@inproceedings{zheng-etal-2026-dp3,
    title = "{DP}$^3$: Differentially Private Prompt Perturbation for Multi-turn {LLM} Inference",
    author = "Zheng, Lele  and
      Zhang, Chao  and
      Yuan, Feiyang  and
      Cheng, Ke  and
      Zhang, Tao  and
      Song, Anxiao  and
      Shen, Yulong",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {ACL} 2026",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-acl/2026.findings-acl.924/",
    pages = "18538--18552",
    ISBN = "979-8-89176-395-1",
    abstract = "Large language models (LLMs) are widely used for text understanding and generation, with increasing deployment in applications involving sensitive user inputs. This raises significant privacy concerns, motivating the adoption of differential privacy (DP) to protect prompts during LLM inference. However, most existing DP methods assume single-turn interactions, whereas real-world usage often relies on multi-turn dialogue. Consequently, these single-turn-based methods break down in multi-turn settings, where recurring tokens repeatedly consume the privacy budget under DP, leading to accumulated privacy loss and degraded cross-turn semantic coherence.To address these challenges, we propose DP$^3$, a differentially private prompt perturbation framework for multi-turn LLM inference. DP$^3$ constructs a perturbation mapping table to reuse perturbations for recurring tokens, reducing redundant privacy costs. It also defines a context-aware utility function that combines embedding distance with attention-based contextual representations to maintain semantic consistency across turns. Additionally, DP$^3$ introduces a two-stage bucketed exponential mechanism to manage long-tail phenomena in large candidate spaces.Experimental results on multi-turn dialogue tasks demonstrate that DP$^3$ offers a better privacy-utility trade-off and stronger resistance to inference attacks compared to existing methods. Our code is publicly available at https://github.com/XidianNSS/DP3."
}