Improving User Privacy in Personalized Generation: Client-Side Retrieval-Augmented Modification of Server-Side Generated Speculations

AI summary

Overview

Research area: Privacy-preserving personalization of large language models / retrieval-augmented generation (NLP + information retrieval). Technical level: Intermediate. Scope: The paper introduces P³, a client–server interactive generation framework that personalizes a large server-side LLM's output using a small client-side model with access to the user's private profile, without transmitting that profile to the server.

What This Paper Is About

Personalized LLM responses today rely on retrieval augmentation, which requires sending relevant pieces of the user's private profile to a powerful cloud model, or else settling for a weaker fully local model. This paper asks how to get most of the quality of the cloud model while keeping the private profile on the user's device, and proposes P³ to do exactly that.

Key Contributions

1. Proposes P³, an interactive framework in which a large server-side model drafts k tokens from the query alone and a small client-side model, conditioned on retrieved private context, verifies, accepts, or corrects those tokens — repeating until an end-of-response token is produced.
2. Adds a PII protection step: personally identifiable information extracted from retrieved profile documents is replaced with a [PII] marker before any token sequence is returned to the server-side model.
3. Demonstrates on the LaMP-QA benchmark that P³ outperforms non-personalized server-side and personalized client-side baselines, and quantifies privacy leakage through linkability and attribute inference attacks.
4. Describes itself as the first attempt toward privacy-preserving retrieval-augmented methods for LLM personalization, and open-sources the implementation.

Main Findings

• Personalization gains: On LaMP-QA, P³ outperforms all baselines across all datasets and on average with statistical significance, achieving improvements of 7.4% to 9% on average depending on the backbone LLM.
• Recovering the leaky upper bound: P³ reaches between 90.3% and 95.7% of the performance of a "leaky" upper bound in which the full personal context is given to a 3–4.6 times larger server-side model.
• Client-side models alone are weaker: The small client-side personalized model underperforms the non-personalized server-side model on average and in nearly all individual settings, motivating the hybrid design.
• Privacy leakage is small: Privacy analyses with linkability and attribute inference attacks show only 1.5% to 3.5% additional leakage compared to submitting a query with no personal context.
• Low client overhead: The client-side model generates only about 9.2% of the final response tokens.
• Qwen 2.5 results (macro average): P³ (14B server / 3B client) scores 0.4624, versus 0.4241 for the non-personalized 14B server-side model, 0.4164 for non-personalized speculative decoding, 0.3952 for client-side RAG personalization, and 0.4923 for the server-side RAG upper bound.
• Gemma 3 results (macro average): P³ (12B server / 4B client) scores 0.5867, versus 0.5461 for the non-personalized 12B server-side model, 0.5211 for non-personalized speculative decoding, 0.5345 for client-side RAG personalization, and 0.6396 for the server-side RAG upper bound.
• Per-dataset pattern: The statistical significance markers in Table 1 are reported for the Qwen 2.5 setting on Arts & Entertainment (0.3680), Lifestyle & Personal Development (0.4888), Society & Culture (0.5306) and average (0.4624); for Gemma 3 they are reported for Arts & Entertainment (0.4811), Society & Culture (0.6592) and average (0.5867), with Lifestyle & Personal Development (0.6199) reported without the significance marker.
• Difference from speculative decoding: The paper lists four differences — the larger model drafts and the smaller verifies here (the reverse of speculative decoding), the two models condition on different inputs, controlled deviation from the server's distribution is intentional, and the models sit on different machines (server vs. client).

Methodology in Plain English

The user's device retrieves a small set of relevant documents from the private profile for the query. Any PII in those documents is flagged using regex patterns for email addresses, phone numbers, IP addresses, URLs, U.S. Social Security numbers, credit card numbers, and dates of birth. Two histories are then maintained: a server-side history containing only the query (plus previously accepted tokens, with PII replaced by a placeholder), and a client-side history containing the query plus the retrieved private context.

In each round, the server-side model proposes a block of draft tokens using only the server-side history. The client-side model scores each draft token against its own probability distribution conditioned on the private context, and compares that probability to the probability of its own most likely token. If the ratio is at or above a rejection threshold, the token is accepted; otherwise it is replaced by the client-side model's preferred token and the rest of the block is discarded. Accepted tokens are appended to the response, and the loop repeats until an end-of-response token is produced or verified.

Setup details: LaMP-QA is used with its three datasets — Art & Entertainment (767 questions), Lifestyle & Personal Development (989 questions), and Society & Culture (1074 questions). Evaluation uses Qwen 2.5 (32B) as a judge scoring each personalized aspect in the range [0, 2], normalized to [0, 1] by dividing by 2, with the mean across aspects as the final score. Server-side models are instruction-tuned Qwen 2.5 (14B) and Gemma 3 (12B); client-side models are instruction-tuned Qwen 2.5 (3B) and Gemma 3 (4B). Default settings are k = 10 draft tokens, rejection threshold τ = 0.05, nucleus sampling with temperature 1.0, maximum context length 2048 for the server model and 8192 for the client model, Contriever retrieval of m = 10 documents, and vLLM for inference, on two NVIDIA A100 GPUs with 80GB memory each and 256GB system RAM. Baselines are non-personalized server-side, non-personalized speculative decoding, client-side RAG personalization, plus a server-side RAG personalization upper bound. Privacy attacks use GPT-4.2 as the attacker model with the Qwen 2.5 family as backbones.

Why This Matters

The work reframes personalized LLM deployment as a risk-reduction problem rather than an all-or-nothing choice between full local privacy and full server disclosure, in the spirit of k-anonymity and differential privacy. It matters because retrieval augmentation is the dominant paradigm for LLM personalization, so its privacy cost is broadly relevant. The paper notes that textual and vector-based obfuscation are vulnerable to inversion attacks and that homomorphic encryption incurs prohibitive overheads (often exceeding 1000× slowdowns) and is unsupported by major LLM providers, leaving a gap this framework tries to fill.

Real-world applications:

• Personal digital archives or assistants where profile data should not leave the device but stronger cloud generation is acceptable.
• Personalized question answering over a user's own history, as studied directly via LaMP-QA.
• Drafting messages or documents using a cloud model without sharing the personal context behind them.
• Consumer services in the intermediate privacy regime, as opposed to high-stakes settings such as banking or financial transactions where the paper says only fully local models are acceptable.

Industry relevance: the framework lets providers offer stronger cloud models while reducing exposure of user profiles, and it keeps client-side compute small (about 9.2% of generated tokens), which matters for edge deployment. The paper also notes that current proprietary APIs for GPT and Gemini cannot sample k tokens and resume generation from an intermediate state, so they were excluded from experiments — a practical constraint on immediate commercial adoption.

Future Directions

• Adapting the framework to proprietary APIs that do not currently support sampling k tokens and resuming from an intermediate state, which the paper identifies as the reason GPT and Gemini were omitted.
• Applying P³ beyond question answering to the wider range of personalization tasks the paper says it is applicable to, and measuring utility and privacy there.
• Strengthening or formally characterizing the privacy guarantee, since P³ still reveals the information implicit in accepted or corrected tokens, and the reported leakage is 1.5%–3.5% over a query-only baseline rather than zero.
• Tuning and analyzing the hyperparameters (k, τ, m, and the choice of client-side model size) and how the client–server model size gap (the upper bound is 3–4.6 times larger) affects the recoverable fraction of personalization quality (90.3%–95.7%).

Target Audience

Researchers and practitioners in information retrieval, natural language processing, and privacy-preserving machine learning who work on LLM personalization, retrieval-augmented generation, or on-device and edge inference. It is also relevant to engineers designing client–server inference architectures for consumer applications where user profiles are sensitive but high-capacity cloud models are still desired.

Authors’ abstract

Personalization is crucial for aligning Large Language Model (LLM) outputs with individual user preferences and background knowledge. State-of-the-art solutions are based on retrieval augmentation, where relevant context from a user profile is retrieved for LLM consumption. These methods deal with a trade-off between exposing retrieved private data to cloud providers and relying on less capable local models. We introduce $P^3$, an interactive framework for high-quality personalization without revealing private profiles to server-side LLMs. In $P^3$, a large server-side model generates a sequence of $k$ draft tokens based solely on the user query, while a small client-side model, with retrieval access to the user's private profile, evaluates and modifies these drafts to better reflect user preferences. This process repeats until an end token is generated. Experiments on LaMP-QA, a recent benchmark consisting of three personalized question answering datasets, show that $P^3$ consistently outperforms both non-personalized server-side and personalized client-side baselines, achieving statistically significant improvements of $7.4%$ to $9%$ on average. Importantly, $P^3$ recovers $90.3%$ to $95.7%$ of the utility of a ``leaky'' upper-bound scenario in which the full profile is exposed to the large server-side model. Privacy analyses, including linkability and attribute inference attacks, indicate that $P^3$ preserves the privacy of a non-personalized server-side model, introducing only marginal additional leakage ($1.5%$--$3.5%$) compared to submitting a query without any personal context. Additionally, the framework is efficient for edge deployment, with the client-side model generating only $9.2%$ of the total tokens. These results demonstrate that $P^3$ provides a practical, effective solution for personalized generation with improved privacy.