LLM-CEG: Extending the Classification Error Gauge Framework for Privacy Auditing of Large Language Models Kato Mivule
— Computer Science Dept. Bowie State University —
arXiv:2604.23795v1 [cs.CR] 26 Apr 2026
Abstract
stronger privacy. This principle was validated on tabular datasets using Gaussian, logarithmic, and This paper extends the Classification Error Gauge multiplicative noise perturbation, as well as differ(x-CEG) framework, originally developed for mea- ential privacy with Laplace noise [2]. suring the privacy-utility trade-off in tabular datasets [1], to privacy auditing of Large Language A decade later, this problem has re-emerged in a draModels (LLMs). We propose LLM-CEG, a sys- matically more complex form. Large Language Modtematic framework that employs membership in- els (LLMs) — including GPT-4, Claude, LLaMA, ference attack (MIA) success rates as an empiri- and Gemini — are trained on massive corpora that cal privacy gauge and model perplexity as a utility inevitably contain private, sensitive, or copyrighted gauge, iteratively adjusting differential privacy pa- information. Unlike tabular databases, LLMs do rameters until both thresholds are jointly satisfied. not publish a dataset; they memorize and reproduce A proof-of-concept prototype fine-tunes DistilGPT- training data implicitly through their model param2 on a synthetic clinical PII dataset under four pri- eters, creating a new class of privacy threat in which vacy regimes using DP-SGD. Results indicate that the model itself becomes the attack surface. DP-SGD reduces MIA attacker advantage by 71.5% Two critical risks converge: membership inference while simultaneously improving out-of-distribution attacks (MIA) [5] — techniques that determine utility by 47–50% relative to the overfitted baseline, whether a specific record was part of a model’s trainsuggesting that differential privacy may act as im- ing set — and insufficient differential privacy guarplicit regularization under narrow fine-tuning con- antees during LLM training [3]. Existing privacy auditions. We further extend the SIED engineering diting tools for LLMs are fragmented, lack standardframework [1] to the LLM context as LLM-SIED, ized evaluation metrics, and provide no systematic providing an auditable, regulator-aligned process for engineering process. privacy-compliant LLM deployment. The central question this paper addresses is whether Keywords: Large Language Models; Differential the privacy-utility trade-off in fine-tuned LLMs can Privacy; Membership Inference Attacks; Classifica- be measured, managed, and communicated in a way tion Error Gauge; Privacy-Utility Trade-off; DP- that is actionable for clinicians, regulators, and orSGD; Implicit Regularization; Human-Centric Pri- ganizational decision-makers, not just technical specialists. We argue that it can, and that doing so is vacy; LLM Privacy Auditing. essential for building public trust in AI systems that handle sensitive data.
1
Introduction
This work makes four contributions: (1) the LLMCEG framework extending x-CEG to language model privacy auditing via MIA-based empirical gauging; (2) the LLM-SIED engineering process for privacy-compliant LLM deployment aligned with the EU AI Act and NIST AI RMF; (3) a proof-ofconcept prototype with empirical validation on syn-
The original x-CEG framework established a foundational principle: the privacy-utility trade-off in a dataset can be measured empirically by passing privatized data through a machine learning classifier and observing the classification error [1]. A lower error signals better utility; a higher error signals 1
Privacy Failure Probability (δ): A small probability parameter paired with ε in (ε, δ)-DP guarantees. It bounds the likelihood that the privacy guarantee fails catastrophically for any single individual. In practice, δ is set to a very small value (e.g., 10−5 ), meaning the guarantee holds with overwhelmA key preliminary finding of this work is that differing probability across training. ential privacy may challenge the conventional view of privacy and utility as fundamentally in tension. Un- DP-SGD: Differentially Private Stochastic Gradient der narrow fine-tuning conditions — such as small, Descent. The standard algorithm for training marepetitive clinical datasets — initial results indicate chine learning models with differential privacy guarthat DP noise may function as implicit regulariza- antees. It adds carefully calibrated random noise to tion, simultaneously protecting privacy and improv- the model’s learning process at each training step. ing model generalization. Together, LLM-CEG and Gradient Descent: The core optimization algorithm LLM-SIED suggest that protecting sensitive data used to train neural networks. At each training step, and maintaining model utility may be achievable sithe model computes how much each parameter conmultaneously, supporting the development of trusttributed to the prediction error (the gradient) and worthy, human-centric AI systems. adjusts the parameters in the direction that reduces that error. Stochastic Gradient Descent (SGD) performs this update on small random subsets (mini2 Background batches) of the training data rather than the full To ensure accessibility across disciplines — including dataset, making training computationally feasible computer science, social sciences, ethics, and health- for large models. care policy — this section defines the key terms and Implicit Regularization: A phenomenon in which notation used throughout the paper. a training procedure unintentionally constrains a thetic clinical PII data, reproducible on a single CPU machine; and (4) the novel finding that DPSGD acts as implicit regularization, improving outof-distribution utility under narrow fine-tuning conditions.
2.1
model’s complexity beyond what is explicitly specified. In this work, DP-SGD noise appears to function as implicit regularization — analogously to weight decay or dropout — preventing the model from overfitting to a narrow training distribution and thereby preserving generalization to out-of-distribution text. This is a preliminary observation that warrants further investigation and replication.
Glossary of Key Terms
Large Language Model (LLM): An AI system trained on large text corpora to generate, summarize, and reason over natural language.
Personally Identifiable Information (PII): Data that can identify a specific individual, including names, social security numbers, medical diagnoses, and fi- Model Collapse: A failure mode in which a language nancial records. model, after fine-tuning on a narrow or repetitive Differential Privacy (DP): A mathematical frame- dataset, loses the broad language capabilities it acwork providing a quantifiable guarantee of individ- quired during pre-training. The model’s output beual privacy. Intuitively, a DP model behaves almost comes confined to the fine-tuning distribution, proidentically whether or not any single individual’s ducing degraded or repetitive text for inputs outdata was included in training, preventing adversarial side that domain. In this work, the baseline model (trained without DP) exhibits signs of collapse, with inference about any specific person. perplexity on general text rising to 179.91 compared Privacy Budget (ε, epsilon): The numerical paramto 119–122 for DP-trained variants. eter controlling the degree of privacy protection. A smaller ε means stronger privacy — more noise is Opacus Library: An open-source PyTorch library added, making individual records harder to infer. A developed by Meta that implements DP-SGD for larger ε means weaker privacy but typically better training neural networks with differential privacy. Opacus handles the per-sample gradient computamodel utility. 2
tion, gradient clipping, and noise injection required by DP-SGD, and automatically computes the privacy cost (ε, δ) for a given training configuration using the Renyi Differential Privacy accountant.
free measure of classifier performance. An AUROC of 0.5 means random guessing (no privacy leakage); an AUROC near 1.0 means near-perfect attack success.
Renyi Differential Privacy (RDP) Accountant: A mathematical tool for tracking the cumulative privacy cost across all steps of DP-SGD training. Rather than naively summing per-step privacy costs — which would produce overly conservative bounds — the RDP accountant uses the Renyi divergence to compute tighter privacy guarantees. The result is a more accurate final (ε, δ) budget that reflects the true privacy expenditure of the full training run.
NIST AI RMF: The National Institute of Standards and Technology AI Risk Management Framework — U.S. guidance for managing AI risks, including privacy and trustworthiness. EU AI Act: The European Union’s 2024 regulation governing AI development and deployment, including requirements for transparency, documentation, and data protection. x-CEG: Classification Error Gauge — the privacyutility measurement framework proposed in [1] for tabular data, extended here to LLMs as LLM-CEG.
Pareto Analysis; Pareto Curve: A method for evaluating trade-offs between two competing objectives. In LLM-CEG, the two objectives are privacy (measured by MIA attacker advantage) and utility (measured by perplexity). A Pareto curve plots model configurations in this two-dimensional space; a configuration is Pareto-optimal if no other configuration achieves better privacy without sacrificing utility, or better utility without sacrificing privacy. The Pareto curve makes the privacy-utility frontier empirically visible and navigable for practitioners.
AdamW Optimizer: A variant of the Adam optimization algorithm that incorporates weight decay (L2 regularization) directly into the parameter update step. AdamW is widely used for finetuning transformer-based language models because it adapts the learning rate per parameter and prevents weights from growing unboundedly, improving generalization.
Membership Inference Attack (MIA): An adversarial technique used to determine whether a specific data record was part of a model’s training set. High MIA accuracy indicates memorization and privacy leakage; an MIA success rate near 50% (random guessing) indicates strong empirical privacy protection.
2.2
Differential Privacy: Language Formulation
A
Plain-
Differential privacy works by adding controlled random noise to a computation so that no single individual’s record has a distinguishable effect on the output. For a query function f (x), where x repreAttacker Advantage: The excess accuracy an atsents a dataset, the Laplace mechanism produces a tacker achieves above random guessing (50%). An privatized output as: advantage of 0.35 means the attacker is 35 percent age points better than chance, indicating significant ∆f memorization and privacy leakage. M(x) = f (x) + Lap 0, (1) ε Perplexity (PPL): A standard measure of language model performance. Lower perplexity means better where M(x) is the privatized output published to language understanding and is used here as the util- the world; f (x) is the true result of the query on the data (for example, the average salary in a database); ity metric. Lap(0, ∆f /ε) is random noise drawn from a Laplace SIED Framework: Specifications, Implementation, distribution centered at zero; ∆f is the sensitivity of Evaluation, Dissemination — a systematic engineerthe query — how much a single individual’s record ing process for data privacy originally proposed in [1] can change the result (for example, if the highestfor tabular data, extended here to LLMs as LLMearning person in a dataset earns $1 billion per SIED. month and the lowest earns $12 per hour, the sensiAUROC: Area Under the ROC Curve. A threshold- tivity spans this entire range); and ε is the privacy 3
budget, where smaller values produce more noise and stronger protection.
1. Proprietary data (untouched)
?
In practice, the larger the gap between the most and least influential record, the more noise must be added to achieve the same level of privacy. This is why enterprise datasets with extreme outliers require careful ε calibration.
2. Tokenize & embed (still clean)
? 3. Compute per-sample gradients
? PRIVACY WALL (DP-SGD)
2.3
DP-SGD: Training LLMs with Privacy
4a. Clip each gradient to norm C 4b. Add noise N (0, σ 2 C 2 I)
For training LLMs, we apply DP-SGD [3], which applies differential privacy at each step of model training. At step t, the algorithm produces a privatized gradient update:
? 5. Privatized gradient g̃t
? 6. Update model weights
1 g̃t = |Bt |
X i∈Bt
gt,i max(1, ∥gt,i ∥2 /C)
!
? 2
2
+ N 0, σ C I
7. Released LLM (DP-guaranteed)
Figure 1: The DP-SGD privacy wall. Raw data and
(2) embeddings pass through unmodified; noise is injected where g̃t is the privatized gradient used to update only at the gradient stage (steps 4a–4b), between learning the model; Bt is the mini-batch of training records and the model weights. The RDP accountant aggregates at step t; gt,i is the gradient for individual record the per-step privacy cost into the final (ε, δ) guarantee reported for the released model. i; C is the clipping norm, which limits how much any single training example can influence the model signals and the model weights that are ultimately update, preventing any one record from dominating released. learning; σ is the noise multiplier, controlling how much Gaussian noise N is added; and I is the identity matrix. In our experiments, σ is automatically 3 Theoretical Foundation set by the Opacus library to achieve the target privacy budget ε over the full training run, with the 3.1 Bridging x-CEG and LLM Privacy privacy cost tracked using the Renyi Differential Pri- The original x-CEG logic maps directly onto the vacy (RDP) accountant [3], which provides tighter LLM context. Table 1 establishes the formal corprivacy bounds than basic composition by accumu- respondence. lating the privacy cost step by step across training. Table 1: Correspondence between x-CEG (tabular) and
In plain terms: at every training step, DP-SGD lim- LLM-CEG its how much any single patient record can influence Original x-CEG the model’s learning, then adds calibrated noise to (Tabular) further obscure individual contributions. The result Original dataset X is a model that has learned from the population of Privacy procedure records without memorizing any individual’s data. Figure 1 shows where in the training pipeline this noise is actually applied. The proprietary dataset itself is never modified; DP-SGD operates strictly on the gradients computed from each mini-batch, forming an “Opacus privacy wall” between raw learning
Privatized dataset Y ML classifier Classification error Utility threshold
4
LLM-CEG Models)
(Language
Pre-training corpus DP-SGD; perturbation; unlearning Trained LLM weights Membership inference attack MIA attacker advantage Perplexity; task accuracy
ing formal guarantees with empirical MIA evaluation rather than relying on ε alone.
In x-CEG, a high classification error on privatized data signals strong privacy but low utility. In LLMCEG, a high MIA success rate signals weak privacy. The gauge is inverted — but the feedback loop logic is identical: adjust ε iteratively until an acceptable MIA success rate is achieved without sacrificing model utility.
Hanke et al. [13] demonstrate that closed-LLM private adaptation methods leak query or training data to the provider, implicitly validating LLM-CEG’s design choice of local open-model fine-tuning.
4.3
4
Literature Review
4.1
Scope and Organization
Chen et al. [14] demonstrate that DP-SGD-trained models exhibit sharper loss minima correlating with residual MIA vulnerability. LLM-CEG’s implicit regularization finding — that DP noise flattens overfitting — may share a mechanistic relationship with this loss-landscape perspective.
The intersection of differential privacy and LLMs has become one of the most active areas in AI safety research during 2022–2026. This review is selective rather than exhaustive, focusing on highly cited or methodologically significant works that directly inform LLM-CEG. It is not intended as a comprehensive survey but as a contextual positioning of our contributions within the recent literature. Five themes are surveyed: DP fine-tuning, MIA research, privacy-utility trade-offs, human-centric privacy, and LLM governance.
4.2
Membership Inference Attack Research
Li et al. [15] survey LLM privacy attacks, identifying MIA as the most consistently demonstrable attack class and noting that strong DP guarantees tend to impose steep utility penalties — a tension that preliminary results from LLM-CEG suggest may be empirically resolvable under narrow fine-tuning conditions, though further replication across larger models and datasets is needed to confirm this finding.
DP Techniques for LLM Fine-Tuning
4.4
Behnia et al. [9] introduce EW-Tune, using an Edgeworth accountant for tighter per-iteration DP-SGD bounds, achieving up to 1.1% utility improvement. Their finding that tighter accounting yields utility gains resonates with LLM-CEG’s implicit regularization observation.
Privacy-Utility Trade-Offs
Sun et al. [16] benchmark three privacy algorithms across Mistral-7B, LLaMA2-7B, and Falcon7B, finding no dominant configuration across settings. LLM-CEG’s finding that DP improves outof-distribution utility is an observation their benchAlghamdi [10] proposes PrivLLM-Guard, an adap- mark is not designed to capture. tive DP framework for clinical LLMs with hierarYe and Luo [17] report that privacy-preserving chical ε allocation per medical data category. It is prompt transformations improve task performance the most directly adjacent prior work to LLM-CEG in some settings — structurally analogous to LLMin the clinical domain, but does not report MIACEG’s implicit regularization finding via a different based empirical privacy evaluation — a gap LLMmechanism, suggesting this effect may be more genCEG fills. eral than previously recognized. Higashi and Nakai [11] evaluate DP-enhanced LoRA (parameter-efficient fine-tuning) and find that ε 4.5 Human-Centric Privacy Frameworks changes produce minimal impact on MIA metrics, independently corroborating LLM-CEG’s plateau A growing body of research argues that technically rigorous DP guarantees are insufficient unless they observation across ε ∈ {0.5, 2.0, 8.0}. Wu [12] reveals variance in empirical DP protec- are legible, controllable, and meaningful to the peotion across configurations sharing the same nomi- ple whose data is at stake. nal ε, validating LLM-CEG’s methodology of pair- Li et al. [18] argue that LLM privacy research has 5
been predominantly model-centered. LLM-CEG’s dressed; LLM-CEG’s controllable ε and Pareto curve controllable ε parameter responds to this critique: bridge this gap by making the privacy-utility tradeclinicians and patients should be able to specify ac- off empirically visible and negotiable. ceptable privacy risk rather than accepting system defaults.
5
Proposed Frameworks
5.2
LLM-SIED Framework
Staufer et al. [19] report from a user study of 458 participants that people want control over LLM- 5.1 LLM-CEG Algorithm generated associations, reinforcing the need for frameworks that report both formal ε and empiri- The LLM-CEG algorithm extends x-CEG to language models as a systematic, iterative procedure. cal MIA advantage. Given a base LLM and a training corpus, it conSun, Xu, and Gao [20] propose a Human-Centered verges on a privacy-audited model with a docuPrivacy (HCP) framework integrating technical, eth- mented privacy-utility profile. ical, and regulatory dimensions across the full AI lifecycle. LLM-CEG’s experimental pipeline constitutes Algorithm 1 LLM-CEG: Privacy-Utility Optimizaa technical instantiation of the HCP data-collection tion for LLMs Require: Base LLM M, corpus D, thresholds tp and training stages. (privacy), tu (utility) Taylor, O’Dell, and Murphy [21] ground humanEnsure: Audited model Mε with privacy report centric AI in Ubuntu and maximum feasible partici1: Initialize ε ← ε0 pation, arguing that DP guarantees protect patients 2: repeat mathematically but may not align with community 3: Fine-tune M on D via DP-SGD(ε) → Mε expectations — motivating LLM-SIED’s dissemina4: Run MIA; compute Adv = AccMIA − 0.5 tion phase. 5: if Adv > tp then 6: Decrease ε; return to Step 2 4.6 LLM Governance and Ethics 7: end if 8: Evaluate utility (PPL or task accuracy) Das, Amini, and Wu [22] survey LLM vulnerabili9: if Utility < tu then ties with explicit focus on healthcare as a high-risk 10: Increase ε; document trade-off deployment domain and call for domain-specific pri11: end if vacy guarantees accounting for the sensitivity gra12: until Adv ≤ tp AND Utility ≥ tu dient of healthcare data. LLM-CEG responds by 13: Publish Mε with Privacy Audit Report including diagnoses, medications, salaries, and SSNs as distinct field types in its synthetic dataset.
4.7
Gaps Addressed by LLM-CEG
The SIED framework [1] is updated for LLM deployment as a four-phase engineering process. Phase 1 (Specifications) gathers privacy requirements: target ε, data sensitivity categories, minimum acceptable utility, and deployment mode. Phase 2 (Implementation) applies DP-SGD fine-tuning, data deduplication, and selective filtering. Phase 3 (Evaluation) executes the LLM-CEG algorithm and documents the ε–utility Pareto curve. Phase 4 (Dissemination) releases the model with a Privacy Audit Report documenting (ε, δ), MIA attacker advantage, AUROC, and utility benchmarks, directly addressing documentation requirements under the EU AI Act and
Five gaps in the literature motivate this work. First, no existing framework provides an end-toend clinical PII pipeline combining DP training with MIA evaluation. Second, no multi-ε Pareto analysis exists for causal language models reporting both formal and empirical privacy metrics together. Third, the DP-as-regularizer effect on narrow clinical fine-tuning datasets is previously undocumented. Fourth, no Pareto visualization tool exists for practitioner DP model selection. Fifth, a persistent disconnect between technical DP guarantees and human-centered privacy values remains unad6
that produces realistic but entirely fictitious personal data such as names, addresses, and medical information. To ensure reproducibility, the random 5.3 Experiment Workflow number generator was initialized with a fixed seed Figure 2 provides a simplified view of the end-to-end value of 42; this means any researcher running the LLM-CEG workflow, from data generation through same script will generate an identical dataset, makiterative privacy-utility optimization to LLM-SIED ing the experiment fully replicable without requiring dissemination. access to real patient records. Faker was used to simulate realistic PII in a clinical context without using 1. Generate synthetic PII data real patient data. Each record comprises six fields — Name, Age, Diagnosis, Medication, Salary, and SSN ? — serialized into natural-language sentences of the 2. Fine-tune baseline (no privacy) form: “Patient Jennifer Walsh, aged 34, has been diagnosed with Type 2 Diabetes and is prescribed Met? formin.” A total of 500 records were partitioned 3. Fine-tune with DP-SGD (ε ∈ {8, 2, 0.5}) into a training member set (n = 300) and a held-out non-member set (n = 200), strictly disjoint by con? struction. A separate held-out general corpus of 50 4. Run membership inference attack (MIA) diverse sentences with no clinical content served for utility evaluation. No: adjust ε
NIST AI RMF.
? 5. Measure utility (perplexity)
6.3
Models Trained
?
Table 2: Model configurations and privacy parameters
6. Privacy AND utility thresholds met? Yes
? 7. LLM-SIED: publish with Audit Report Figure 2: Simplified LLM-CEG workflow. Steps 3–6 form the iterative feedback loop: if thresholds are not met, ε is adjusted and training repeats.
Model
Mechanism
ε
δ
Baseline DP ε=8 DP ε=2 DP ε=0.5
Standard SGD DP-SGD (Opacus) DP-SGD (Opacus) DP-SGD (Opacus)
— 8.0 2.0 0.5
— 10−5 10−5 10−5
All models were fine-tuned for 10 epochs, batch size 8, learning rate 5 × 10−5 , AdamW optimizer, per6 Experiments and Results sample gradient clipping with max-grad-norm=1.0. Token and position embeddings were frozen prior 6.1 Experimental Setup to Opacus wrapping to accommodate GPT-2’s tiedAll experiments were conducted on a single weight architecture. consumer-grade CPU machine running macOS −5 25.4.0 with Python 3.13.12, PyTorch 2.10.0, Hugging In Table 2, δ = 10 is the privacy failure probaFace Transformers 5.2.0, and Opacus 1.5.4. The base bility: the small probability that the (ε, δ)-DP guarfails for any individual record. Setting δ to model was DistilGPT-2, a distilled variant of GPT- antee −5 — well below 1/n where n = 300 is the train10 2 with 82 million parameters and six transformer ing set size — is standard practice and ensures the blocks. Code is available upon request. guarantee holds with overwhelming probability. The AdamW optimizer is a variant of the Adam algo6.2 Dataset rithm that incorporates weight decay directly into Synthetic patient records were generated using the the update step, improving generalization during Faker library — an open-source Python package fine-tuning of transformer-based models. 7
6.4
Training Dynamics
Table 5 presents perplexity scores on a held-out general-purpose corpus of 50 diverse sentences with no clinical content. Counter-intuitively, all three DP-trained models substantially outperform the non-private baseline: mean perplexity drops from 179.91 (baseline) to the 119–122 range across all DP configurations, corresponding to normalized utility scores of 147.5–150.4% relative to baseline. This indicates that DP-trained models retain significantly better general language ability than the baseline model, which overfitted to the narrow clinical training distribution. The utility scores are nearly identical across the three ε values, reinforcing the earlier MIA finding that privacy strength has minimal impact on model quality once DP is applied.
Table 3: Training loss per epoch (selected epochs)
Epoch
Baseline
DP ε=8
DP ε=2
DP ε=0.5
1 2 4 6 8 10
0.9994 0.2884 0.1898 0.1650 0.1585 0.1514
8.8148 7.8330 5.6373 3.5292 1.8358 1.0416
9.0557 8.3819 7.0787 5.8086 4.1974 2.7881
9.1514 8.7911 8.1683 7.5064 6.8003 6.0840
The baseline converged rapidly to 0.1514, indicating near-complete memorization. DP models, with noise multipliers 0.6927, 1.3232, and 3.9062 for ε ∈ {8, 2, 0.5} respectively, show systematically attenuated convergence proportional to the injected noise.
6.7 6.5
Membership Inference Attack Results Counter-intuitively, all three DP models achieve lower perplexity on out-of-distribution general text than the baseline, yielding utility scores of 147.5– 150.4%. The mechanism is as follows: the baseline model rapidly overfitted the narrow, repetitive distribution of 300 short patient-record sentences, degrading its general language ability (perplexity 179.91). DP noise, functioning analogously to weight decay or dropout [7,8], prevented the model from collapsing entirely onto the training distribution, preserving the broader representational knowledge inherited from the pre-trained DistilGPT-2 checkpoint (perplexity 119–122 on general text).
Table 4: Loss-based MIA results across all models Model
Loss Gap
MIA Acc.
Advantage
AUROC
Baseline DP ε=8 DP ε=2 DP ε=0.5
0.2995 0.0330 0.0328 0.0321
85.8% 60.2% 60.4% 60.6%
0.358 0.102 0.104 0.106
0.876 0.515 0.516 0.513
The baseline is severely vulnerable: an attacker achieves 85.8% MIA accuracy with AUROC of 0.876, exploiting a loss gap of 0.2995 nats between members and non-members. All three DP variants collapse the loss gap by approximately 9× and reduce AUROC to near 0.514 — barely above the 0.5 randomchance floor. Notably, all three DP models yield nearly identical attack performance despite a 16-fold range in ε (0.5 to 8.0), suggesting that once DP is applied at any of these levels, the memorization signal is suppressed below the attack’s detection threshold.
6.6
Novel Finding: DP as Implicit Regularization
This finding extends prior observations by Ye and Luo [17] and aligns with theoretical generalization bounds linking DP to uniform stability [7, 8]. Its practical message is direct: protecting privacy and maintaining model utility are not necessarily in conflict. Under conditions of narrow fine-tuning data — common in clinical, legal, and enterprise settings — differential privacy can simultaneously improve both.
Utility Evaluation
Table 5: Perplexity and normalized utility scores Model Baseline DP ε=8 DP ε=2 DP ε=0.5
Mean PPL
Utility Score
179.91 119.63 121.27 121.97
100.0% 150.4% 148.3% 147.5%
6.8
Privacy-Utility Pareto Analysis
Figure 3 captures the central message of this paper. The crossing of the two lines — privacy improving while utility simultaneously increases at the Baseline-to-DP transition — is the empirical signa8
50% above the baseline. Taken together, these results indicate that DP training simultaneously reduces privacy leakage and improves generalization, with the ε=8 configuration representing the Paretooptimal operating point: it achieves the same empirical privacy protection as the strictest setting while preserving the highest utility.
Figure 3: LLM-CEG Privacy-Utility Pareto Curve. Red line (left axis): MIA attacker advantage (lower is more private). Blue line (right axis): normalized utility score (higher is better). Green region: LLM-CEG acceptable operating zone (advantage ≤ 0.10). All three DP models satisfy the privacy threshold while exceeding the 100% utility baseline. DP ε=8 is the Pareto-optimal configuration.
7
Discussion
7.1
LLM-CEG Validation
The results validate the core LLM-CEG hypothesis: controllable ε guarantees embedded into LLM finetuning pipelines can simultaneously reduce empirical privacy risk and improve model utility. The framework’s iterative feedback loop converges to a welldefined Pareto-optimal operating point, providing ture of differential privacy acting as implicit regu- practitioners with a concrete, reproducible method larization. All three DP models land squarely in the for selecting a deployment configuration rather than green acceptable zone. The Pareto-optimal config- relying on formal ε values alone. uration is DP ε=8: it achieves the same empirical privacy protection as the strongest setting (ε=0.5) 7.2 Human-Centric Implications and while preserving the highest utility.
Trust
6.9
Full Results Summary
The human-centric privacy literature [18,19,21] consistently argues that mathematical DP guarantees must be legible and controllable to the people whose data is at stake, not only to technical specialists. LLM-CEG’s Pareto curve provides exactly this: a visual instrument that translates abstract ε values into empirically measured consequences that a clinician, CISO, patient advocate, or regulator can interpret and act on.
Table 6: Complete results across all models Model
Loss
Advantage
AUROC
PPL
Utility
Baseline DP ε=8 DP ε=2 DP ε=0.5
0.1514 1.0416 2.7881 6.0840
0.358 0.102 0.104 0.106
0.876 0.515 0.516 0.513
179.91 119.63 121.27 121.97
100.0% 150.4% 148.3% 147.5%
Table 6 consolidates all evaluation metrics across the four model configurations. Reading across the columns, the non-private baseline achieves a very low training loss (0.1514) — indicative of near-complete memorization — but correspondingly high MIA vulnerability (advantage 0.358, AUROC 0.876) and poor general-text perplexity (179.91). The three DP variants present a markedly different profile: training loss is higher (reflecting the noise-induced learning constraint), yet MIA attacker advantage collapses to 0.102–0.106 and AUROC drops to approximately 0.513–0.516, barely above the 0.5 randomchance floor. Crucially, perplexity improves to 119– 122 across all DP models, yielding utility scores 47–
The finding that ε=8.0 provides essentially identical empirical protection to ε=0.5 while preserving 50% more model utility is an actionable insight that purely formal DP reporting cannot provide. This has direct implications for AI adoption strategy: when organizational stakeholders can see that privacy protection is strong, measurable, and does not come at the cost of system usefulness, the barrier to deploying privacy-preserving AI is substantially lowered. Trust is not built through mathematical proofs alone — it is built through transparency, empirical evidence, and tools that make risk visible and negotiable. 9
7.3
References
Limitations and Future Work
LLM-CEG is a heuristic gauge, not a formal proof of privacy; MIA success rates are empirical upper bounds, not tight theoretical guarantees. The current prototype uses DistilGPT-2 on 500 synthetic records. Future work includes scaling to larger models on real clinical data; integrating LoRA-based parameter-efficient fine-tuning with DP [11]; incorporating the loss-landscape perspective of Chen et al. [14]; and developing the participatory governance frameworks called for by Taylor et al. [21] to ensure LLM-SIED’s dissemination phase aligns with community-level expectations of medical data stewardship.
8
Conclusion
This paper presented LLM-CEG, a systematic framework extending a decade of data privacy research to the most consequential AI privacy challenge of the current era: language model memorization of sensitive training data. On a single consumergrade CPU machine, we demonstrated that DPSGD reduces MIA attacker advantage by 71.5% while simultaneously improving out-of-distribution utility by 47–50%, establishing that the privacyutility trade-off in fine-tuned LLMs is not always zero-sum under narrow fine-tuning conditions.
[1] K. Mivule, “An investigation of data privacy and utility using machine learning as a gauge,” Doctoral Dissertation, Bowie State University, ProQuest UMI 3619387, 2014. [2] K. Mivule, “Utilizing noise addition for data privacy, an overview,” arXiv:1309.3958, 2013. [3] M. Abadi et al., “Deep learning with differential privacy,” Proc. ACM CCS, pp. 308–318, 2016. [4] C. Dwork, “Differential privacy,” in Proc. ICALP, Springer, pp. 1–12, 2006. [5] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” Proc. IEEE S&P, pp. 3–18, 2017. [6] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” Proc. IEEE CSF, pp. 268–282, 2018. [7] R. Bassily, A. Smith, and A. Thakurta, “Private empirical risk minimization,” J. ACM, vol. 63, no. 6, pp. 1–40, 2016. [8] V. Feldman and T. Steinke, “Private stochastic convex optimization: Optimal rates in ℓ1 geometry,” Proc. ICML, pp. 3089–3098, 2020. [9] R. Behnia, M. R. Ebrahimi, J. Pacheco, and B. Padmanabhan, “EW-Tune: A framework for privately fine-tuning large language models with differential privacy,” Proc. IEEE ICDMW, 2022.
The literature review identified five specific gaps the framework addresses, including the first end-to-end clinical PII pipeline combining DP training with MIA evaluation, and the novel finding that differen[10] W. Alghamdi, “PrivLLM-Guard: An adaptive tial privacy can act as implicit regularization. The differential privacy framework for clinical large LLM-SIED engineering process provides organizalanguage models,” Scientific Reports, 2026. tions with a repeatable, auditable path to privacycompliant LLM deployment aligned with the EU AI [11] T. Higashi and T. Nakai, “Enhancing large language model privacy with differentially private Act and the NIST AI RMF. parameter-efficient fine-tuning,” LM-SHIELD The broader message is one of possibility: protecting Workshop, 2025. sensitive data and building useful, trustworthy AI systems are not mutually exclusive goals. With sys- [12] F. Wu, “Differential privacy in the era of largescale generative AI,” Ph.D. Dissertation, Univ. tematic frameworks like LLM-CEG and LLM-SIED, of Illinois Urbana-Champaign, 2025. organizations can demonstrate measurable privacy protection, communicate risk transparently to all [13] F. Hanke et al., “Leveraging open LLMs for private adaptation without exposing data,” Proc. stakeholders, and build the foundation of trust that NeurIPS, 2024. responsible AI adoption requires. 10
[14] Y. Chen et al., “Privacy-Flat: Towards flatter loss landscape for privacy-preserving large language models,” Proc. SIAM SDM, 2025. [15] H. Li et al., “Privacy in large language models: Attacks, defenses, and future directions,” arXiv:2310.10383, 2023. [16] X. Sun, B. Suleiman, A. Ullah, and I. Razzak, “Privacy-Preserving4LLM: A benchmark for privacy-preserving techniques in large language model training,” Proc. ACM WWW, 2025. [17] H. Ye and P. Luo, “Large language models are privacy-erasable,” Proc. EMNLP, 2025. [18] T. Li et al., “Towards a human-centered LLM privacy research agenda,” CHI Extended Abstracts, 2024. [19] L. Staufer, M. Morehouse, J. Hartmann, and B. Berendt, “Human-centred privacy audits for large language models,” CHI HEAL Workshop, 2026. [20] Y. Sun, J. Xu, and H. Gao, “Human-centered privacy framework for AI systems,” Springer Handbook of AI Ethics, 2026. [21] M. Taylor, R. O’Dell, and S. Murphy, “Humancentric AI: Philosophical foundations,” AI & Society, 2024. [22] S. Das, M. H. Amini, and Y. Wu, “Security and privacy challenges of large language models,” ACM Computing Surveys, 2025. [23] N. Grislain, “DP-RAG: Applying differential privacy to retrieval-augmented generation,” Proc. IEEE CAI, 2025. [24] N. Carlini et al., “Extracting training data from large language models,” Proc. USENIX Security, pp. 2633–2650, 2021. [25] European Parliament, “EU Artificial Intelligence Act,” Regulation (EU) 2024/1689, 2024. [26] NIST, “AI Risk Management Framework,” NIST AI 100-1, 2023.
11