Privacy Without Regret: Differentially Private Inference-Time Alignment
Organizations: Indian Institute of Technology Kanpur
Abstract
Best-of-N (BoN) sampling is the simplest and most widely deployed inference-time alignment strategy, but it suffers from two distinct problems: reward hacking, in which the selected response exploits errors in the proxy reward model, and the absence of any privacy protection for the sensitive human preference data used to train that reward model. We show that a single intervention-adding calibrated noise to reward scores before selection-resolves both. Our first result, Private Best-of-N (PrivBoN), establishes that Gumbel noise at an appropriate scale simultaneously provides -differential privacy and implements KL-regularized alignment. Whenever the privacy budget exceeds a critical threshold , the privacy-mandated noise is the regret-optimal regularization, and privacy imposes zero additional alignment cost-matching the information-theoretic skyline of Huang et al. (2025). Because depends on an unknown coverage coefficient, we introduce Private Inference-Time Pessimism (PrivITP), which combines -regularized rejection sampling with a two-phase Gaussian mechanism. PrivITP achieves ex-post -DP with a privacy cost independent of the number of responses , cleanly decouples the regularization parameter from the privacy parameter, and attains the skyline up to a noise-inflation term. Experiments across several language models, datasets, and reward models confirm our results: PrivBoN and PrivITP are scaling-monotonic (unlike BoN, which degrades past a critical ), and PrivITP matches or outperforms PrivBoN at equivalent privacy levels, with the largest gains in the strong-privacy regime.
Figures & tables
| Dataset | Algorithm | Oasst-RM | Gemma-RM | Llama-RM | Armo-RM |
|---|---|---|---|---|---|
| GSM8K | BoN | ||||
| PrivBoN | |||||
| PrivITP | |||||
| ITP | |||||
| MMLU | BoN | ||||
| PrivBoN |
Appendix figures & tables17 assets
Supplementary material from the paper’s appendix.
Appendix
| Dataset | Algorithm | Oasst-RM | Gemma-RM | Llama-RM | Armo-RM |
|---|---|---|---|---|---|
| GSM8K | BoN | ||||
| PrivBoN | |||||
| PrivITP | |||||
| ITP | |||||
| MMLU | BoN | ||||
| PrivBoN |
| Dataset | Algorithm | Oasst-RM | Gemma-RM | Llama-RM | Armo-RM |
|---|---|---|---|---|---|
| GSM8K | BoN | ||||
| PrivBoN | |||||
| PrivITP | |||||
| ITP | |||||
| MMLU | BoN | ||||
| PrivBoN |
| RM | n | BoN | PrivBoN | ITP | PrivITP |
|---|---|---|---|---|---|
| Gemma | 64 | 90.82 1.91 | 88.35 2.08 | 90.56 1.99 | 87.89 2.23 |
| 512 | 92.19 1.72 | 89.65 1.97 | 90.30 1.97 | 89.78 1.95 | |
| 2048 | 92.06 1.81 | 89.39 1.98 | 90.82 1.89 | 89.97 2.07 | |
| 4096 | 92.38 1.84 | 90.17 2.02 | 90.36 1.95 | 91.15 1.84 | |
| Llama | 64 | 92.32 1.87 | 89.39 1.90 | 92.32 1.78 | 89.19 2.03 |
| 512 | 91.73 1.82 | 89.32 2.03 | 91.93 1.66 | 90.62 1.92 |
| RM | Oasst | Gemma | Llama | Armo |
|---|---|---|---|---|
| PrivBoN | 0.4145 | 0.9003 | 1.1804 | 0.4530 |
| PrivITP | 0.4704 | 0.9827 | 1.2838 | 0.4812 |
| Overhead | +13.5% | +9.2% | +8.8% | +6.2% |
| (PrivBoN) | (PrivITP) | |||
|---|---|---|---|---|
| 0.10 | 7.80 | 24.25 | 23.25 | 47.50 |
| 0.25 | 3.12 | 9.70 | 8.49 | 18.19 |
| 0.50 | 1.56 | 4.85 | 3.48 | 8.33 |
| 0.75 | 1.04 | 3.23 | 2.22 | 5.45 |
| 1.00 | 0.78 | 2.42 | 1.43 | 3.85 |
Inference-Time Language Model Alignment
Inference-time language model alignment steers or selects outputs during generation to better meet safety, preference, and task goals without retraining.
See all 75 papersBest-of-Tails: Bridging Optimism and Pessimism in Inference-Time Alignment
optimistic'' approaches like Best-of-$N$ suffer from reward hacking, while pessimistic'' regularized methods often stifle the exploration needed to discover high-quality responses. In this work, we formalize this trade-off through the lens of regret minimization, demonstrating that the optimal strategy depends critically on the tail behavior of the reward distribution. We show theoretically that light-tailed regimes favor optimism to unearth high-quality outliers, whereas heavy-tailed regimes require pessimism to guard against reward mis-calibration in the extremes. Guided by this insight, we introduce Best-of-Tails (BoT), an adaptive inference-time alignment framework that uses Tsallis divergence as a tunable regularizer to provide a finer granularity of interpolation between these extremes. BoT uses the Hill estimator to characterize reward-tail heaviness on a per-prompt basis and dynamically adjusts its selection rule to balance exploration gains against alignment error. Across math, multiple-choice reasoning, and human-preference evaluations, BoT improves alignment performance across a range of reference and reward model configurations relative to fixed-strategy baselines.