXiv preprint arXiv:2511.11483. — [arXiv:2511.11483](https://arxiv.org/abs/2511.11483) find
  47. Yihan Wu, Ruibo Chen, Georgios Milis, and Heng Huang. 2025. An ensemble framework for unbiased language model watermarking. arXiv preprint arXiv:2509.24043. — [arXiv:2509.24043](https://arxiv.org/abs/2509.24043) find
  48. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  49. Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. 2019. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology (TIST), 10(2):1–19. find
  50. Andrew C Yao. 1982. Protocols for secure computations. In 23rd annual symposium on foundations of computer science (sfcs 1982), pages 160–164. IEEE. find
  51. Xiang Yue, Minxin Du, Tianhao Wang, Yaliang Li, Huan Sun, and Sherman SM Chow. 2021. Differential privacy for text analytics via natural text sanitization. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 3853–3866. Association for Computational Linguistics (ACL). find
  52. Jiawen Zhang, Xinpeng Yang, Lipeng He, Kejia Chen, Wen-jie Lu, Yinghao Wang, Xiaoyang Hou, Jian Liu, Kui Ren, and Xiaohu Yang. 2024. Secure transformer inference made non-interactive. Cryptology ePrint Archive. find
  53. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, and 1 others. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in neural information processing systems, 36:46595–46623.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/mai-2026-sharedrequest-privacy-preserving-model-agnostic/