DP³: Differentially Private Prompt Perturbation for Multi-turn LLM Inference

Large language models (LLMs) are widely used for text understanding and generation, with increasing deployment in applications involving sensitive user inputs. This raises significant privacy concerns, motivating the adoption of differential privacy (DP) to protect prompts during LLM inference. However, most existing DP methods assume single-turn interactions, whereas real-world usage often relies on multi-turn dialogue. Consequently, these single-turn-based methods break down in multiturn settings, where recurring tokens repeatedly consume the privacy budget under DP, leading to accumulated privacy loss and degraded cross-turn semantic coherence. To address these challenges, we propose DP 3 , a differentially private prompt perturbation framework for multi-turn LLM inference. DP 3 constructs a perturbation mapping table to reuse perturbations for recurring tokens, reducing redundant privacy costs. It also defines a contextaware utility function that combines embedding distance with attention-based contextual representations to maintain semantic consistency across turns. Additionally, DP 3 introduces a two-stage bucketed exponential mechanism to manage long-tail phenomena in large candidate spaces. Experimental results on multi-turn dialogue tasks demonstrate that DP 3 offers a better privacy-utility trade-off and stronger resistance to inference attacks compared to existing methods. Our code is publicly available at https://github.com/XidianNSS/DP3.