# SecureLLM: A Unified Framework for Privacy-Focused Large Language Models
## 3 Proposed Methods: The SecureLLM Framework
### Layer 3: Differentially Private Inference  
During inference, we incorporate a differential privacy layer that injects controlled noise into the query embeddings and model outputs, mitigating membership inference and model inversion attacks. Traditionally, differential privacy is used only in training to protect the training data; here, we extend it to inference-time interactions [41]. The theoretical motivation is that any data the model processes--from training examples to user queries--can be exploited by adversaries via repeated probing [42]. Therefore, we adapt the standard \((\varepsilon,\delta)\)-DP framework to treat both query embeddings and outputs as \"private data\", ensuring that the responses to two similar or adjacent queries remain statistically indistinguishable under a defined privacy budget. Our approach builds on established methods for training using differential privacy, as introduced by [PERSON] et al. [32]. In our implementation, example parameters (e.g., \(\varepsilon=1.0\) and \(\delta=1\times 10^{-5}\)) balance privacy with utility. **The formal definition of noise injection:** Given the sensitivity \(S\) of the model's output, the noise \(\eta\) is sampled from a Gaussian distribution:  
\[\eta\sim\mathcal{N}\Big{(}0,\big{(}\frac{S\sim\sqrt{2\ln(1.25/\delta)}}{ \varepsilon}\big{)}^{2}\Big{)}. \tag{2}\]  
In Section 5.5, although the baseline model's membership inference accuracy was 66.3%, the DP variant reduced it to 60.8%, indicating a measurable drop in data memorization. Moreover, the cumulative privacy loss is continuously tracked using a standard Renyi Differential Privacy (RDP) accountant, ensuring that the overall privacy budget is properly managed across multiple queries. The noisy output is then computed as  
\[\vec{y}=y+\eta, \tag{3}\]  
where \(y\) is the original output. We also include a noise calibration mechanism that dynamically adjusts the Gaussian or Laplacian noise in the model outputs, maintaining acceptable accuracy while offering strong privacy guarantees [43]. Concretely, we define a sensitivity parameter reflecting how much a single query can change the output distribution. Based on this parameter, the framework injects noise into logits or representation layers before producing responses. Consequently, the privacy budget that once covered only training data now covers cumulative inference queries, preventing attackers from gradually extracting private information through repeated interactions. Because we selectively apply noise at certain layers, the performance impact on critical tasks remains small. Nonetheless, a continuing privacy budget must be updated with each query, preventing adversaries from assembling partial data over time [44]. Administrators can tune \(\varepsilon\) and \(\delta\) depending on the setting: stricter budgets yield stronger privacy at the cost of greater noise. Conversely, tasks requiring higher accuracy may use a more lenient privacy budget while still maintaining a baseline level of protection. Practically, implementing differentially private inference can involve specialized noise injection layers or output modifications. The SecureLLM framework treats this as a policy-driven setting, allowing organizations to define their own thresholds for acceptable utility vs. privacy. Logging and audit mechanisms can track real-time noise injections, generating compliance reports or triggering alerts if the cumulative privacy budgets approach critical levels. This flexibility ensures operators can quickly respond if the privacy settings are nearing their constraints. Overall, combining lightweight cryptography, decentralized fine-tuning, and differentially private inference yields a robust and adaptive security posture. Each layer operates independently yet synergistically: cryptography secures the data in transit, decentralized fine-tuning prevents any single entity from seeing all of the data, and DP-based inference safeguards against attempts to reverse-engineer sensitive content.