NOIR: Privacy-Preserving Generation of Code with Open-Source LLMs
Not on the map. Why?
Abstract (arXiv)
Although boosting software development performance, large language model (LLM)-powered code generation introduces intellectual property and data security risks rooted in the fact that a service provider (cloud) observes a client's prompts and generated code, which can be proprietary in commercial systems. To mitigate this problem, we propose NOIR, the first framework to protect the client's prompts and generated code from the cloud. NOIR uses an encoder and a decoder at the client to encode and send the prompts' embeddings to the cloud to get enriched embeddings from the LLM, which are then decoded to generate the code locally at the client. Since the cloud can use the embeddings to infer the prompt and the generated code, NOIR introduces a new mechanism to achieve indistinguishability, a local differential privacy protection at the token embedding level, in the vocabulary used in the prompts and code, and a data-independent and randomized tokenizer on the client side. These components effectively defend against reconstruction and frequency analysis attacks by an honest-but-curious cloud. Extensive analysis and results using open-source LLMs show that NOIR significantly outperforms existing baselines on benchmarks, including the Evalplus (MBPP and HumanEval, Pass@1 of 76.7 and 77.4), and BigCodeBench (Pass@1 of 38.7, only a 1.77% drop from the original LLM) under strong privacy against attacks.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 35 of its 65 references that are in the map. First posted on arXiv 22 Jan 2026.
Builds on
35 of 65 references.
References · 35
- 2017Attention Is All You Needcited by 60,361
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2021Evaluating Large Language Models Trained on Codecited by 8,320
- 2021Program Synthesis with Large Language Modelscited by 3,637
- 2023Is Your Code Generated by ChatGPT Really Correct? Rigorous Evaluation of Large Language Models for Code Generationcited by 1,391
- 2025Group Sequence Policy Optimizationcited by 835
- 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 723
- 2024BigCodeBench: Benchmarking Code Generation with Diverse Function Calls and Complex Instructionscited by 546
- 2020CodeBLEU: a Method for Automatic Evaluation of Code Synthesiscited by 479
- 2021Large Dual Encoders Are Generalizable Retrieverscited by 456
- 2018Split learning for health: Distributed deep learning without sharing raw patient datacited by 395
- 2022The Stack: 3 TB of permissively licensed source codecited by 359
23 more
- 2025Layer by Layer: Uncovering Hidden Representations in Language Modelscited by 311
- 2014RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Responsecited by 272
- 2024LiveBench: A Challenging, Contamination-Limited LLM Benchmarkcited by 262
- 2020Information Leakage in Embedding Modelscited by 203
- 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
- 2019Privacy- and Utility-Preserving Textual Analysis via Calibrated Multivariate Perturbationscited by 119
- 2024Revisiting Zeroth-Order Optimization for Memory-Efficient LLM Fine-Tuning: A Benchmarkcited by 114
- 2020Unleashing the Tiger: Inference Attacks on Split Learningcited by 105
- 2023Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generationcited by 96
- 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 83
- 2023Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentencecited by 81
- 2023Offsite-Tuning: Transfer Learning without Full Modelcited by 78
- 2020Local Differential Privacy based Federated Learning for Internet of Thingscited by 75
- 2023Split Learning in 6G Edge Networkscited by 68
- 2022The Limits of Word Level Differential Privacycited by 63
- 2023DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineercited by 57
- 2021Natural Language Understanding with Privacy-Preserving BERTcited by 55
- 2023Privacy-Preserving In-Context Learning for Large Language Modelscited by 50
- 2019Collecting and Analyzing Multidimensional Data with Local Differential Privacycited by 49
- 2023Split-and-Denoise: Protect large language model inference with local differential privacycited by 32
- 2020Towards Differentially Private Text Representationscited by 29
- 2024Unveiling the Vulnerability of Private Fine-Tuning in Split-Based Frameworks for Large Language Models: A Bidirectionally Enhanced Attackcited by 18
- 2022XRand: Differentially Private Defense against Explanation-Guided Attackscited by 11
Built on by
Citing papers per year: 2026: 1.
1 paper.