ArXiv: 2605.20258
🎯 Pitch
A self-distillation framework achieves up to a 31-point gain in contextual privacy compliance without sacrificing task performance by decomposing the problem into two opposing feedback-conditioned policies—one that explains what to retain, another what to suppress—and training the model to satisfy the intersection of their demands.
1. Executive Summary
This paper proposes SELFCI, a complementary self-distillation framework that aligns LLMs to Contextual Integrity (CI) norms—governing appropriate information disclosure based on task context—without sacrificing native task-solving capability. Evaluated on the CI-RL benchmark and out-of-domain agentic scenarios (PrivacyLens, CIMemories) across instruction-tuned models (Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, and others) and reasoning backbones (DeepSeek-R1-Distill-Llama-8B, Qwen3-4B), SELFCI decouples CI alignment into two complementary self-teacher policies—one promoting task completeness by conditioning on self-generated feedback explaining why allowed attributes should be retained, the other enforcing minimal disclosure by conditioning on feedback explaining why disallowed attributes should be suppressed—and jointly optimizes reverse KL divergences toward their product-of-experts (PoE) intersection. The framework consistently improves the joint satisfaction of task utility and privacy integrity, raising Complete scores on CI-RL by up to 31 percentage points over the initial model (e.g., from 23.29 to 53.42 on Qwen2.5-7B-Instruct) while reducing GPU training time by nearly half compared to online RL baselines, establishing that contextual privacy alignment need not degrade native capabilities when the retain/suppress asymmetry is structurally decomposed rather than collapsed into a single objective.
2. Context and Motivation
The Core Problem: LLMs Must Learn When to Share and When to Stay Silent
The paper addresses a deceptively subtle problem: how do we teach language models to selectively disclose information based on context, rather than treating all accessible data as fair game? This is not the traditional privacy problem of keeping secrets entirely hidden. Instead, it is a context-dependent disclosure problem: the same piece of information—a phone number, a medical condition, a travel date—may be entirely appropriate to share in one scenario (booking a hotel) but inappropriate in another (sending a casual message to a friend who doesn't need to know your itinerary).
This challenge arises because LLMs deployed as personal agents [27, 44] increasingly operate over rich, accumulating user contexts: private documents, communication histories, tool outputs, and long-term memory stores. When a user says "book me a room for my trip," the model may have access to the user's full profile, including their name, travel dates, room preferences, passport number, medical history, insurance details, and personal chat logs. The model must figure out which of these are necessary and appropriate for the hotel booking task (name, dates, room type) and which should be suppressed (passport details, medical notes, conversations with their doctor).
The paper formalizes this through the lens of Contextual Integrity (CI) [4, 32, 33], a privacy framework that defines privacy not as secrecy but as appropriate information flow governed by context-specific norms. CI asks: given a particular sender, recipient, task purpose, and transmission principle, is sharing this attribute justified? This is fundamentally different from Differential Privacy (DP) [10], which enforces a uniform, context-independent indistinguishability guarantee. CI requires the model to be context-dependent: invariant to disallowed information but responsive to allowed information. Section 2 formalizes this as the ideal CI state (Definition 2.1): the model's predictive distribution should be identical whether or not disallowed attributes are present, while still completing the task using the allowed attributes.
Why This Problem Matters Now
The paper identifies several converging trends that make CI alignment urgent:
LLMs are becoming personal agents with memory. As models transition from stateless question-answering to persistent assistants that accumulate user history [27, 44], they gain access to increasingly rich and sensitive contexts. The same attribute may be relevant across multiple tasks—a phone number is useful for booking hotels, scheduling appointments, and ordering delivery—but the appropriateness of sharing it depends entirely on the current recipient and purpose. A simple blanket rule ("never share phone numbers") would break legitimate functionality, while permissive sharing ("if you have it, use it") leads to over-disclosure.
Existing privacy frameworks don't capture the nuance. The paper distinguishes CI from standard data protection approaches. Differential Privacy [50] provides strong mathematical guarantees but enforces a uniform, context-independent notion of privacy: model outputs should be nearly indistinguishable regardless of whether any individual's data is included. This is both too strong (it may mask information the task legitimately requires) and too weak (it doesn't distinguish between appropriate and inappropriate disclosure—it only constrains information quantity, not contextual appropriateness). Memorization control [6] addresses whether models regurgitate training data but doesn't help with deciding which in-context attributes to disclose. CI fills a gap that neither DP nor memorization defenses address: the norm-governed, context-sensitive flow of information in deployment.
Even frontier models fail at CI. The paper notes that instruction-tuned models inherit a strong prior toward satisfying the user's request, which encourages them to exploit any accessible context. This leads to over-disclosure: the model includes task-irrelevant but sensitive information simply because it's available in the context window. As Tab. 1 shows, the Initial models—strong instruction-tuned backbones like Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct—achieve Integrity scores of only 35.34% and 65.21%, respectively, on the CI-RL benchmark, meaning they frequently leak disallowed attributes in their responses. This is not a capability gap; it's an alignment gap: the models have the information to make correct disclosure decisions but aren't trained to do so.
Where Prior Approaches Fall Short
The paper identifies three broad categories of prior work and explains why each fails to satisfy CI's joint requirement of task completeness + minimal disclosure.
1. Supervised fine-tuning on CI-compliant trajectories [8, 11, 19, 47]. The most straightforward approach is to train the model on examples of "good" behavior: responses that include allowed attributes and exclude disallowed ones. This provides dense token-level supervision, which is appealing. However, the paper identifies two structural problems:
-
Cost and scalability of data construction: Manually writing CI-compliant responses that correctly navigate the retain/suppress boundary for every attribute in every context is expensive. The paper cites Jing et al. [19] and Das et al. [8] as examples of this approach, which requires either human annotation or distillation from a larger model that already exhibits CI-aligned behavior. Scaling this to the diversity of real-world contexts is impractical.
-
Exposure bias: Even if you construct perfect training trajectories, the model is trained on ground-truth responses that it would not necessarily generate itself during deployment. Once the model's own generations deviate from the training distribution—which they inevitably will, since the model makes mistakes—the token-level supervision becomes misaligned with the model's actual behavior. This is a well-known problem in imitation learning [2]; the model hasn't learned why certain attributes should be suppressed, only what the training data looked like.
The paper's ContextDistill baseline is an instance of this approach: it fine-tunes on responses generated by a larger teacher model (e.g., Qwen2.5-32B-Instruct teaching Qwen2.5-7B-Instruct) conditioned on feedback about which attributes are allowed or disallowed. As shown in Tab. 1, ContextDistill consistently underperforms SELFCI, particularly on Integrity and Complete. For example, on Qwen3-4B-Instruct, ContextDistill achieves only 40.00 Complete vs. SELFCI's 55.34. The paper attributes this to the distributional mismatch between teacher-generated and student-generated responses at test time.
2. Online reinforcement learning with scalar rewards [17, 22]. To avoid the exposure bias of offline supervised data, online RL methods (specifically GRPO, the Group Relative Policy Optimization used in CI-RL [22]) optimize the model using on-policy rollouts and a scalar reward signal. The CI-RL baseline uses a reward function that directly encodes the joint requirement:
where and are the sets of allowed and disallowed attributes for task , and , are the subsets that appear in the model's response. This reward encourages the model to include all allowed attributes (first term) and exclude all disallowed attributes (second term), with format violations penalized at .
The paper identifies two fundamental limitations of this approach:
-
Sparse, entangled feedback: The scalar reward collapses the retain/suppress distinction into a single number. If the model receives a low reward, it doesn't know which attributes caused the problem—did it omit a required attribute, or leak a restricted one? Did it do both? This entanglement makes credit assignment difficult, particularly for context-dependent norms where the same attribute may be allowed in one scenario and disallowed in another. The model must infer the underlying CI norms from coarse sequence-level feedback, which is sample-inefficient and often insufficient.
-
Task performance degradation: Because the reward jointly incentivizes suppression (penalizing disallowed attribute presence) and completion (rewarding allowed attribute presence), the model can achieve a decent reward by becoming overly conservative—suppressing borderline attributes at the expense of task completeness. Conversely, if the model's prior toward task completion is strong (as it is in instruction-tuned models), it may ignore the privacy penalty and continue leaking attributes. The paper observes that CI-RL often improves Integrity but at the cost of Utility: on Qwen2.5-7B-Instruct, CI-RL raises Integrity from 35.34 to 73.70 but drops Utility from 68.22 to 61.10 (Tab. 1). This is the classic privacy-utility trade-off manifested as a failure of the single-objective optimization.
Fig. 3 (Middle) provides striking evidence of this sample inefficiency: CI-RL requires approximately 15 epochs to exceed 40% Complete on Qwen3-4B-Instruct, while SELFCI reaches the same threshold by epoch 3. The wall-clock time comparison (Fig. 3, Right) is equally damning: CI-RL requires 15.02 seconds per training step (generating 16 completions per prompt for GRPO) versus SELFCI's 7.77 seconds (generating only one completion).
3. Inference-time CI enforcement [11, 12, 24]. Some prior work enforces CI constraints at inference time through techniques like privacy checklists [24], context filtering [12], or legal grounding [11]. These methods add an external privacy layer that screens model outputs before they reach the recipient—detecting and redacting inappropriate disclosures. The paper acknowledges this line of work but argues that it is fundamentally limited: it treats CI as an output-level constraint rather than an internalized reasoning capability. This means the model itself hasn't learned why certain disclosures are inappropriate; it simply has its outputs post-processed. The approach doesn't scale to complex agentic workflows where disclosure decisions happen across multiple tool calls and intermediate reasoning steps, and it can't influence the model's reasoning process—only its final output.
The Structural Asymmetry That Prior Work Misses
The paper's central conceptual contribution is reframing CI alignment as a problem of asymmetric pressures: the model must simultaneously be attracted toward using allowed information (to complete the task) and repelled from using disallowed information (to maintain privacy). These are not symmetric opposites that can be captured by a single loss function or reward signal.
The paper formalizes this through the lens of context-dependent invariance (Definition 2.1 and Eq. 1 in Section 2). The ideal CI policy should:
- Produce the same next-token distribution whether or not disallowed attributes are in the context:
- But remain sensitive to —the allowed attributes that are necessary for task completion
This leads to a token-level surrogate objective (Eq. 1) that penalizes the KL divergence between the full-context policy and an "allowed-only" reference policy, but only along prefixes generated by the full-context policy itself. In other words: given the same generation prefix, injecting disallowed information should not change what the model would say next.
However, the paper observes that directly optimizing this surrogate is under-specified in practice (Section 3, validated in Section 4.4). Removing disallowed attributes from the context tells the model what not to use, but doesn't tell it which allowed attributes are actually necessary, why they're task-relevant, or how they should appear in the response. The allowed-only reference policy may not even be task-complete—it knows what information is available but has no guidance on how to use it effectively. Fig. 5 (Left) confirms this empirically: the allowed-only reference yields lower Utility than the PoE target induced by SELFCI.
How SELFCI Positions Itself
SELFCI frames CI alignment as a self-distillation problem rather than a supervised learning or reinforcement learning problem. The key insight is that the retain/suppress asymmetry can be decomposed into two specialized teacher policies, each constructed from the model's own parameters by conditioning on different self-generated feedback:
- π_allow: The model conditioned on self-generated rationales explaining why allowed attributes are appropriate to share. This teacher is biased toward task completeness—it "knows" which attributes are necessary and why.
- π_disallow: The model conditioned on self-generated rationales explaining why disallowed attributes violate CI norms. This teacher is biased toward minimal disclosure—it "knows" which attributes should be suppressed and why.
The student policy is trained to minimize a weighted sum of reverse KL divergences to these two teachers (Eq. 5), which under fixed teacher distributions is equivalent to matching a Product-of-Experts (PoE) target (derived in Appendix F):
This multiplicative form concentrates probability mass on the intersection of the two teachers' support—tokens that are simultaneously endorsed by both the utility-oriented and privacy-oriented experts. This is structurally different from averaging or taking a linear combination of the two signals, which would create a compromise between utility and privacy. The PoE instead requires agreement: only behaviors that satisfy both criteria receive high probability.
The paper's self-distillation framing distinguishes it from prior work in several crucial ways:
On-policy by construction. Unlike offline SFT (ContextDistill), the student trains on its own generations, and the teachers are instantiated from its own parameters. This eliminates the exposure bias from distributional mismatch between student and teacher at test time. As the student changes during training, it always sees guidance conditioned on its current behavior.
Dense token-level supervision. Unlike online RL (CI-RL) with scalar rewards, the KL divergence provides per-token guidance. If the student assigns high probability to a token that the disallow teacher assigns low probability, the gradient directly penalizes that specific token, rather than providing only a sequence-level signal that entangles multiple decisions. This makes credit assignment dramatically more efficient.
Decomposed retain/suppress signals. Unlike a single monolithic objective that entangles task completion and privacy, SELFCI maintains two distinct feedback channels. The model learns from explicit rationales about why an attribute should be retained (via π_allow) and why an attribute should be suppressed (via π_disallow), rather than from a single scalar "good/bad" signal. The paper shows (Tab. 3, Section 4.4) that decomposing feedback into separate teachers yields higher Complete scores than concatenating all feedback into a single monolithic teacher (e.g., +3.83 percentage points on Qwen3-4B-Instruct).
Theoretical grounding in the ideal CI objective. Appendix G proves that optimizing the SELFCI objective provides an upper-bound surrogate for the ideal CI objective in Eq. 1: minimizing the complementary teacher loss tightens an upper bound on the KL divergence to the true allow-only ideal policy, up to an alignment error term that measures how well the PoE target approximates the ideal.
The paper also positions SELFCI relative to the broader self-distillation literature [18, 37, 51]. Standard self-distillation (Eq. 6, Appendix A) trains a student to match a teacher conditioned on some privileged context —typically ground-truth rationales or completions from a larger model. SELFCI's key departure is that the privileged context is self-generated feedback grounded in CI norms, and that two complementary teachers are used rather than one, decomposing the retain/suppress structure rather than collapsing it into a single privileged context.
The practical implications of this positioning are significant: SELFCI requires no external teacher model, no human-written rationales, and no hand-crafted reward functions. It generates its own feedback by verbalizing existing CI decisions through transmission principle templates (Section 3.1), then uses that feedback to condition its own parameters as teachers. This makes it self-contained—suitable for deployment scenarios where access to a larger teacher model is infeasible or undesirable, and where manual annotation of CI-compliant responses doesn't scale.
3. Technical Approach
3.1 Reader Orientation
SELFCI is a training framework—not a model architecture change—that takes an existing instruction-tuned or reasoning LLM and adapts it to follow Contextual Integrity norms using only the model's own outputs as a training signal. The system solves the asymmetric disclosure problem: teaching the model to simultaneously retain attributes needed for the task and suppress attributes that are inappropriate to share, without collapsing these distinct pressures into a single objective that forces a trade-off between privacy and utility.
3.2 Big-Picture Architecture (Diagram in Words)
The SELFCI system has four major components that operate in sequence during training:
-
Feedback Generator: For a given task with explicit annotations of allowed attributes (
$A_T$) and disallowed attributes ($D_T$), the model produces natural-language rationales explaining why each attribute should or should not be disclosed. These rationales are generated by filling templated prompts ($I_{\text{allow}}$and$I_{\text{disallow}}$) that ask the model to justify disclosure decisions grounded in CI transmission principles (Confidentiality, Proportionality, Consent). -
Complementary Teacher Constructor: The self-generated feedback is aggregated into two separate privileged contexts—one for allowed attributes (
$\tilde{f}_{\text{allow}}$), one for disallowed attributes ($\tilde{f}_{\text{disallow}}$). These contexts are prepended to the base task prompt to condition the same model parameters differently, producing two teacher policies:$\pi_{\text{allow}}$(biased toward task completion, seeing rationales for why allowed attributes are necessary) and$\pi_{\text{disallow}}$(biased toward minimal disclosure, seeing rationales for why disallowed attributes are inappropriate). Teacher parameters are updated via Exponential Moving Average (EMA) of the student's parameters with an update rate of 0.001. -
Student Training Loop: The student model generates a response to the full task input (containing both allowed and disallowed attributes). At each token position, two reverse KL divergences are computed: one between the student's next-token distribution and
$\pi_{\text{allow}}$'s distribution, and another between the student and$\pi_{\text{disallow}}$. These are weighted by a coefficient$\lambda$(defaulting to 0.5) and summed, then backpropagated to update only the student parameters. -
Product-of-Experts Target: Under fixed teacher distributions, minimizing the weighted sum of reverse KL divergences is mathematically equivalent to matching a single target distribution proportional to
$\pi_{\text{allow}}^\lambda \cdot \pi_{\text{disallow}}^{1-\lambda}$. This product form assigns high probability only to tokens that both teachers agree on—the intersection where utility and privacy are simultaneously satisfied.
Information flows as follows: task input enters → feedback generator produces rationales → rationales condition teacher distributions → student generates a response → KL divergences to both teachers are computed at every token → student parameters are updated → teacher parameters are EMA-smoothed toward student → repeat for next task.
3.3 Roadmap for the Deep Dive
- First, the formal ideal CI state (Definition 2.1) and its token-level surrogate (Equation 1), because this defines what SELFCI is ultimately trying to approximate and why a direct optimization approach is under-specified.
- Second, the feedback generation mechanism (Section 3.1), since the entire framework depends on the model producing its own privileged context, and the quality of that context determines the quality of the teacher distributions.
- Third, the complementary teacher construction (Section 3.2, Equation 4), explaining how the same model parameters are conditioned differently to produce two specialized policies, and why EMA updates are necessary to maintain stable supervision targets.
- Fourth, the joint optimization objective (Section 3.2, Equation 5), including the derivation of the Product-of-Experts equivalence, why reverse KL rather than forward KL is used, and how the weighted sum structurally decomposes the retain/suppress asymmetry.
- Fifth, the theoretical connection to the ideal CI objective (Appendix G), establishing that minimizing the SELFCI loss provides an upper-bound surrogate for the ideal CI objective, with an explicit characterization of the approximation error.
3.4 Detailed, Sentence-Based Technical Breakdown
This is fundamentally an alignment framework paper whose core idea is that Contextual Integrity alignment requires structurally decomposing the retain/suppress asymmetry into two complementary self-teacher policies, with the student optimized toward their product-of-experts intersection rather than toward a single monolithic signal.
The Ideal CI State and Why Direct Optimization Falls Short
The paper grounds CI alignment in a formal definition of the ideal CI state (Definition 2.1). This is the theoretical target—what a perfectly CI-aligned model would look like—and it provides the conceptual framework from which SELFCI's design choices are derived.
Definition 2.1 restated. Given a task instruction $\mathcal{T}$ and a partition of accessible attributes into $\mathcal{A}_T$ (allowed, minimal sufficient subset for the task) and $\mathcal{D}_T$ (disallowed, inappropriate or unnecessary), a policy $\pi_\theta$ attains the ideal CI state if two conditions hold:
- Task completeness: The policy successfully completes the task when given only
$\mathcal{A}_T$,$\mathcal{T}$. - Context-dependent invariance: Adding
$\mathcal{D}_T$to the context does not change the policy's predictive distribution:
where $\pi_\theta(\cdot \mid \ldots)$ is the next-token distribution produced by the policy given a particular context.
What this means operationally. If you give the model only the allowed attributes, it produces correct responses. If you then add disallowed attributes to the context, the model behaves identically—it does not "notice" or "use" the disallowed information. This is inspired by Differential Privacy's notion of output invariance to input changes, but adapted to be context-dependent rather than context-independent: the invariance only applies to $\mathcal{D}_T$, not to all inputs. The model should be sensitive to $\mathcal{A}_T$; it should not be sensitive to $\mathcal{D}_T$.
The token-level surrogate (Equation 1). Because autoregressive generation produces a sequence of tokens, the equality of full distributions can be approximated by matching next-token distributions at each generation step, conditioned on the same prefix generated under the full-context policy. Formally:
where:
$y \sim \pi_\theta(\cdot \mid \mathcal{A}_T, \mathcal{D}_T, \mathcal{T})$means the generation prefix$y_{<t}$is sampled from the full-context policy (the actual deployment condition),$\pi_\theta(\cdot \mid \mathcal{A}_T, \mathcal{D}_T, \mathcal{T}, y_{<t})$is the student's next-token distribution given both allowed and disallowed attributes plus the prefix generated so far,$\text{stopgrad}(\pi_\theta(\cdot \mid \mathcal{A}_T, \mathcal{T}, y_{<t}))$is the reference distribution—the model's prediction given only the allowed attributes, with gradients blocked so this target is fixed during optimization,$D_{\text{KL}}(\cdot \mid\mid \cdot)$is the Kullback-Leibler divergence, measuring how much the full-context distribution diverges from the allowed-only distribution,- The expectation is over full-context rollouts and the sum is over all token positions in each rollout.
What it computes. For each token position in each generated response, it measures how much adding disallowed information changes the model's token probabilities, and averages this divergence across all prefixes and all rollouts. A perfectly CI-aligned model would achieve zero for this quantity. The $\text{stopgrad}$ operation on the reference ensures that gradients only flow through the full-context policy, pushing it toward matching the allowed-only behavior, rather than degrading the allowed-only behavior toward the full-context behavior.
Why this form. The autoregressive decomposition reflects how the model actually generates text: one token at a time, conditioned on previously generated tokens. The KL divergence is the natural information-theoretic measure of distributional difference, and it provides per-token gradients (unlike a sequence-level metric). The reference distribution is the allowed-only policy rather than a blank "no disallowed information" distribution because CI requires task completeness: the model must still use $\mathcal{A}_T$ effectively. The reference isn't a suppression-only target; it's intended to represent task-complete behavior with $\mathcal{D}_T$ treated as causally irrelevant.
Why direct optimization fails (the under-specification problem). The paper identifies a critical subtlety in Section 3. The allowed-only reference $\pi_\theta(\cdot \mid \mathcal{A}_T, \mathcal{T}, y_{<t})$ specifies what information is available but not how that information should be used in generation. Simply removing $\mathcal{D}_T$ from the context and forcing the full-context policy to match the allowed-only policy provides an unstable and potentially quality-degrading training signal:
- The allowed-only policy may not be task-complete: it knows which attributes are allowed but has no guidance on which allowed attributes are necessary for the task or how they should appear in the response. It might omit required attributes or produce responses that don't satisfy the task.
- The KL divergence pushes the full-context policy toward whatever behavior the allowed-only policy happens to exhibit, including its failures. If the allowed-only policy makes mistakes, those mistakes become the training target.
- As training proceeds, both policies evolve (since they share parameters), creating a moving-target problem where the reference distribution itself drifts, potentially destabilizing optimization.
The paper validates this empirically in Section 4.4 (Figure 5). Directly optimizing Equation 1 improves Integrity (the full-context policy leaks fewer disallowed attributes) but causes Utility to drop substantially, indicating that the allowed-only reference provides an inadequate signal for task-complete behavior. This motivates SELFCI's feedback-based decomposition: instead of a single under-specified reference, use two feedback-conditioned teachers that provide explicit guidance on why attributes should be retained or suppressed.
Feedback Generation (Section 3.1)
The feedback generation step is the mechanism by which SELFCI creates its own privileged context—the rationales that condition the teacher distributions. This is what makes the framework self-contained: no external teacher, no human-written rationales, no hand-crafted reward function.
Input data structure. The feedback generation operates on structured synthetic data from Lan et al. [22] (the CI-RL benchmark), which contains assistant-task instances with explicit attribute-level annotations. Each instance specifies:
- The task instruction
$\mathcal{T}$(e.g., "Send a message to the hotel staff to book a room"), - The sender, recipient, data subject, and the CI transmission principle that applies (one of Confidentiality, Proportionality, or Consent),
- The concrete attribute values partitioned into
$\mathcal{A}_T$(allowed, e.g., Name: "Alice Carter", CheckInDate: "January 15, 2024", RoomPreferences: "Ocean view suite") and$\mathcal{D}_T$(disallowed, e.g., DocumentID: "P1234567", MedicalNotes: "Currently taking RX2019 for hypertension"), - Annotation maps that identify which concrete attribute values are allowed (
$a^{(i)} \in \mathcal{A}_T$) and which are disallowed ($d^{(i)} \in \mathcal{D}_T$).
The three transmission principles (defined in Table 5) are:
- Confidentiality: Information unrelated to the context (task, sender, recipient relationship) should not be shared.
- Proportionality: Shared information should be proportionate to the task and not excessive.
- Consent: Information sharing depends on the awareness and consent of the data subject.
Feedback prompt templates. The paper introduces two instruction templates, $I_{\text{allow}}(\cdot)$ and $I_{\text{disallow}}(\cdot)$, illustrated in Figure 9:
$I_{\text{allow}}$: Given a task, recipient, data subject, attribute name, attribute value, and the rubric definition, asks the model to "provide feedback explaining strictly why sharing {keyword} is appropriate and aligns with Contextual Integrity in this specific context." The prompt explicitly states the attribute "has been flagged as APPROPRIATE (Allowed)" and instructs the model to base its explanation on the specified transmission principle.$I_{\text{disallow}}$: Similar structure but asks "why sharing {keyword} is a violation of Contextual Integrity," with the attribute "flagged as INAPPROPRIATE (Disallowed)."
Feedback generation procedure. For each task $\mathcal{T}$, the system iterates over every allowed attribute $a^{(i)} \in \mathcal{A}_T$ and every disallowed attribute $d^{(i)} \in \mathcal{D}_T$, generating one rationale per attribute:
where:
$f^{(i)}_{\text{allow}}$is a natural-language rationale explaining why$a^{(i)}$is appropriate to share,$f^{(i)}_{\text{disallow}}$is a natural-language rationale explaining why$d^{(i)}$violates CI,$\pi_\theta$is the base model (pre-training initialization, not the model being trained).
Why this is not circular. A critical design choice: the model is asked to explain given disclosure decisions, not to infer them from scratch. The prompt templates explicitly state whether the attribute is allowed or disallowed (via "has been flagged as APPROPRIATE" or "has been flagged as INAPPROPRIATE"). The model's job is to verbalize why that classification holds, grounded in the transmission principle definition. This means the feedback reflects the model's contextual understanding (through the lens of CI norms) while remaining anchored to the ground-truth attribute partition. The feedback is "on-policy" in the sense that it comes from the same model being trained, but it's not "on-policy" in the RL sense of being generated under the full task context—it's generated under a simpler justification prompt that gives away the answer.
Handling reasoning models. For models that produce reasoning traces (DeepSeek-R1, Olmo-3-Think, Qwen3-4B with thinking mode), the paper strips the reasoning block (everything between thinking and response tags) and retains only the final response. This ensures the feedback is concise and directly usable as privileged context, rather than containing extraneous reasoning that might confuse the teacher conditioning.
Quality considerations. The paper argues that self-generated feedback is sufficient for CI alignment because:
-
CI norms are verbalizable: Unlike some alignment dimensions that resist explicit articulation, the transmission principles (Confidentiality, Proportionality, Consent) have clear definitions that models can reference and apply to concrete attribute-task-recipient triples. The model doesn't need to discover the norms from scratch; it needs to apply known principles to specific cases.
-
Errors are not catastrophic: If the feedback mischaracterizes why an attribute is appropriate or inappropriate, the error propagates to the teacher distribution, making the teacher slightly less informative. But because the student is optimizing toward the joint support of both teachers, and because the feedback is attribute-specific (an error on one attribute doesn't corrupt feedback for other attributes), the framework is robust to imperfect feedback. Empirically, the paper shows that feedback-based teachers outperform keyword-only teachers (Tab. 2), confirming that the rationales provide useful signal beyond the simple attribute labels.
-
On-policy alignment: The feedback is generated by the same model being trained, so the language and reasoning style of the rationales naturally match the model's own internal representations. This reduces the distributional mismatch that would arise from using an external teacher's rationales.
Complementary Teacher Construction (Section 3.2, Equation 4)
Once feedback is generated for all attributes, the paper constructs two teacher distributions—$\pi_{\text{allow}}$ and $\pi_{\text{disallow}}$—that provide asymmetric supervision signals.
Feedback aggregation (Equation 3). For each group $g \in \{\text{allow}, \text{disallow}\}$, the attribute-level feedback is concatenated into a single text string:
where $\text{concat}(\cdot)$ is string concatenation and $\{f^{(i)}_g\}_i$ is the set of all feedback statements for attributes in group $g$. For the allow group, $\tilde{f}_{\text{allow}}$ contains one rationale per allowed attribute, all concatenated together. For the disallow group, $\tilde{f}_{\text{disallow}}$ contains one rationale per disallowed attribute. Figure 10 provides concrete examples: the allow suffix begins with "[NOTE] Only the following keywords are appropriate to share in this specific context:" followed by per-attribute rationales; the disallow suffix begins with "[NOTE] Following keywords are inappropriate to share in this specific context:" followed by per-attribute violation explanations.
Teacher policy definition (Equation 4). Writing the full task input as $x_\mathcal{T} := (\mathcal{A}_T, \mathcal{D}_T, \mathcal{T})$, the teacher policy for each group is defined by conditioning the same model parameters on the corresponding aggregated feedback:
where:
$\pi_\theta$is the model with current parameters$\theta$,$x_\mathcal{T}$is the full task context (allowed attributes, disallowed attributes, task instruction),$\tilde{f}_g$is the aggregated feedback for group$g$, prepended to the input as a suffix after the base CI-CoT prompt,$y_{<t}$is the generation prefix (the same prefix used by the student),$\pi_g(\cdot \mid \ldots)$is the next-token distribution produced by the model when it sees both the task and the feedback.
What this does operationally. $\pi_{\text{allow}}$ is the model's next-token distribution when it has read rationales explaining why each allowed attribute is necessary and appropriate. This makes it more likely to produce tokens that use those attributes in task-appropriate ways—it's a utility-oriented teacher. $\pi_{\text{disallow}}$ is the model's next-token distribution when it has read rationales explaining why each disallowed attribute violates CI norms. This makes it more likely to avoid tokens that reference those attributes—it's a privacy-oriented teacher.
Why the same parameters. This is the core self-distillation property: both teachers and the student share parameters $\theta$. The only difference is the conditioning context ($\tilde{f}_{\text{allow}}$ vs. $\tilde{f}_{\text{disallow}}$ vs. no feedback for the student). This means:
- No external model is needed. The "expertise" comes from the feedback, not from a larger or differently-trained model.
- The teachers remain close to the student's capabilities: they can't produce tokens the student couldn't produce, so the supervision signal is always within the student's reach. This prevents the problem of trying to imitate a teacher whose output distribution the student cannot match.
- As the student improves, the teachers can improve too (via EMA updates), maintaining the "close but slightly better" relationship.
Teacher update strategy (EMA). The paper uses Exponential Moving Average (EMA) [41] to update teacher parameters, rather than using the current student parameters directly or keeping teachers fixed:
where $\tau = 0.001$ is the update rate, $\theta_t$ are the student parameters at step $t$, and $\theta_{\text{EMA},t}$ are the teacher parameters at step $t$. The paper experiments with alternative update strategies (Tab. 8):
- No EMA (current student as teacher): Teachers are instantiated from the student's exact current parameters at each step. This is unstable because the target moves with the optimized policy and can reinforce transient errors. Tab. 4 shows this drops Complete from 55.34 to 47.12 on Qwen3-4B-Instruct.
- Fixed teachers: Teachers are initialized once and never updated. This becomes stale as training proceeds, since the student evolves and the fixed teachers no longer represent "slightly better" behavior.
- Tokenwise logit interpolation: Interpolating between student and teacher logits at each token position. This improves Utility but substantially reduces Integrity and Complete (Tab. 8).
- EMA only: Smooths the teacher parameters by maintaining an exponential moving average. This keeps teachers slightly behind the student (providing a stable target) while allowing them to adapt as the student improves. The paper sweeps update rates (Tab. 9): 0.01 improves final metrics but shows lower training stability; 0.0001 lags behind the student and underperforms; 0.001 provides the best balance.
Why EMA works for CI alignment. In self-distillation, the teacher must be simultaneously close enough to the student that the distillation target is reachable, and different enough that optimizing toward it provides a meaningful improvement signal. EMA with a small update rate creates a teacher that tracks the student's trajectory but with lower variance—it represents a smoothed version of the student's recent behavior. The feedback conditioning then shifts this smoothed distribution toward utility-preserving or privacy-enforcing behavior, creating a "slightly better" target that is both informative and attainable.
Joint Optimization Toward the Product-of-Experts (Section 3.2, Equation 5)
With two teacher distributions defined, SELFCI trains the student by minimizing a weighted sum of reverse KL divergences.
The training objective (Equation 5). Omitting the shared conditioning on $(x_\mathcal{T}, y_{<t})$ for brevity, the per-token loss is:
and the sequence-level objective is the expectation over student-generated rollouts:
where:
$\pi_\theta$is the student's next-token distribution (conditioned on full task context, no feedback),$\pi_{\text{allow}}$is the utility-oriented teacher's next-token distribution,$\pi_{\text{disallow}}$is the privacy-oriented teacher's next-token distribution,$\lambda \in [0,1]$controls the relative weight of the two teachers (default:$\lambda = 0.5$),$\text{stopgrad}(\cdot)$prevents gradients from flowing through the teacher distributions, treating them as fixed targets during backpropagation,$D_{\text{KL}}(P \;\|\; Q) = \sum_v P(v) \log \frac{P(v)}{Q(v)}$is the reverse KL divergence, summing over vocabulary tokens$v$.
What it computes. For each token position, the loss has two components. The first term $\lambda D_{\text{KL}}(\pi_\theta \;\|\; \pi_{\text{allow}})$ penalizes the student when it assigns low probability to tokens that the utility-oriented teacher assigns high probability—essentially, it pushes the student to respect the "these attributes are necessary" signal. The second term $(1-\lambda) D_{\text{KL}}(\pi_\theta \;\|\; \pi_{\text{disallow}})$ penalizes the student when it assigns high probability to tokens that the privacy-oriented teacher assigns low probability—it pushes the student away from the "these attributes are inappropriate" tokens. The sum is computed over all token positions in the student's own generated response, making the supervision on-policy (the student sees guidance conditioned on prefixes it actually generates).
Why reverse KL. The paper explicitly chooses reverse KL over forward KL. In reverse KL $D_{\text{KL}}(\pi_\theta \;\|\; \pi_{\text{teacher}})$, the expectation is under the student's distribution $\pi_\theta$. The penalty structure is:
$\pi_\theta(v) \log \frac{\pi_\theta(v)}{\pi_{\text{teacher}}(v)}$is large when$\pi_\theta(v)$is large but$\pi_{\text{teacher}}(v)$is small (the student assigns high probability to tokens the teacher dislikes).- It is small when
$\pi_{\text{teacher}}(v)$is large but$\pi_\theta(v)$is small (the teacher likes tokens the student ignores).
This asymmetry matters for CI alignment because the student should not imitate either teacher in isolation. It should avoid regions where either teacher assigns low probability (tokens that violate utility or privacy), but it doesn't need to cover all tokens that either teacher likes. Forward KL $D_{\text{KL}}(\pi_{\text{teacher}} \;\|\; \pi_\theta)$ would have the opposite penalty structure: it heavily penalizes the student for ignoring tokens that the teacher likes, which would push toward broader coverage and could cause the student to include tokens from both teachers' support—a "union" behavior rather than the desired "intersection" behavior. Tab. 7 empirically validates this: replacing either branch with forward KL reduces Complete scores.
The Product-of-Experts equivalence (Appendix F). Under fixed teacher distributions, minimizing the weighted sum of reverse KL divergences is mathematically equivalent to minimizing a single reverse KL divergence to a product-of-experts (PoE) target:
where the PoE target is:
and $Z_\lambda = \sum_{u \in \mathcal{V}} \pi_{\text{allow}}(u)^\lambda \cdot \pi_{\text{disallow}}(u)^{1-\lambda}$ is the normalization constant ensuring $P_{\text{PoE}}$ sums to 1.
What this equivalence means operationally. The PoE target multiplies the two teacher probabilities (raised to powers $\lambda$ and $1-\lambda$), then renormalizes. This multiplicative form has a sharp selection property: if either teacher assigns near-zero probability to a token $v$, the product is near-zero regardless of what the other teacher thinks. The only tokens that receive high probability in $P_{\text{PoE}}$ are those that both teachers endorse—tokens that simultaneously preserve task completeness (endorsed by $\pi_{\text{allow}}$) and maintain privacy (endorsed by $\pi_{\text{disallow}}$). This is the intersection of their support, not a compromise or average.
Why this is the right target for CI alignment. A linear combination of the two teacher distributions ($\lambda \pi_{\text{allow}} + (1-\lambda) \pi_{\text{disallow}}$) would create an average—tokens that are strongly endorsed by one teacher but rejected by the other would still receive moderate probability. This would produce "compromise" behavior where the model sometimes leaks disallowed attributes and sometimes omits allowed ones. The PoE's multiplicative form eliminates this: a token that the disallow teacher rejects (probability near zero) will have near-zero PoE probability regardless of how strongly the allow teacher endorses it. This enforces the joint satisfaction of utility and privacy, not a trade-off between them.
The role of $\lambda$. The coefficient $\lambda$ controls the relative influence of the two teachers in the PoE product. When $\lambda = 1$, $P_{\text{PoE}} \propto \pi_{\text{allow}}$—the student only cares about utility, ignoring privacy. When $\lambda = 0$, $P_{\text{PoE}} \propto \pi_{\text{disallow}}$—the student only cares about privacy, ignoring utility. Intermediate values balance the two. Section 4.5 (Figure 6, Left) empirically maps this trade-off: $\lambda = 0.25$ achieves high Integrity but lower Utility; $\lambda = 0.75$ achieves higher Utility but lower Integrity; $\lambda = 0.5$ provides the best Pareto balance. This is consistent with the PoE interpretation: $\lambda = 0.5$ gives equal exponent weight to both teachers, requiring equal agreement from both.
The quasi-static assumption. The PoE equivalence holds exactly only when the teacher distributions are fixed. In practice, teachers are updated via EMA with rate $\tau = 0.001$, which changes them slowly relative to the student's updates. Appendix F (Remark F.1) notes that if the Lipschitz constant of $\theta \mapsto \log \pi_\theta$ is bounded by $L$, the per-step deviation from the exact PoE gradient scales as $O(\tau)$. For the small $\tau$ used, the quasi-static approximation is reasonable, and the teachers effectively define a stable PoE target at each training step.
Per-token gradient structure. At each token position $t$, the gradient with respect to the student's logits $z_t$ decomposes as:
The gradient pushes up the logit for token $v$ when the student's probability $\pi_\theta(v)$ is below the weighted average of the teachers' probabilities, and pushes it down when it's above. Because both teachers contribute to the gradient, every token receives a signal that reflects both utility and privacy considerations. A token that $\pi_{\text{allow}}$ endorses but $\pi_{\text{disallow}}$ rejects will receive a mixed gradient—the exact behavior that (in aggregate, across the sequence) produces the PoE intersection property.
Theoretical Connection to the Ideal CI Objective (Appendix G)
The paper provides a theoretical justification for why optimizing the SELFCI loss approximates the ideal CI objective from Definition 2.1—establishing that the framework is not merely an ad-hoc decomposition but a principled surrogate for the true target.
Two-step bound. The connection is established in two steps (Theorem G.3):
Step 1: SELFCI loss upper-bounds divergence to PoE (Lemma G.1). For any $\lambda \in [0,1]$:
where $\log Z_\lambda \leq 0$ (by Hölder's inequality, since $Z_\lambda$ is a sum of weighted geometric means of probability distributions, which is at most 1). Therefore:
What this says. The SELFCI loss provides a conservative upper bound on the KL divergence to the PoE target. When the two teachers disagree (making $Z_\lambda < 1$ and $-\log Z_\lambda > 0$), the SELFCI loss is strictly larger than the divergence to the PoE target. This means minimizing the SELFCI loss forces the student to attend more sharply to the agreement region between the two teachers—exactly the desired behavior for CI alignment, since the agreement region is where utility and privacy are jointly satisfied.
Step 2: PoE divergence bounds ideal CI divergence (Lemma G.2, Theorem G.3). Using a variational change-of-measure argument with Rényi divergences, the paper shows that for any $\alpha > 1$:
where:
$P^A_\theta := \pi_\theta(\cdot \mid \mathcal{A}_T, \mathcal{T}, y_{<t})$is the allow-only ideal policy (the target of Equation 1),$D_\alpha(P \;\|\; Q) = \frac{1}{\alpha-1} \log \sum_v P(v)^\alpha Q(v)^{1-\alpha}$is the Rényi divergence of order$\alpha$.
What this says. The KL divergence to the ideal CI policy is bounded by (a scaled version of) the KL divergence to the PoE target, plus an alignment error term $D_\alpha(P_{\text{PoE}} \;\|\; P^A_\theta)$. This error term measures how well the PoE target approximates the true allow-only ideal policy—it captures the quality gap between SELFCI's self-generated feedback and a perfect oracle that knows exactly which attributes are necessary and how they should be used.
Combined bound (Theorem G.3). Chaining the two inequalities:
Taking expectations over tasks and student-generated prefixes:
where $L_{\text{CI}}(\theta)$ is the ideal CI objective (Equation 1, sequence-level expectation), $L_{\text{SELFCI}}(\theta)$ is the SELFCI training objective (Equation 5, sequence-level expectation), and $\delta_\alpha(\lambda, \theta) := \mathbb{E}_{\mathcal{T}, y \sim \pi_\theta}\left[\sum_t D_\alpha(P_{\text{PoE}} \;\|\; P^A_\theta)\right]$ is the alignment error.
Why this theoretical connection matters. It establishes that SELFCI is not optimizing an arbitrary proxy but is instead tightening an upper bound on the true ideal CI objective. Reducing the SELFCI training loss directly reduces the upper bound on the divergence to the ideal policy (up to the multiplicative constant $\alpha/(\alpha-1)$). The remaining gap $\delta_\alpha(\lambda, \theta)$ is the "quality of feedback" term: it shrinks as the PoE target becomes a better approximation of the allow-only ideal policy. If the self-generated feedback perfectly captured the CI norms (so that $P_{\text{PoE}}$ exactly matched $P^A_\theta$), the bound would be tight and minimizing SELFCI would be exactly equivalent to minimizing the ideal CI objective.
In practice, the feedback is imperfect, so $\delta_\alpha(\lambda, \theta)$ is non-zero. The paper's empirical results (Section 4.4, Figure 7, Right) show that the PoE target does move closer to the allow-only ideal policy over training epochs, confirming that the feedback-conditioned teachers become better approximations as the model improves.
Sensitivity to Design Choices and Hyperparameters
The paper explicitly validates several critical design choices through ablations and sensitivity analyses.
Keyword-only vs. feedback-based context (Table 2). Replacing the self-generated rationales with a simple listing of allowed and disallowed attribute keywords degrades Complete scores. On Qwen3-4B-Instruct, Complete drops from 55.34 (feedback) to 51.51 (keyword-only), and on the reasoning model Qwen3-4B, the drop is larger: from 57.26 to 45.21. The paper attributes this to the richer context provided by rationales: keywords specify what is allowed or disallowed, but feedback explains why, which provides a more informative conditioning signal for the teacher distributions.
Decomposed vs. monolithic teacher (Table 3). Concatenating all feedback ($\tilde{f}_{\text{allow}}$ and $\tilde{f}_{\text{disallow}}$) into a single context and optimizing a single KL divergence to the resulting monolithic teacher reduces Complete scores on both Qwen3-4B-Instruct (55.34 → 51.51) and Qwen3-4B (57.26 → 53.97). The per-step training time savings from a single teacher are marginal (about 5-6%), confirming that the computational overhead of maintaining two separate teachers is justified by the improved alignment.
KL direction (Table 7). Using reverse KL for both branches achieves the best Complete (55.34). Replacing either branch with forward KL reduces Complete (to 51.23 or 53.15), and using forward KL for both reduces it further to 50.68. This supports the PoE interpretation: reverse KL implements the intersection behavior because it penalizes the student for probability mass on regions unsupported by the teacher; forward KL penalizes the student for ignoring teacher-supported regions, pushing toward broader coverage (union behavior) that dilutes the privacy signal.
EMA update rate (Table 9). The paper sweeps $\tau \in \{0.01, 0.001, 0.0001\}$. The fastest rate (0.01) achieves the highest final metrics (Complete: 58.63) but shows lower training stability in early epochs. The slowest rate (0.0001) underperforms significantly (Complete: 48.77). The default 0.001 balances stability and performance.
Coefficient $\lambda$ (Figure 6, Left). Sweeping $\lambda \in \{0, 0.25, 0.5, 0.75, 1\}$ maps the privacy-utility Pareto frontier. $\lambda = 0$ (disallow-only) yields highest Integrity but lowest Utility; $\lambda = 1$ (allow-only) yields highest Utility but lowest Integrity; $\lambda = 0.5$ sits at the knee of the curve, providing the best joint satisfaction. This is consistent with the PoE formulation: equal exponent weighting ($\lambda = 0.5$) gives both teachers equal influence in the product, requiring equal agreement from both.
Training and Implementation Details
Base prompt template. All methods (including baselines) use the CI-CoT prompt template from Lan et al. [22], shown in Figure 8. This prompt instructs the model to "use the Contextual Integrity framework to guide your decisions" and requires a structured reasoning process within thinking and response tags, followed by a final answer within <answer> and </answer> tags. The reasoning phase asks the model to evaluate each personal attribute and justify disclosure decisions based on CI principles.
Student-teacher prompt difference. The student sees the base CI-CoT prompt with the full attribute set ($\mathcal{A}_T$ and $\mathcal{D}_T$). The teachers see the same base prompt with an appended suffix containing the aggregated feedback. The suffix format (Figure 10): "[NOTE] Only the following keywords are appropriate to share in this specific context:" followed by per-attribute rationales for $\pi_{\text{allow}}$, or "[NOTE] Following keywords are inappropriate to share in this specific context:" for $\pi_{\text{disallow}}$. This suffix is prepended before the model begins generation—it conditions the entire teacher distribution, not just a specific part of the output.
Optimization configuration. All experiments use AdamW [28] with a base learning rate of $1 \times 10^{-6}$ and a linear scheduler with warm-up over the first 10% of training steps. LoRA [16] is applied with rank $r = 32$, scaling factor $\alpha = 64$, and dropout 0.05 to the query and value projections in all attention layers. The total batch size is 2 (each batch contains one task instance, generating one student response and two teacher forward passes). Models are trained for 30 epochs on the CI-RL training split (590 instances), and the checkpoint with the highest Complete score on the CI-RL evaluation split (66 instances) is selected. All experiments run on a single NVIDIA H200 GPU.
Maximum output lengths. Instruction-tuned backbones use 2048 tokens maximum; reasoning backbones use 4096 tokens (to accommodate extended thinking traces).
Generation temperature. All rollouts (student generation, teacher evaluation) use temperature 0.7.
Reasoning model handling. For Qwen3-4B (which natively uses thinking mode), the paper follows the self-distillation approach of Zhao et al. [51]: during SELFCI training, the student model's thinking mode is disabled by inserting the prefix thinking\n response before the response delimiter in each assistant output, while the teacher model's thinking mode remains enabled. This ensures the student generates direct responses (not extended reasoning chains) while the teachers benefit from the richer thinking-mode distributions. At evaluation time, the student uses whatever its default behavior is (thinking mode enabled for Qwen3-4B).
Evaluation protocol. For all evaluations, five responses are sampled per prompt (temperature 0.7), and the mean of each metric is reported. On CI-RL, metrics are computed via normalized string matching against annotation maps after parsing only the final answer span (reasoning traces excluded). Utility is 1 when all required keywords are present; Integrity is 1 when no restricted keywords are present; Complete is 1 only when both conditions hold.
Summary of Design Choices and Their Justifications
-
Self-generated feedback over human-written rationales: Eliminates annotation cost, ensures on-policy language and reasoning style, and scales to diverse contexts. The feedback is anchored to ground-truth attribute annotations (the model explains given decisions, doesn't infer them from scratch), so it reflects CI norms without requiring the model to discover them.
-
Two complementary teachers over one monolithic teacher: Decomposes the asymmetric retain/suppress structure into explicit, specialized signals. A single teacher concatenating both feedback types provides less discriminative supervision (Tab. 3), likely because the mixed context blurs the distinction between "this attribute is necessary" and "this attribute is inappropriate."
-
Reverse KL divergence over forward KL: Implements the PoE intersection behavior rather than broad teacher coverage (union behavior). Reverse KL penalizes the student for probability mass on tokens any teacher rejects; forward KL penalizes the student for ignoring tokens any teacher endorses. The intersection (PoE) is the right target for joint utility-privacy satisfaction.
-
EMA teacher updates over fixed or current-parameter teachers: Balances target stability (current-parameter teachers are too volatile, causing optimization instability) against staleness (fixed teachers become progressively less informative as the student improves). The small update rate (
$\tau = 0.001$) ensures teachers track the student smoothly. -
Product-of-Experts (PoE) target over linear combination: Enforces joint satisfaction rather than compromise. A linear combination would allow tokens rejected by the privacy teacher to still receive non-zero probability if strongly endorsed by the utility teacher; the PoE's multiplicative form forces near-zero probability whenever either teacher disagrees.
-
LoRA for parameter-efficient fine-tuning: Preserves pretrained capabilities during CI alignment, following the observation from Biderman et al. [5] that LoRA "learns less and forgets less." This is important because CI alignment must add suppression behavior without degrading instruction-following ability.
-
$\lambda = 0.5$as default balance: Empirically sits at the Pareto frontier knee (Figure 6, Left), providing the best trade-off between Integrity and Utility. This is also the symmetric choice in the PoE formulation, giving equal exponent weight to both teachers. -
On-policy training with single-generation per prompt (vs. GRPO's 16 completions): Dramatically reduces computational cost (Figure 3, Right: 7.77 seconds per step vs. 15.02 seconds for CI-RL) while providing dense token-level supervision through the KL objective, which is more sample-efficient than sparse sequence-level rewards.
-
Checking against evaluation split for early stopping: Prevents overfitting to the training distribution. The CI-RL evaluation split uses different task instances than the training split, and the best checkpoint is selected based on Complete score—the joint metric that captures both utility and privacy.
4. Key Insights and Innovations
Innovation 1: Reframing CI Alignment as Context-Dependent Invariance with Asymmetric Pressures
The paper's most fundamental conceptual move is not a new algorithm but a diagnostic reframing of what CI alignment requires — one that reveals why prior approaches consistently fail the privacy-utility trade-off. Before this work, CI alignment was treated as a problem of teaching models to be "more private": reduce disclosure rates, suppress sensitive attributes, sanitize outputs. Methods optimized for this through supervised fine-tuning on privacy-compliant trajectories [8, 11, 19, 47], scalar reward maximization penalizing attribute leakage [17, 22], or inference-time output filtering [12, 24]. All of these share an implicit assumption: that privacy and utility lie on a single spectrum where improving one inherently sacrifices the other, and the best you can do is find an acceptable compromise point.
SELFCI argues that this framing misses the structural nature of CI. The requirement is not "be as private as possible while remaining somewhat useful." It is an asymmetric invariance: the model's behavior should be unchanged by the presence of disallowed attributes, while remaining fully responsive to allowed attributes. This is not a trade-off to be balanced — it is two distinct constraints that operate on different subsets of the input. Compromising between them (accepting some leakage to preserve some utility, or accepting some utility loss to reduce leakage) is a failure to satisfy either constraint properly.
The paper formalizes this through Definition 2.1 and the token-level surrogate in Equation 1, but the insight is more than a mathematical formalization. It provides a unified diagnostic lens for understanding why prior methods fail:
- Supervised fine-tuning fails because it learns what CI-compliant outputs look like rather than why certain attributes should be ignored — the model hasn't internalized the invariance, only mimicked its surface form. When test-time prefixes deviate from training trajectories (exposure bias [2]), the mimicry breaks down.
- Scalar reward RL fails because a single reward signal entangles the two asymmetric pressures. A low reward could mean the model omitted a required attribute or leaked a restricted one — credit assignment is ambiguous. The model can "succeed" at the scalar objective by becoming uniformly conservative (suppressing borderline allowed attributes) or uniformly permissive (leaking borderline disallowed attributes), since both strategies improve the reward in different regions of the input space.
- Inference-time filtering fails because it treats CI as output sanitation rather than an internalized reasoning capability — the model's generation process itself is unchanged, so filtering can only catch surface-level leaks and can't influence multi-step reasoning or intermediate tool states.
This reframing is what makes the SELFCI architecture conceptually necessary rather than merely one design choice among many. Once you accept that CI alignment requires two asymmetric pressures — an attractive force toward allowed-attribute usage and a repulsive force from disallowed-attribute usage — you need a training signal that decomposes these pressures. A single scalar reward or a single teacher distribution cannot provide this decomposition; two specialized teachers, each encoding one side of the asymmetry, are structurally required. The paper's empirical validation of this conceptual point is in the ablation showing that decomposing feedback into two teachers outperforms a single monolithic teacher by 3.83 Complete points on Qwen3-4B-Instruct (Table 3) — not because the single teacher has less information, but because collapsing the retain/suppress signals into one context entangles the asymmetric pressures and dilutes the training signal.
The significance of this reframing extends beyond SELFCI. It provides a template for thinking about other asymmetric alignment problems where the model must simultaneously be sensitive to one class of inputs and invariant to another: bias mitigation (invariant to protected attributes, responsive to task-relevant features), safety alignment (invariant to harmful prompts, responsive to benign ones), and multi-task deployment where different contexts activate different disclosure norms. The invariance framing makes explicit that these are not single-axis optimization problems — they require structurally decomposed training signals that respect the asymmetry.
Innovation 2: Self-Distillation with Complementary Teachers as a Decomposition Mechanism for Asymmetric Objectives
The paper's second distinctive contribution is the insight that self-distillation can be used not just for capability transfer but for structurally decomposing an asymmetric alignment objective. Self-distillation [18, 37, 51] has previously been understood as a technique for knowledge transfer: a student learns from an (often larger or differently-conditioned) teacher by matching its output distribution, typically to improve reasoning, enable continual learning, or incorporate privileged information at training time. The standard framing (Equation 6, Appendix A) treats the teacher as a superior policy — better informed, more capable, or more stable — and distillation as a way to transfer that superiority to the student.
SELFCI reinterprets self-distillation as a mechanism for objective decomposition. Rather than having one teacher that is "better" than the student, SELFCI creates two teachers that are each differently biased: π_allow is conditioned on rationales explaining why allowed attributes should be disclosed, making it biased toward task completeness; π_disallow is conditioned on rationales explaining why disallowed attributes should be suppressed, making it biased toward minimal disclosure. Neither teacher is correct in isolation — following π_allow would leak private information; following π_disallow would break task functionality. The student's job is not to imitate either teacher, but to find the region where both teachers agree: the PoE intersection.
This is a fundamentally different use of self-distillation than what appears in prior work. Previous self-distillation papers [18, 37, 51] use teachers that encode more information than the student (privileged context, ground-truth rationales, frontier-model completions) and distill down to the student. SELFCI's teachers encode different information — complementary biases — and the distillation target is the intersection of their preferences, not any single teacher's distribution. The PoE equivalence derived in Appendix F makes this precise: minimizing the weighted sum of reverse KL divergences is equivalent to matching a single target P_PoE ∝ π_allow^λ · π_disallow^(1-λ), which is not a compromise between the teachers but a multiplicative selection that only assigns high probability where both teachers agree.
This reinterpretation is significant beyond CI alignment because it provides a general recipe for decomposing asymmetric alignment objectives into specialized teachers. Consider any alignment problem where the model must satisfy constraints that pull in different directions:
- Create two (or more) teacher distributions, each conditioned on a privileged context that encodes one side of the asymmetry. The privileged context can be generated by the model itself (as in SELFCI) or provided externally.
- Optimize the student toward the PoE intersection of these teachers using reverse KL divergences. The reverse KL direction is critical here: it penalizes the student for assigning probability to regions any teacher rejects (intersection behavior), whereas forward KL would penalize for ignoring regions any teacher endorses (union behavior).
- Use EMA-updated teacher parameters to balance stability (preventing the target from moving too fast) against staleness (preventing the target from becoming outdated).
The paper validates this decomposition recipe through multiple ablation studies. Table 3 confirms that two specialized teachers outperform a single teacher that concatenates both feedback types — not because the single teacher has less total information, but because the decomposition makes the asymmetric structure explicit. Table 7 confirms that reverse KL is the right divergence direction — forward KL implements a "cover all teacher preferences" behavior that dilutes the privacy signal. Figure 6 (Left) confirms that λ smoothly controls the privacy-utility Pareto frontier, with λ = 0.5 (equal weight to both teachers) providing the best joint satisfaction — evidence that the PoE intersection, not a compromise between teacher distributions, is the mechanism at work.
The computational efficiency of this approach is a secondary but practically important consequence. Because the student generates only one response per training step (compared to 16 for GRPO-based CI-RL), and because the teachers are instantiated from the same parameters (requiring only additional forward passes, not separate model training), SELFCI achieves nearly 2× faster per-step training than online RL (Fig. 3, Right: 7.77 seconds vs. 15.02 seconds). This is not just an engineering detail — it reflects the conceptual efficiency of providing dense, decomposed supervision (KL divergences at every token) rather than sparse, entangled feedback (a single scalar reward per sequence).
Innovation 3: The Product-of-Experts Target as a Joint-Satisfaction Lens for Privacy-Utility Alignment
While the PoE formulation [15] is a known mathematical tool, the paper's application of PoE as a principled target for privacy-utility alignment represents a conceptual advance over prior approaches that treat privacy and utility as a single-axis trade-off. The dominant paradigm in privacy-preserving ML — from differential privacy's ε-δ budget [10] to RL-based CI alignment's scalar reward [22] — is to find an acceptable operating point on a privacy-utility curve: how much privacy can you get for a given utility cost, or vice versa. This framing implicitly accepts that privacy and utility are in tension — that improving one necessarily degrades the other — and the question is only how to navigate that tension.
SELFCI's PoE target challenges this framing. The product form P_PoE(v) ∝ π_allow(v)^λ · π_disallow(v)^(1-λ) does not average, interpolate, or compromise between the two teachers. It selects tokens that satisfy both constraints simultaneously. If π_disallow(v) ≈ 0 for some token v (the privacy teacher rejects it), then P_PoE(v) ≈ 0 regardless of how strongly π_allow endorses v. The PoE target is not a point on a trade-off curve — it is the intersection of two independent requirements. Privacy and utility are not traded against each other; they are jointly enforced.
This reframing matters because it changes what "improving CI alignment" means. Under the trade-off paradigm, an intervention that increases Integrity at the cost of some Utility might be considered successful — it moved the model along the Pareto frontier in the right direction. Under the joint-satisfaction paradigm, that same intervention would be considered a partial failure — the model hasn't learned to satisfy both constraints simultaneously; it's just trading one for the other. The Complete metric (which is 1 only when all required attributes are present and no restricted attributes are leaked) operationalizes this: improvements that come at the cost of Utility don't improve Complete, even if they improve Integrity.
The paper's empirical results support the joint-satisfaction interpretation. On Qwen2.5-7B-Instruct, CI-RL achieves Integrity of 73.70 (up from 35.34) but Utility drops from 68.22 to 61.10 — a clear trade-off pattern where privacy gain comes at a utility cost. SELFCI achieves Integrity of 83.56 with Utility at 62.19 — not only higher Integrity but with a comparable Utility cost, resulting in a substantially higher Complete (53.42 vs. 43.29). The gain is not in shifting the trade-off curve but in finding a point where both constraints are better satisfied simultaneously. This is the signature of joint satisfaction, not trade-off optimization.
The theoretical connection to the ideal CI objective (Appendix G) reinforces this interpretation. The ideal CI state (Definition 2.1) is not "as private as possible while remaining somewhat useful." It is a model that is perfectly invariant to disallowed attributes while perfectly responsive to allowed ones. This is a joint requirement — there is no trade-off to navigate, only a target to reach. SELFCI's PoE formulation provides a practical surrogate for that target: the PoE approximates the allow-only ideal policy, and minimizing the SELFCI loss tightens an upper bound on the divergence to that ideal (Theorem G.3). The remaining gap is an alignment error term — the quality of the PoE's approximation to the ideal — not a fundamental trade-off between privacy and utility.
This has practical implications for how CI alignment should be evaluated and pursued. Metrics that report only Integrity or only Utility are insufficient — they don't capture whether the model has learned joint satisfaction or is simply trading one for the other. Methods that optimize a scalar privacy-utility reward (like CI-RL) are structurally limited because they can succeed by trading, not by jointly satisfying. The PoE formulation suggests that future CI alignment work should focus on improving the quality of the decomposed signals (better feedback, better teacher conditioning, better approximation of the allow-only ideal) rather than on finding better scalar trade-off functions.
Innovation 4: Self-Generated Norm-Grounded Feedback as On-Policy Privileged Context
The paper's final distinctive insight is how to construct privileged context for self-distillation without external supervision — a problem that prior self-distillation work solved by relying on larger teacher models or human-written rationales. Standard context distillation [39] conditions the teacher on privileged context that is available at training time but not at deployment: ground-truth reasoning chains, retrieval-augmented documents, or completions from a more capable model. Self-distillation variants [18, 51] reduce the dependency on external models by using the same model as teacher, but still typically rely on externally-provided privileged context (e.g., ground-truth rationales from a dataset, or completions from a frozen instruction-tuned model).
SELFCI demonstrates that for CI alignment, the privileged context can be generated by the model itself through norm-grounded verbalization. The key design choice that makes this work is the feedback generation protocol (Section 3.1): the model is asked to explain given disclosure decisions, not to make disclosure decisions. The prompts I_allow and I_disallow (Figure 9) explicitly state whether the attribute is allowed or disallowed, provide the CI transmission principle definition, and ask the model to justify why that classification holds. This means:
- The feedback is anchored to ground truth (the attribute partition from the CI-RL dataset), so the model doesn't need to independently discover which attributes are allowed or disallowed — it only needs to articulate the normative reasoning that supports the partition.
- The feedback verbalizes principles the model already possesses. Instruction-tuned models have been trained on data that includes discussions of privacy norms, confidentiality, and appropriate information sharing. The feedback generation prompts simply elicit this existing knowledge in a context-specific format. The model doesn't need to learn new CI norms; it needs to apply norms it already understands to concrete cases.
- The feedback is on-policy in language and reasoning style because it's generated by the same model being trained. This eliminates the distributional mismatch that would arise from using human-written rationales or rationales from a different model family — the language patterns, level of detail, and argumentation style naturally match what the model itself produces.
The paper validates that this self-generated feedback provides signal beyond simple keyword labels. Table 2 shows that replacing the feedback-based teacher conditioning with a keyword-only context (listing attribute names but no rationales) reduces Complete by 3.83 points on Qwen3-4B-Instruct and by 12.05 points on the reasoning model Qwen3-4B. The larger drop on the reasoning model is particularly informative: reasoning models generate longer, more complex outputs where the richer conditioning signal from full rationales matters more. Keywords tell the model what is allowed or disallowed; rationales tell it why, and the "why" provides a more robust conditioning signal — especially when the model must make nuanced decisions across multiple token positions in a long generation.
This innovation matters beyond CI alignment because it suggests a general strategy for constructing self-supervised privileged context for alignment: identify a norm or principle that the model can verbalize (even if it doesn't consistently follow it), create prompts that elicit explanations of why particular decisions align with or violate that principle, and use those self-generated explanations as conditioning for teacher distributions. This could apply to safety alignment (generating explanations of why certain outputs are harmful), honesty alignment (generating explanations of why certain claims are true or false), or factual-grounding alignment (generating explanations of why certain information is supported by evidence). In each case, the model generates the privileged context itself, eliminating the annotation bottleneck that limits supervised approaches.
The self-contained nature of this feedback generation is what makes SELFCI scalable to larger models and diverse deployment contexts (consistent with the scaling behavior shown in Figure 6, Right). As model capabilities improve, the quality of self-generated feedback likely improves as well — better models produce better rationales, which produce better teacher distributions, which produce better-aligned students. This creates a virtuous cycle that is not available to methods relying on fixed external supervision.
5. Experimental Analysis
Evaluation Methodology
-
Dataset. The primary in-domain benchmark is CI-RL [22], a synthetic dataset of 729 assistant-task instances with explicit attribute-level annotations identifying which attributes are allowed (
A_T, minimally necessary for the task) and disallowed (D_T, inappropriate or unnecessary). Following the original split from Lan et al. [22], the paper shuffles all instances with seed 42 into 590 training, 66 evaluation, and 73 test instances. Each instance includes a task instruction, sender, recipient, data subject, CI transmission principle (one of Confidentiality, Proportionality, or Consent — defined in Table 5), concrete attribute values with their allowed/disallowed labels, and is rendered with the CI-CoT prompt template (Figure 8) that requires structured step-by-step reasoning before generating a final answer. Two out-of-domain benchmarks are used for generalization assessment: PrivacyLens [35], which evaluates CI behavior in tool-using agent trajectories through leakage rate and helpfulness-adjusted leakage rate metrics, and CIMemories [30], a compositional benchmark where user attributes accumulate across sequential tasks requiring increasingly many context-dependent disclosure decisions (Section 4.3). -
Base model(s). The paper applies SELFCI across a diverse set of seven backbones spanning two model categories. Instruction-tuned models: Qwen2.5-7B-Instruct [48], Llama-3.1-8B-Instruct [13], Olmo-3-7B-Instruct [34], and Qwen3-4B-Instruct-2507 [49]. Reasoning models: DeepSeek-R1-Distill-Llama-8B [14], Olmo-3-7B-Think [34], and Qwen3-4B [49]. The selection is designed to test SELFCI across different model families (Qwen, Llama, Olmo), scales (4B to 8B parameters), and reasoning paradigms (standard instruction-tuned vs. chain-of-thought reasoning models). The authors argue these models are representative of widely-used open-weight LLMs, and the inclusion of multiple families provides evidence that SELFCI's benefits are not architecture-specific.
-
Metrics. On the CI-RL test set, three complementary metrics are computed via normalized string matching against annotation maps after parsing only the final answer span (reasoning traces excluded): Utility is the fraction of instances where all required (allowed) keywords are present in the response; Integrity is the fraction where no restricted (disallowed) keywords appear; and Complete is the fraction where both conditions hold simultaneously — this is the primary joint-satisfaction metric. On PrivacyLens, privacy leakage is measured by Leakage Rate (LR) — the fraction of cases where the model's final action contains any disallowed sensitive attribute — and Adjusted Leakage Rate (ALR) — LR computed only over cases whose final action is judged helpful by GPT-5-mini [38] as an LLM-as-a-Judge, with helpfulness scored on a [0, 3] scale. On CIMemories, the paper reports Violation@5, an attribute-level ever-leakage rate that measures whether an attribute is inappropriately disclosed in any of 5 repeated generations, as a function of the number of tasks seen (accumulated memory). For all evaluations, five responses are sampled per prompt (temperature 0.7), and the mean of each metric is reported.
-
Baselines. Three baselines are compared: (1) Initial model: the backbone without any CI-specific adaptation, serving as a zero-shot reference capturing the policy's behavior prior to alignment. (2) CI-RL[22]: an online reinforcement learning baseline that optimizes the policy using GRPO [36] with a scalar reward
|A_present|/|A_T| - |D_present|/|D_T|(where A_present and D_present are the subsets of allowed and disallowed attributes present in the response), with format violations penalized at −1. The GRPO KL coefficient is β = 1×10⁻³, clipping threshold ε = 0.2, 16 completions per prompt, batch size 16 with 2 gradient accumulation steps. (3) ContextDistill[39]: an offline supervised fine-tuning baseline that constructs a target corpus by generating one response per training instance from a larger teacher model (32B to 70B parameters depending on student backbone, as listed in Table 6: e.g., Qwen2.5-32B-Instruct for Qwen2.5-7B-Instruct, Llama-3.1-70B-Instruct for Llama-3.1-8B-Instruct) conditioned on a single concatenated feedback context containing both allowed and disallowed attribute rationales, then fine-tunes the student on these teacher-generated responses with batch size 1 and 2 gradient accumulation steps. This baseline tests whether external-teacher distillation can capture CI norms without the asymmetric teacher decomposition of SELFCI. -
Generation budget / compute accounting. Fair comparison between methods is ensured by controlling the number of training epochs (all methods train for 30 epochs on the same 590-instance CI-RL training split), the number of gradient updates, and the underlying data budget (all methods see the same training instances). The paper explicitly compares wall-clock GPU time per training step (Figure 3, Right), measured on a single NVIDIA H200 GPU, to quantify computational efficiency: SELFCI requires one student rollout and two teacher forward passes per step (7.77 seconds for Qwen3-4B-Instruct), while CI-RL requires 16 completions per prompt for GRPO (15.02 seconds). No special compute normalizations are needed beyond this, since the training data, optimizer, and hardware are held constant.
-
Cross-validation / statistical protocol. The paper does not use cross-validation for model selection within the training pipeline; instead, it follows a standard train-evaluation-test split protocol. All optimization-based methods train on the CI-RL training split (590 instances), and the checkpoint with the highest Complete score on the CI-RL evaluation split (66 instances) is selected for final reporting. Results are then reported on the held-out CI-RL test split (73 instances), with five evaluation runs per instance to reduce sampling variance. For out-of-domain evaluation (PrivacyLens, CIMemories), the selected checkpoint is evaluated directly with no further fine-tuning or selection. On CIMemories, the 454 test scenarios are relabeled by GPT-5 [38] under a multi-judge protocol with mixed Westin privacy personas [20], labeling each attribute as necessary or inappropriate only if all personas agree. For feedback generation, the paper uses the CI-RL training split to generate rationales; no feedback is generated for test or out-of-domain instances.
Main Quantitative Results
In-Domain Performance on CI-RL: SELFCI Consistently Outperforms Baselines on Joint Privacy-Utility Satisfaction
Table 1 reports the core comparison across all seven backbones and three baselines on the CI-RL test set. The central finding is that SELFCI achieves the highest Complete score on every backbone without exception, with gains coming primarily from dramatically improved Integrity while maintaining or improving Utility relative to baselines.
On instruction-tuned models, the headline numbers are:
-
Qwen2.5-7B-Instruct: SELFCI achieves Complete 53.42, compared to Initial 23.29, CI-RL 43.29, and ContextDistill 43.01. The gain is driven by Integrity jumping from 35.34 (Initial) to 83.56 (SELFCI) — an improvement of 48.22 percentage points — while Utility remains at 62.19, only slightly below the Initial model's 68.22 and competitive with CI-RL's 61.10. Notably, CI-RL improves Integrity to 73.70 but drops Utility from 68.22 to 61.10, demonstrating the privacy-utility trade-off that SELFCI avoids. ContextDistill achieves Integrity of 66.85 and Utility of 64.38 — a more balanced but substantially weaker result than SELFCI on both Complete (43.01 vs. 53.42) and Integrity.
-
Llama-3.1-8B-Instruct: SELFCI achieves Complete 66.30, compared to Initial 34.79, CI-RL 64.38, and ContextDistill 54.25. Unlike the Qwen case, SELFCI matches CI-RL on Integrity (82.47 vs. 83.29) but substantially outperforms on Utility (81.10 vs. 78.36), resulting in a Complete advantage of 1.92 percentage points. This demonstrates that SELFCI's benefits manifest differently depending on the base model's prior: Llama-3.1-8B-Instruct already has strong privacy behavior (Initial Integrity of 65.21, much higher than Qwen2.5's 35.34), so the margin for Integrity improvement is smaller, but SELFCI better preserves Utility. ContextDistill lags substantially (Complete 54.25), suggesting that teacher-student distribution mismatch is more severe for this model family.
-
Olmo-3-7B-Instruct: SELFCI achieves Complete 51.00, compared to Initial 33.42, CI-RL 35.62, and ContextDistill 43.84. The Integrity gain is the largest across all instruction-tuned models: from 62.47 (Initial) to 90.70 (SELFCI) — a 28.23 point improvement — while Utility is essentially unchanged (56.44 vs. 56.70). CI-RL barely moves the needle (Complete 35.62 vs. 33.42), and ContextDistill achieves moderate gains (Complete 43.84) but at the cost of Utility dropping slightly (55.89 vs. 56.44). This pattern — SELFCI achieving large Integrity gains with minimal Utility cost — is consistent with the PoE intersection property: the model learns to suppress disallowed attributes without degrading its task-completion behavior.
-
Qwen3-4B-Instruct: SELFCI achieves Complete 55.34, compared to Initial 36.16, CI-RL 45.21, and ContextDistill 40.00. Integrity improves from 58.08 (Initial) to 85.21 (SELFCI), while Utility remains at 64.11 versus the Initial 65.75. CI-RL improves Integrity to 69.04 but drops Utility to 63.01 (Complete 45.21), and ContextDistill achieves Integrity 69.86 and Utility 60.27 (Complete 40.00). The gap between SELFCI and the next-best baseline (CI-RL) on Complete is 10.13 percentage points, the largest relative advantage among instruction-tuned models.
Across all four instruction-tuned backbones, SELFCI achieves an average Complete improvement of 19.83 percentage points over the Initial model and 10.10 percentage points over the best baseline (CI-RL). The Integrity improvement is consistently the driver: SELFCI achieves an average Integrity of 85.48 across instruction-tuned models, compared to 55.28 for Initial and 72.88 for CI-RL.
On reasoning models, the results show a similar pattern but with one important exception:
-
DeepSeek-R1-Distill-Llama-8B: SELFCI achieves Complete 49.86, compared to Initial 18.36, CI-RL 47.12, and ContextDistill 48.49. Interestingly, SELFCI achieves the highest Utility of any method on this backbone (68.49 vs. 55.89 for Initial, 62.74 for CI-RL, 62.19 for ContextDistill) but lower Integrity than CI-RL (71.51 vs. 79.45). This is the only case where SELFCI does not achieve the highest Integrity, suggesting that on reasoners, the balance between the two teachers leans toward Utility preservation. Despite this, the Complete score remains best, indicating that the Utility-Integrity combination is more favorable even when Integrity alone is not maximized.
-
Olmo-3-7B-Think: SELFCI achieves Complete 43.84, compared to Initial 27.40, CI-RL 30.14, and ContextDistill 32.33. The gain is driven by Integrity jumping from 43.84 to 77.81, while Utility drops slightly from 68.49 to 58.63 — a pattern consistent with the instruction-tuned results but with a larger Utility cost. CI-RL and ContextDistill show only marginal improvements over Initial, suggesting that reasoning models are particularly resistant to scalar reward and offline distillation approaches.
-
Qwen3-4B: SELFCI achieves Complete 57.26, the highest Complete score across all reasoning backbones, compared to Initial 26.03, CI-RL 26.85, and ContextDistill 43.29. The Integrity gain is dramatic: from 32.88 to 82.19, while Utility drops only moderately from 75.34 to 69.32. ContextDistill achieves a notable Improvement in Integrity (70.68) but drops Utility to 59.18 (Complete 43.29), indicating that the reasoning model benefits from the decomposition approach specifically because its longer outputs make the single-teacher signal less informative.
The consistent pattern across all seven backbones — SELFCI achieving the highest Complete score in every case — is the paper's strongest empirical claim. The mechanism behind these gains is partially illuminated by Figure 3 (Left), which plots the average D_KL from Equation 1 (measuring sensitivity to disallowed attributes) against the Complete score on the CI-RL test set for Qwen2.5-7B-Instruct. SELFCI achieves both the lowest D_KL (0.333) and the highest Complete (53.42), while the Initial model has the highest D_KL (0.854) and lowest Complete (23.29). CI-RL and ContextDistill fall between (0.505 and 0.438 D_KL, 43.29 and 43.01 Complete). This inverse relationship between invariance to disallowed attributes and joint satisfaction is consistent with the theoretical framing: models that are less sensitive to D_T are better at simultaneously preserving Utility and Integrity.
Training Efficiency: SELFCI Achieves Faster Convergence and Lower Per-Step Cost Than Online RL
Figure 3 (Middle and Right) quantifies the computational efficiency advantages of SELFCI over CI-RL on Qwen3-4B-Instruct. The per-epoch Complete scores (Middle) show that SELFCI exceeds 40% Complete by epoch 3 and continues to improve gradually, while CI-RL requires approximately 15 epochs to reach the same threshold. This 5× faster convergence in terms of epochs reflects the efficiency of dense token-level KL supervision compared to sparse sequence-level scalar rewards: SELFCI provides per-token guidance on which tokens to suppress or retain, while CI-RL must infer attribute-level decisions from a single scalar signal entangling all attributes.
The wall-clock comparison (Right) is equally striking: SELFCI requires 7.77 seconds per training step versus CI-RL's 15.02 seconds — a 1.93× reduction. This is because SELFCI generates only one student completion per prompt (plus two teacher forward passes that share most computation with the student forward pass through the same underlying model), whereas CI-RL's GRPO requires 16 completions per prompt. The combination of faster per-step training and faster convergence means SELFCI achieves its final performance using substantially less total compute than CI-RL.
Out-of-Domain Generalization to Agentic Tasks: SELFCI Reduces Privacy Leakage Without Degrading Task Fulfillment
Table 1 reports out-of-domain results on PrivacyLens, which evaluates CI behavior in tool-using agent trajectories — a substantially different deployment scenario from the CI-RL training distribution. The key finding is that SELFCI maintains its privacy advantages in this zero-shot transfer setting while also preserving helpfulness:
-
Qwen3-4B-Instruct: SELFCI achieves the lowest leakage among all methods: LR 47.06 (vs. Initial 56.59, CI-RL 53.75, ContextDistill 55.98) and ALR 48.17 (vs. Initial 58.14, CI-RL 54.40, ContextDistill 57.58). Critically, this leakage reduction does not come at the cost of helpfulness: SELFCI achieves the highest Helpful score of 2.62 (on the [0, 3] scale), up from the Initial 2.59 but substantially above CI-RL's 2.31 and ContextDistill's 2.55.
-
Qwen3-4B (reasoning model): The same pattern holds more strongly. SELFCI achieves LR 32.45 (vs. Initial 40.97, CI-RL 37.93, ContextDistill 40.77) and ALR 42.37 (vs. Initial 52.23, CI-RL 55.09, ContextDistill 52.90), with the highest Helpful score of 1.92 (vs. Initial 1.89, CI-RL 1.71, ContextDistill 1.86).
-
Olmo-3-7B-Instruct: SELFCI achieves LR 26.77 and ALR 30.37, both substantially lower than CI-RL (28.19, 46.58) and ContextDistill (29.41, 47.95), while achieving the highest Helpful score of 2.07 — a notable gain over the Initial model's 1.22. This is the clearest case where SELFCI simultaneously reduces leakage and improves utility in out-of-domain transfer.
The pattern is not uniform across all backbones. Llama-3.1-8B-Instruct shows a more mixed picture: SELFCI achieves LR 21.10 (close to CI-RL's 21.30) and ALR 26.53 (better than CI-RL's 32.42), with Helpful 1.43 (above CI-RL's 1.27 but below ContextDistill's 1.74). DeepSeek-R1-Distill-Llama-8B shows SELFCI with LR 36.31 (matching CI-RL's 36.71), ALR 37.11 (better than CI-RL's 39.58), and Helpful 1.92 (comparable to CI-RL's 1.98). The variability across backbones suggests that SELFCI's out-of-domain privacy benefits are most pronounced when the base model's initial privacy behavior is poor (Qwen3, Olmo families), and more modest when the base model is already relatively privacy-conscious (Llama family, which has the lowest Initial LR of 25.96).
The PrivacyLens results are significant because they test a fundamentally different type of CI behavior: CI-RL requires the model to disclose or suppress attributes in a direct response, while PrivacyLens requires the model to make disclosure decisions through tool calls and actions in a multi-step agent trajectory. That SELFCI transfers to this setting without additional training suggests it has learned a generalizable CI reasoning capability, not just surface-level suppression patterns.
Robustness Under Accumulated Memory: SELFCI Maintains Low Leakage as Private Context Grows
Figure 4 evaluates SELFCI on CIMemories [30], which tests a crucially different challenge: as the model observes more tasks, its memory of user attributes grows, and it must make increasingly many context-dependent disclosure decisions. The same attribute (e.g., a medical condition) may be appropriate for one recipient and task but inappropriate for another, and the model must track this across a growing pool of accumulated private information. Fixed suppression rules ("never share medical information") fail here because the appropriateness is context-dependent.
The results show that SELFCI (using Qwen3-4B-Instruct) keeps Violation@5 below 5% even after observing 48 tasks, while all baselines exhibit compounding privacy failures. The Initial model reaches approximately 26% Violation@5 after 48 tasks, CI-RL reaches approximately 21%, and ContextDistill also increases steadily (reaching approximately 17-18% at 48 tasks). The key pattern is the slope of the violation rate curve: the baselines show roughly linear growth in Violation@5 as more attributes accumulate, indicating that each new attribute creates additional opportunities for leakage that the model fails to navigate correctly. SELFCI's curve is essentially flat, suggesting that the model has learned a stable, context-conditioned disclosure boundary that correctly handles new attributes without additional leakage.
This result addresses a critical practical concern: personal agents accumulate user information over time, and CI alignment must scale to growing memory contexts. A method that works well on isolated tasks but degrades as context accumulates is insufficient for deployment. SELFCI's flat violation curve is evidence that the PoE intersection — jointly requiring task completion and minimal disclosure — produces a disclosure policy that generalizes across growing context, rather than memorizing attribute-specific suppression rules that break when new attributes appear.
The Privacy-Utility Pareto Frontier is Controlled by λ
Figure 6 (Left) sweeps the coefficient λ (the weight on the utility-oriented teacher in Equation 5) and maps the resulting Integrity-Utility trade-off on the CI-RL test set for Qwen3-4B-Instruct. The extreme values exhibit the expected failure modes: λ = 0 (trained only toward π_disallow) achieves the highest Integrity (approximately 87%) but lowest Utility (approximately 55%); λ = 1 (trained only toward π_allow) achieves the highest Utility (approximately 67%) but Integrity drops to approximately 60%. Intermediate values trace a convex Pareto frontier: λ = 0.25 yields Integrity near 85% and Utility near 58%; λ = 0.5 (the default) yields Integrity approximately 82% and Utility approximately 64%; λ = 0.75 yields Integrity approximately 75% and Utility approximately 66%.
The default λ = 0.5 sits at the knee of this curve, providing the best joint satisfaction as measured by Complete score (shown in the middle plot). This is consistent with the PoE interpretation: equal exponent weighting gives both teachers equal influence in the product, requiring equal agreement from both. Deviating from λ = 0.5 in either direction shifts the PoE target toward one teacher's distribution, causing the student to sacrifice either Integrity (for λ > 0.5) or Utility (for λ < 0.5).
Figure 6 (Middle) provides a complementary view by evaluating the teacher distributions themselves on the CI-RL training set. For each teacher (π_allow, π_disallow, and π_PoE — the normalized PoE target decoded with λ = 0.5), the per-epoch Complete score is shown. The π_PoE target achieves the highest Complete score after several epochs, rising above both individual teachers. This confirms that the PoE intersection is indeed a better distillation target than either teacher in isolation: the product form selects tokens that both teachers agree on, which corresponds to simultaneously satisfying task completeness and minimal disclosure. If π_allow or π_disallow were individually sufficient, their Complete scores would match or exceed π_PoE; that they don't indicates that the complementary teacher decomposition is generating a genuinely more informative target through the multiplicative intersection.
Scaling Behavior: SELFCI Improves Across Model Sizes While CI-RL's Gains Diminish
Figure 6 (Right) evaluates SELFCI across the Qwen3 model family at four scales: 0.6B, 1.7B, 4B, and 8B parameters (corresponding to Qwen3-0.6B, Qwen3-1.7B, Qwen3-4B, Qwen3-8B). The Initial model's Complete score increases with scale (from approximately 8% at 0.6B to approximately 24% at 8B), indicating that larger models have better inherent CI behavior. CI-RL improves over Initial at small scales (achieving approximately 28% at 0.6B, a large relative gain) but its advantage diminishes: at 4B, CI-RL achieves approximately 24% vs. Initial's approximately 23%, and at 8B, CI-RL's advantage is marginal (approximately 26% vs. approximately 24%). This suggests that scalar reward optimization is most effective when the base model's behavior is far from CI-compliant but provides diminishing returns as the base model's prior becomes stronger — larger models already have a strong instruction-following prior that scalar rewards struggle to override without degrading utility.
SELFCI, in contrast, improves over the Initial model at every scale, with the gap growing at larger sizes: from approximately 18% at 0.6B to approximately 50% at 8B — a gain of 25.74 percentage points over the Initial model and 23.74 points over CI-RL at the largest scale. The improvement is relatively smaller at 0.6B (approximately 10 percentage points over Initial), which the paper attributes to weaker in-context learning capability limiting the quality of self-generated feedback and teacher conditioning. At larger scales, where the model's ability to understand and use the feedback context improves, SELFCI's advantages compound.
This scaling trend has important practical implications: it suggests that SELFCI is a viable alignment strategy for increasingly capable models, where obtaining an external teacher (as in ContextDistill) becomes impractical (the teacher would need to be even larger) and where scalar reward RL (as in CI-RL) provides insufficient signal to overcome strong task-completion priors.
Ablation Studies and Robustness Checks
-
Keyword-only vs. feedback-based privileged context (Table 2): Replacing the self-generated rationales with a simple listing of allowed and disallowed attribute keywords (without explanatory rationales) substantially degrades Complete scores. On Qwen3-4B-Instruct, Complete drops from 55.34 (feedback) to 51.51 (keyword-only) — a 3.83 point decrease. On the reasoning model Qwen3-4B, the drop is much larger: from 57.26 to 45.21 — a 12.05 point decrease. The keyword-only context boosts Integrity (88.49 vs. 85.21 on Qwen3-4B-Instruct) but causes a disproportionate drop in Utility (60.55 vs. 64.11), suggesting that without rationales explaining why attributes should be used, the model becomes overly conservative and suppresses allowed attributes it should retain. The larger drop on the reasoning model indicates that the richer conditioning signal from full rationales is especially important for longer, more complex generations where per-token decisions about attribute usage accumulate.
-
Decomposed vs. single monolithic teacher (Table 3): Concatenating all feedback (both
˜f_allowand˜f_disallow) into a single privileged context and optimizing a single KL divergence to the resulting monolithic teacher reduces Complete scores. On Qwen3-4B-Instruct, Complete drops from 55.34 (SELFCI, two teachers) to 51.51 (single teacher) — a 3.83 point decrease. On Qwen3-4B, the drop is 3.29 points (from 57.26 to 53.97). The single-teacher variant achieves slightly higher Integrity in one case (86.03 vs. 85.21 on Qwen3-4B-Instruct) but at the cost of substantially lower Utility (61.10 vs. 64.11). The per-step training time is only marginally lower with a single teacher (7.38 vs. 7.77 seconds on Qwen3-4B-Instruct, a 5% reduction; 7.97 vs. 8.52 seconds on Qwen3-4B, a 6.5% reduction), confirming that the computational overhead of maintaining two separate teacher distributions is justified. This ablation is central to the paper's claim that decomposing the retain/suppress signals is structurally necessary: a single teacher that sees both feedback types cannot provide the discriminative supervision that two specialized teachers provide. -
KL divergence direction (Table 7): The paper compares four combinations of forward and reverse KL for the allow and disallow branches on Qwen3-4B-Instruct. Reverse KL on both branches (the default) achieves the best Complete (55.34). Replacing only the disallow branch with forward KL (RKL + FKL) yields higher Integrity (86.58 vs. 85.21) but lower Utility (63.84 vs. 64.11) and lower Complete (53.15). Replacing only the allow branch with forward KL (FKL + RKL) yields higher Integrity (86.58) but substantially lower Utility (60.55) and Complete (51.23). Forward KL on both branches (FKL + FKL) yields the highest Integrity (87.67) but the lowest Utility (57.81) and Complete (50.68). The pattern is clear: forward KL tends to make the student cover teacher behavior more broadly, which increases suppression (higher Integrity) but also sacrifices task-relevant attribute usage (lower Utility). Reverse KL implements the desired intersection behavior — penalizing the student for probability mass on tokens any teacher rejects, rather than penalizing for ignoring tokens any teacher endorses.
-
Teacher update strategy (Table 8): On Qwen3-4B-Instruct, EMA (the default) achieves Complete 55.34. Using the current student parameters as the teacher at every step (no EMA, equivalent to the "Interp" row interpolating student-teacher logits with weight 0, since the teacher is just the student) substantially degrades performance: Complete drops to 47.12, Integrity drops to 74.25 (from 85.21), though Utility slightly improves (66.03 vs. 64.11). Tokenwise logit interpolation between student and teacher (Interp) similarly underperforms (Complete 47.12). Adding interpolation to EMA (EMA + Interp) improves Integrity to 89.04 but drops Utility to 62.74 and Complete to 54.79 — slightly below pure EMA. The instability of current-parameter teachers is expected: the target moves with the optimized policy and can reinforce transient errors. EMA provides the best balance between target stability and adaptation.
-
EMA update rate (Table 9): Sweeping the EMA update rate τ ∈ {0.01, 0.001, 0.0001} on Qwen3-4B-Instruct: τ = 0.01 achieves the highest final Complete (58.63) and Utility (68.77) but the paper notes lower training stability (likely oscillatory behavior, though not quantified). τ = 0.001 (default) achieves Complete 55.34 with stable training. τ = 0.0001 underperforms significantly (Complete 48.77), as the teacher lags too far behind the student and provides an outdated supervision target. The trade-off between final performance and training stability at τ = 0.01 vs. 0.001 mirrors standard findings in EMA-based self-distillation: faster updates provide a more responsive teacher but risk creating feedback loops where the teacher and student co-evolve unstably.
-
Direct optimization of the ideal CI surrogate vs. SELFCI (Figure 5): This is the critical ablation connecting the theoretical framework to the empirical design. On Qwen3-4B-Instruct, directly optimizing Equation 1 (the token-level ideal CI surrogate, matching the full-context policy to the allowed-only policy) improves Integrity over training epochs but causes Utility to drop substantially (Figure 5, Right). In contrast, SELFCI (optimizing Equation 5 toward the two feedback-conditioned teachers) retains Utility while improving Integrity. Figure 5 (Left) explains why: the allowed-only reference distribution (used as the target in Equation 1) achieves lower Utility (58.63) than the PoE target induced by SELFCI (70.68), confirming that the allowed-only target provides an under-specified utility signal. This ablation directly validates the paper's central design claim: the allowed-only reference is insufficient for task-complete behavior, and the feedback-conditioned PoE target provides a more practical optimization objective.
-
External vs. self-teacher (Table 4): On Qwen3-4B-Instruct, replacing the self-teacher with a fixed feedback-conditioned larger teacher (Qwen3-32B with thinking disabled) degrades Integrity to 75.89 (from 85.21) and Complete to 51.23 (from 55.34), though Utility slightly improves (66.03 vs. 64.11). This suggests that the larger teacher's output distribution differs enough from the student's that the distillation signal becomes less effective — distributional mismatch offsets the benefit of greater teacher capacity. An offline variant of self-distillation (constructing target responses from the student itself conditioned on feedback, then training on those fixed responses) performs worse still: Integrity 73.97, Utility 57.53, Complete 38.08. This confirms that on-policy distillation (where the student trains on its own current-epoch generations) is important, likely because the student's behavior evolves during training and offline targets become stale.
-
Teacher dynamics toward the ideal CI policy (Figure 7): This analysis tracks how the three teacher targets (π_allow, π_disallow, π_PoE) evolve relative to the allow-only ideal policy during training on Qwen3-4B-Instruct. The per-epoch Integrity and Utility of the teachers (Left and Middle) show that π_disallow maintains high Integrity but low Utility; π_allow maintains high Utility but lower Integrity; and π_PoE achieves intermediate values that improve over training. The average token-level KL divergence to the allow-only ideal policy (Right, computed via Equation 7) shows that all three teachers move closer to the ideal over epochs. π_disallow achieves the lowest divergence (consistent with its strong privacy bias, since the ideal policy suppresses disallowed attributes), while π_allow remains farther away (since it's more permissive). π_PoE reduces divergence substantially and eventually approaches π_disallow in KL while retaining higher Complete, confirming that the PoE target improves alignment with the ideal without collapsing into pure suppression.
-
Generalization of sequential-to-parallel ratio findings from revision experiments: Not applicable — this paper does not have revision or sequential-vs-parallel sampling experiments. This is a single-axis alignment framework without the sequential/parallel decomposition studied in the example paper.
Critical Assessment
The experimental evaluation provides strong evidence for SELFCI's effectiveness on the CI-RL benchmark and demonstrates promising generalization to out-of-domain agentic settings. However, several aspects of the experimental design limit the strength of the conclusions that can be drawn.
Do the experiments support the claim that SELFCI "consistently outperforms competitive baselines"? Yes, with qualifications about the narrowness of the baselines. Table 1 shows SELFCI achieving the highest Complete score on all seven backbones, with consistent and often large margins. The comparison against the two most relevant learning-based baselines (CI-RL for online RL, ContextDistill for offline distillation) is fair: all methods use the same training data, the same number of epochs, the same evaluation protocol, and comparable compute budgets (with SELFCI actually being more efficient). However, the paper does not compare against several plausible alternative approaches: (a) multi-objective RL that decomposes the scalar CI-RL reward into separate utility and privacy components with separate optimization; (b) a KL-constrained variant of CI-RL that penalizes deviation from the base model to preserve Utility; (c) a supervised fine-tuning baseline that trains on CI-compliant trajectories generated by the same model (not a larger teacher), which would control for the teacher-student capacity gap in ContextDistill. The absence of these baselines means SELFCI's advantages might be partly attributable to the specific weaknesses of the chosen baselines rather than to the inherent superiority of complementary self-distillation. The paper does include a relevant ablation in Table 4 (offline self-teacher distillation), which performs poorly, suggesting that on-policy self-distillation is genuinely important — but this doesn't fully address whether alternative online methods could match SELFCI's performance.
Does the paper demonstrate that SELFCI "decouples information suppression from task resolution" as claimed in the abstract? The evidence supports a somewhat more modest claim: SELFCI achieves better joint satisfaction of privacy and utility than baselines that optimize a single objective, and the ablations (Table 3, Figure 5) indicate that the decomposition into two teachers is important for this outcome. However, "decoupling" implies that the retain and suppress mechanisms operate independently — that improving Integrity should not affect Utility, and vice versa. The λ sweep in Figure 6 (Left) shows that this is not the case: changing λ shifts both Integrity and Utility along a clear Pareto frontier, indicating that the two objectives remain coupled in the optimization. The PoE intersection provides better joint satisfaction than a single objective, but the paper does not demonstrate true independence of the two pressures. A more accurate characterization would be that SELFCI reduces the trade-off tension — it achieves higher Integrity at a given Utility level, and higher Utility at a given Integrity level — rather than eliminating the trade-off entirely.
Does the generalization to PrivacyLens and CIMemories establish that SELFCI "provides a practical path toward CI alignment" for real-world deployment? The out-of-domain results are encouraging but limited in several ways. PrivacyLens and CIMemories are still synthetic benchmarks with explicit attribute annotations — they are not real user data with ambiguous, context-dependent disclosure norms. The PrivacyLens evaluation uses GPT-5-mini as an LLM judge for helpfulness, which introduces potential confounding: if the judge model shares similar biases to the evaluated model, the helpfulness scores may not reflect genuine task fulfillment. The paper does not report human evaluation of response quality or privacy appropriateness, which would substantially strengthen the deployment case.
The CIMemories result (Figure 4) is striking — SELFCI maintains sub-5% Violation@5 across 48 tasks — but it's evaluated only on Qwen3-4B-Instruct. The paper doesn't show whether this robustness holds across other backbones, which matters because Figure 4's flat violation curve might be partially attributable to this specific model's characteristics rather than to SELFCI generally. Additionally, the Violation@5 metric captures any leakage over 5 generations, which is a conservative measure of worst-case behavior — it doesn't characterize the severity of leakage (leaking a full medical history vs. a single attribute name) or the frequency (one violation in 48 tasks vs. consistent violations). A more nuanced privacy metric would strengthen the claim.
Does the scaling analysis (Figure 6, Right) demonstrate that SELFCI "offers a practical route to scaling alignment to stronger models"? The scaling trend is promising but evaluated on only four model sizes within a single model family (Qwen3). The paper doesn't test whether SELFCI's advantages hold at larger scales (e.g., 32B, 70B parameters) or whether they transfer to frontier-scale models (100B+ parameters) where self-generated feedback quality might differ substantially. The 0.6B result is also notable: SELFCI provides only a modest improvement at this scale, which the paper attributes to weaker in-context learning. This implies a lower bound on model capability below which SELFCI's self-distillation mechanism doesn't work well — but the paper doesn't characterize this boundary. If the practical target is deployment of small on-device models, the weak performance at 0.6B is a significant limitation that the paper acknowledges but doesn't deeply investigate.
The test set size is small. The CI-RL test set contains only 73 instances. With five evaluation runs per instance (365 total evaluations), the statistical power is limited for detecting small differences between methods. The paper doesn't report confidence intervals, standard deviations, or significance tests for any metric. Some of the reported Complete score differences — particularly between SELFCI and CI-RL on backbones where the gap is small (e.g., DeepSeek-R1-Distill-Llama-8B: 49.86 vs. 47.12, a 2.74 point gap) — might not be statistically significant on a test set of 73 instances split across five evaluation runs. The paper would benefit from reporting variance across evaluation runs and from using a larger or more diverse test set.
The training data is entirely synthetic and structured. SELFCI relies on the CI-RL dataset's explicit attribute annotations to construct the feedback templates (I_allow and I_disallow require knowledge of which attributes are allowed vs. disallowed, and which CI transmission principle applies). In real deployment, this annotation would need to come from somewhere — either human labeling (expensive) or automated classification (error-prone). The paper does not evaluate how SELFCI performs when the attribute partition is noisy or ambiguous, which would be the realistic case. The PrivacyLens and CIMemories evaluations test out-of-domain generalization in terms of task format but still rely on the underlying CI-RL training with clean annotations. The framework's robustness to annotation quality is an important unexamined variable.
The feedback generation is done once and never updated during training. The paper generates feedback from the base (pre-training) model and uses this fixed feedback throughout SELFCI training. However, the student model changes substantially during training (as shown by the improving Complete scores in Figure 3, Middle), which means the feedback — generated by the pre-training model — becomes increasingly off-policy relative to the model's current understanding of CI norms. The paper doesn't experiment with regenerating feedback periodically during training (which would be more expensive but potentially more informative) or with using the EMA-updated teacher to regenerate feedback. The fixed feedback might limit how much the model can improve, since the teacher conditioning is anchored to the base model's (potentially flawed) CI reasoning.
A missing ablation: what happens if you train SELFCI without the CI-CoT prompt? All experiments use the CI-CoT prompt template (Figure 8), which explicitly instructs the model to reason about CI principles before generating a response. This prompt itself might be doing substantial work — the model might be learning to attend to the CI instructions rather than internalizing CI norms. An ablation testing SELFCI with a standard (non-CI-prompted) task format would reveal whether the alignment generalizes beyond the CI-CoT scaffolding.
A missing comparison: what happens if you simply include the feedback as part of the training prompt? A simpler baseline than SELFCI would be to fine-tune the model on training instances where the CI-CoT prompt is augmented with the self-generated feedback (both allow and disallow rationales), treating the feedback as additional in-context instruction. This would test whether feedback is effective as explicit guidance (at both training and inference time) rather than as a teacher conditioning mechanism (only at training time). If this simpler approach works, it would undermine the claim that the complementary teacher decomposition is necessary.
Overall, the experiments convincingly demonstrate that SELFCI outperforms CI-RL and ContextDistill on the CI-RL benchmark and transfers reasonably to PrivacyLens and CIMemories. The ablation studies provide good evidence that the complementary teacher decomposition and feedback-based context are important for this performance. However, the claims of providing a "practical path toward CI alignment" for real-world deployment are supported only for synthetic, cleanly-annotated settings with relatively small models (≤8B parameters) and small test sets. Extrapolation to production deployment would require evaluation on naturally-occurring user data with ambiguous disclosure norms, testing at larger model scales, characterization of robustness to annotation noise, and human evaluation of both privacy appropriateness and task fulfillment.
6. Limitations and Trade-offs
SELFCI Relies on Structured Synthetic Data with Explicit Attribute Annotations
The assumption or constraint. The feedback generation mechanism (Section 3.1) requires training data where each attribute is explicitly labeled as allowed ($\mathcal{A}_T$) or disallowed ($\mathcal{D}_T$), and where the applicable CI transmission principle (Confidentiality, Proportionality, Consent) is specified. The paper acknowledges this explicitly: "SELFCI relies on structured synthetic data [22] with explicit attribute annotations, which may not fully capture real-world ambiguity in CI norms." The feedback templates $I_{\text{allow}}$ and $I_{\text{disallow}}$ (Figure 9) require knowing which attributes are allowed/disallowed and which CI rubric applies, since those are filled into the prompt. Without this annotation, the model cannot generate the normative rationales that condition the teacher distributions.
The consequence. In real deployment, attribute-level disclosure annotations do not exist naturally. Someone—either a human annotator or an automated classifier—must label every piece of user information as appropriate or inappropriate for each task, recipient, and purpose combination. This is expensive at scale and error-prone: CI norms are context-dependent and often ambiguous (is sharing a phone number with a delivery service "necessary" or merely "helpful"? Is sharing a previous purchase history with a customer support agent appropriate under proportionality or a violation of confidentiality?). If annotations are noisy or inconsistent, the feedback rationales become correspondingly unreliable, and the teacher distributions $\pi_{\text{allow}}$ and $\pi_{\text{disallow}}$ encode misleading signals. The framework provides no mechanism for handling annotation uncertainty—the feedback is conditioned on binary allowed/disallowed labels, not on confidence scores or ambiguous cases. A real assistant encountering genuinely ambiguous disclosure decisions (where reasonable people disagree about whether sharing is appropriate) has no training signal for navigating that ambiguity.
What evidence exists in the paper. None. All experiments (CI-RL, PrivacyLens, CIMemories) use benchmarks with clean, pre-annotated attribute partitions. The paper does not evaluate SELFCI under noisy, incomplete, or ambiguous annotations, nor does it report sensitivity to annotation quality. The out-of-domain generalization results (PrivacyLens, Section 4.2) test task-format transfer but still rely on the underlying CI-RL training with ground-truth annotations. The paper does not characterize the annotation cost of the CI-RL dataset (how many person-hours per instance, what level of CI expertise is needed), which makes it difficult for practitioners to estimate the cost of applying SELFCI to a new domain.
Mitigation status. The paper acknowledges the limitation (quoted above) but makes no attempt to address it. The authors position all baselines as operating under the same data budget—"all baselines are compared under the same data budget and number of gradient updates"—which is true for the specific experimental comparison but does not address the deployability gap. A practitioner wanting to use SELFCI on their own domain would need to either manually annotate attribute disclosure decisions or develop an automated annotation pipeline, neither of which is discussed or evaluated.
SELFCI Requires Models with Sufficient In-Context Learning Capability
The assumption or constraint. The entire self-distillation mechanism depends on the model's ability to (1) generate useful feedback rationales when prompted with $I_{\text{allow}}$ and $I_{\text{disallow}}$, and (2) condition its own next-token distribution on that feedback when acting as a teacher. Both of these are in-context learning behaviors—the model must read the feedback context and adjust its predictions accordingly. The paper acknowledges this dependency: "like other self-distillation methods, SELFCI relies on the model's ability to generate and use feedback as privileged context, which may limit its effectiveness for smaller models (i.e., Qwen3-0.6B) with weaker in-context learning ability."
The consequence. SELFCI's efficacy degrades substantially as model capability decreases. At very small scales, the self-generated feedback is likely incoherent or uninformative (the model lacks the reasoning capacity to articulate why a disclosure decision aligns with CI principles), and the teacher conditioning provides a weak or noisy signal (the model cannot effectively adjust its predictions based on the feedback context). This creates a lower bound on model size below which SELFCI provides minimal benefit—and potentially a worse outcome than simpler approaches (like rule-based attribute suppression or a smaller but CI-focused supervised fine-tuning dataset). For practitioners deploying small on-device models where CI alignment is critical (e.g., privacy-focused edge assistants), SELFCI may not be viable even if the annotation problem (Limitation 1) is solved. Conversely, at larger scales, the paper does not evaluate whether self-generated feedback quality saturates or whether teacher conditioning continues to provide additive value over the base model's already-improved privacy reasoning. The scaling result in Figure 6 (Right) shows improvement from 4B to 8B, but doesn't test 32B or 70B models, leaving the upper bound of SELFCI's effectiveness unknown.
What evidence exists in the paper. Figure 6 (Right) shows that SELFCI's Complete score improvement over the Initial model is much smaller at Qwen3-0.6B (approximately 10 percentage points, from ~8% to ~18%) compared to Qwen3-8B (approximately 26 percentage points, from ~24% to ~50%). The paper explicitly attributes this to weaker in-context learning. The keyword-vs-feedback ablation (Table 2) shows a larger drop from feedback to keyword-only conditioning on the reasoning model Qwen3-4B (12.05 Complete points) than on the instruction-tuned Qwen3-4B-Instruct (3.83 points), suggesting that feedback quality and in-context utilization vary across model types as well as scales.
Mitigation status. The paper acknowledges the limitation explicitly and leaves it unresolved. No experiments test whether alternative feedback formats (simpler language, more structured rationales, chain-of-thought decomposition) could improve SELFCI's performance at small scales. No experiments characterize the minimum in-context learning capability needed for effective self-distillation, nor whether pre-training the model with CI examples before applying SELFCI could bootstrap smaller models.
The Feedback Is Generated Once and Becomes Progressively Off-Policy During Training
The assumption or constraint. SELFCI generates feedback from the base model (prior to any CI alignment training) and uses this fixed feedback to condition the teacher distributions throughout all 30 training epochs. However, as the student model is trained, its understanding of CI norms and its generation behavior change substantially—this is the intended effect of alignment. The feedback rationales, generated by the pre-trained model, reflect the base model's (potentially flawed or incomplete) CI reasoning. As the student improves, the feedback becomes increasingly off-policy: the model producing the feedback (the base model) is progressively less similar to the model being trained (the student at epoch $t$). The paper does not discuss or measure this distributional shift.
The consequence. The teacher distributions $\pi_{\text{allow}}$ and $\pi_{\text{disallow}}$ are conditioned on feedback that encodes the base model's CI understanding, not the improving student's understanding. If the base model has systematic errors in its CI reasoning—for example, it might consistently over- or under-estimate the relevance of certain attribute types, or it might produce rationales that are shallow or miss key nuances—those errors are frozen into the feedback and limit how much the student can improve. The student can learn to better attend to the feedback (improving its ability to follow the rationales' recommendations), but it cannot learn CI norms that the feedback doesn't encode. This creates a capability ceiling: SELFCI's maximum achievable CI alignment is bounded by the quality of the base model's self-generated feedback. If the base model fundamentally misunderstands certain CI principles, no amount of self-distillation training can correct that misunderstanding—the student has no source of corrective signal beyond the frozen feedback.
Additionally, as the student evolves, the EMA-updated teachers (tracking the student's parameters) condition the feedback on distributions that are increasingly different from the distribution that generated the feedback. The feedback was generated under the base model's distribution (specific temperature, specific prompt format, specific reasoning style). Conditioning the epoch-30 student on that feedback may produce different—and potentially degraded—teacher behavior compared to conditioning the base model, since the interaction between the feedback text and the model's learned representations has shifted. The paper provides no mechanism to assess or correct for this interaction drift.
What evidence exists in the paper. The paper acknowledges that feedback is generated once ("generated for the training split and used as privileged context throughout training," Appendix B.1) but does not measure off-policy drift. Figure 7 (Right) shows that the teacher distributions do move closer to the ideal CI policy over training, but this movement reflects the EMA-updated parameters adapting to the student, not the feedback being regenerated. The teacher improvement comes from better parameter values, not from better feedback. The paper does not report an ablation regenerating feedback at intermediate checkpoints (e.g., every 10 epochs using the EMA teacher) to test whether updated feedback would improve final performance, nor does it measure how the relevance or informativeness of the frozen feedback changes as the student evolves. The Quasi-static PoE Equivalence (Appendix F, Remark F.1) assumes teachers change slowly, which is satisfied by the EMA, but does not address whether the feedback-text-to-parameter interaction remains valid as parameters change.
Mitigation status. Not addressed. The paper's limitation section focuses on data annotation and model scale, not on the frozen-feedback issue. The authors do not propose periodic feedback regeneration or discuss the boundary conditions under which frozen feedback becomes a bottleneck. A practitioner implementing SELFCI might reasonably consider regenerating feedback periodically (using the EMA teacher or student checkpoint), but the paper provides no guidance on whether, when, or how this should be done, nor on the computational cost implications (regenerating feedback for 590 training instances requires generating one rationale per attribute—potentially hundreds of generations per epoch if done frequently).
The Test Set is Small and Evaluation Lacks Statistical Rigor
The assumption or constraint. All in-domain evaluation is conducted on the CI-RL test set, which contains 73 instances. Each instance is evaluated with 5 response samples, yielding 365 total evaluations per method per backbone. This is a small sample for comparing methods that differ by a few percentage points in Complete score. The paper does not report confidence intervals, standard deviations, standard errors, or the results of any statistical significance test (e.g., bootstrap confidence intervals, McNemar's test, paired permutation test) for any metric in any table or figure. The only statistical protocol described is taking the mean across five evaluation runs per instance.
The consequence. The headline results in Table 1—particularly for backbones where the gap between SELFCI and the best baseline is small—may not be statistically reliable. Consider the DeepSeek-R1-Distill-Llama-8B results: SELFCI Complete 49.86 vs. ContextDistill 48.49, a gap of 1.37 percentage points on 73 instances. With five samples per instance, the effective sample size for detecting a 1.37-point difference depends on the per-instance variance in correctness, which is not reported. If some instances are "easy" (all methods get them right) and some are "hard" (all methods get them wrong), the discriminatory power of the test set is concentrated in a small number of borderline instances, making small gaps even less reliable. Similarly, on Llama-3.1-8B-Instruct, the gap between SELFCI (66.30) and CI-RL (64.38) is 1.92 Complete points—is this a genuine improvement, or within the noise of 73-instance evaluation?
The problem compounds for sub-metrics. Integrity and Utility are each computed as the fraction of instances satisfying a binary condition. With 73 instances, a change of 2 percentage points corresponds to approximately 1.5 instances changing classification. This is well within the range of sampling noise, especially since each instance gets only 5 evaluation samples (a single "wrong" sample due to temperature-0.7 stochasticity could flip an instance from pass to fail). For out-of-domain evaluation, PrivacyLens and CIMemories use different instance counts (not explicitly reported in the main text for PrivacyLens; 454 for CIMemories), but the same absence of variance reporting applies.
What evidence exists in the paper. None beyond the raw means. The paper does not report variance, error bars, or significance tests for any metric. Figure 3 (Middle)—the per-epoch Complete scores for Qwen3-4B-Instruct—shows SELFCI and CI-RL curves without any shading for standard deviation, making it impossible to assess whether the gap at any given epoch is meaningful or noise. The paper states results are reported as "mean for each metric" (Section 4.1) but provides no dispersion information.
Mitigation status. Not addressed. The paper provides no statistical analysis, no power analysis for the test set size, and no discussion of the minimum detectable effect given 73 instances. The conclusion that SELFCI "consistently outperforms competitive baselines" is stated without qualification, even though the margin on several backbones is small relative to the test set size. A practitioner deciding whether to adopt SELFCI over CI-RL would need to know whether the Complete score difference on their target model family is statistically reliable or within sampling noise—the paper does not provide the information needed to make that judgment.
The Framework Only Evaluates Final-Response Privacy, Not Leakage in Intermediate Reasoning
The assumption or constraint. All evaluations measure privacy leakage in the model's final output—the answer within <answer> tags (CI-RL), the final tool action (PrivacyLens), or the generated message (CIMemories). The model's internal reasoning trace (within thinking and response tags in CI-RL) is explicitly excluded from evaluation scoring: "evaluation is performed on the test split using normalized string matching against the annotation maps after parsing only the final answer span, so the reasoning trace is excluded from scoring" (Appendix C.1). The paper's limitation section acknowledges: "our evaluation focuses on final responses, leaving explicit analysis of leakage in reasoning traces or intermediate tool states for future work."
The consequence. This is a significant omission for two reasons. First, reasoning traces can themselves leak private information even if the final answer is clean. A model might correctly suppress a restricted attribute from its final response but explicitly mention it in its reasoning: "I know the user's passport number is P1234567, but I should not share that with the hotel, so I will only include the name and dates." This reasoning trace, if logged or surfaced to the user, constitutes a privacy violation—the sensitive information is disclosed in the reasoning, even if it's absent from the answer. The paper's evaluation would score this as a privacy success (Integrity = 1 because the answer contains no restricted keywords), completely missing the reasoning-trace leakage.
Second, for reasoning models (DeepSeek-R1, Olmo-3-Think, Qwen3-4B) evaluated in Table 1, the thinking trace is often much longer than the final answer and may contain detailed consideration of which attributes to include or exclude. The evaluation protocol strips this trace before scoring, so the reported Integrity and Complete scores for reasoning models represent only the "sanitized" final-answer privacy, not the full privacy behavior of the model. This is especially concerning because SELFCI's teacher conditioning is based on feedback appended to the prompt—the teacher sees the feedback and the full attribute list and may learn to "think about" disallowed attributes (reasoning about why they shouldn't be shared) before suppressing them from the final output. If the student imitates this behavior—reasoning about disallowed attributes during the thinking phase and then producing a clean answer—the evaluation would show high Integrity while the reasoning trace contains the private information. The paper's own example outputs (Figures 15 and 16) show reasoning traces that explicitly mention restricted attributes (e.g., "Health logs: Prescriptions (Duloxetine 20mg), Conditions (mild hypertension, insomnia)" and "Policy reference: Insurance: Plan number XZ90034") while the final answers correctly exclude them. The evaluation protocol classifies this as successful CI alignment, even though the reasoning trace has disclosed the restricted information.
What evidence exists in the paper. The paper provides no analysis of reasoning-trace leakage. Tab. 1 reports Integrity and Complete based only on final-answer parsing, with no metric for reasoning-trace privacy. The out-of-domain evaluation on PrivacyLens uses tool-use trajectories where the "reasoning" is the action sequence itself; leakage is measured from the final action, but intermediate action steps are part of the "past trajectory" and may also contain sensitive attributes. The CIMemories evaluation (Figure 4) uses a simplified CI-CoT prompt (Figure 13) that asks for "direct answering" without reasoning, which avoids the reasoning-trace issue but also changes the evaluation condition relative to the main CI-RL results. The qualitative examples (Appendix E, Figures 15 and 16) visually demonstrate the problem—restricted attributes appear in the reasoning trace—but this is not quantified or discussed as a limitation.
Mitigation status. The paper explicitly defers this to future work in the limitations section but makes no attempt to measure or mitigate reasoning-trace leakage in the current framework. The acknowledgment is brief ("leaving explicit analysis of leakage in reasoning traces or intermediate tool states for future work") and does not discuss how serious the problem might be or whether SELFCI's training objective (which conditions teachers on feedback that may reference disallowed attributes) inherently encourages reasoning about restricted information. This is not a minor oversight—it is a fundamental gap between the evaluation metric (final-answer privacy) and the deployment reality (reasoning traces may be logged, inspected, or exposed to downstream systems).
SELFCI Uses a Static λ Coefficient Without Adaptive or Context-Dependent Weighting
The assumption or constraint. The coefficient $\lambda$ in Equation 5 controls the relative weight of the utility-oriented teacher ($\pi_{\text{allow}}$) versus the privacy-oriented teacher ($\pi_{\text{disallow}}$) in the PoE target. The paper uses a fixed $\lambda = 0.5$ for all tasks, all backbones, and all training stages. The $\lambda$ sweep (Figure 6, Left) shows that different $\lambda$ values produce different privacy-utility trade-offs: higher $\lambda$ yields better Utility but worse Integrity; lower $\lambda$ yields the opposite. The default $\lambda = 0.5$ is chosen because it provides the best average Complete score across the training distribution, but this uniform weighting treats all tasks identically. The paper acknowledges: "we use a static λ to balance the complementary teachers; although we analyze its effect in Sec. 4.5, adaptive coefficient selection remains future work."
The consequence. Different tasks may benefit from different privacy-utility trade-offs. A task where the disallowed attributes are highly sensitive (e.g., medical records, financial information) might warrant a lower $\lambda$ (stronger privacy pressure), while a task where the disallowed attributes are relatively innocuous (e.g., a previous casual conversation) might be better served by a higher $\lambda$ (stronger utility pressure). The fixed $\lambda = 0.5$ forces a one-size-fits-all trade-off that is suboptimal for both extremes. The paper's own difficulty-dependent findings—SELFCI performs better on some backbones and worse on others, and the relative improvement over baselines varies across task types—suggest that a task-adaptive $\lambda$ could improve overall performance by allocating the privacy-utility balance per-task.
More subtly, $\lambda = 0.5$ weights the two teachers equally in the PoE product, but this assumes the teachers are equally well-calibrated. If $\pi_{\text{allow}}$'s feedback is generally higher-quality (more accurate, more informative) than $\pi_{\text{disallow}}$'s feedback (or vice versa), equal weighting in the PoE product gives them equal influence despite unequal reliability. The paper provides no calibration analysis of the two teachers—we don't know whether the self-generated allow rationales are more or less accurate than the disallow rationales. If one teacher systematically provides weaker signal, the PoE intersection is dominated by the stronger teacher, and $\lambda = 0.5$ is effectively giving equal weight to unequal-quality information. A calibrated $\lambda$ that reflects relative teacher quality could improve performance.
What evidence exists in the paper. Figure 6 (Left) clearly shows the $\lambda$-dependent Pareto frontier for Qwen3-4B-Instruct, demonstrating that the privacy-utility trade-off is controllable and that $\lambda = 0.5$ is the best average choice. However, this is an aggregate finding—it doesn't show per-task variation or identify whether some tasks would benefit from different $\lambda$ values. The paper does not report whether the optimal $\lambda$ varies across difficulty levels, task types, or domain categories within the CI-RL dataset. The teacher calibration question is unexamined: the paper does not report the accuracy of self-generated allow feedback vs. disallow feedback (e.g., by having a human evaluate whether the rationales correctly apply the transmission principles).
Mitigation status. The paper acknowledges this as future work but makes no progress toward addressing it. An adaptive $\lambda$ scheme could be implemented in several ways: conditioning $\lambda$ on the CI transmission principle (giving different weights for Confidentiality vs. Proportionality vs. Consent tasks), using the task's sensitivity level (e.g., lower $\lambda$ for tasks involving medical or financial data), or learning $\lambda$ as a function of the task embedding via a lightweight meta-network. None of these are explored. The theoretical framework (Appendix G) derives the PoE bound for arbitrary fixed $\lambda$ and doesn't preclude adaptive $\lambda$, but the paper provides no empirical or theoretical guidance on how to select $\lambda$ per-task in deployment.
7. Implications and Future Directions
How This Work Changes the Landscape
SELFCI introduces a structural reframing of Contextual Integrity alignment—not as a privacy-utility trade-off to be navigated by scalar optimization, but as an asymmetric invariance problem requiring decomposed training signals. This is a conceptual shift with pragmatic consequences: it explains why prior single-objective approaches consistently produce the trade-off pattern (CI-RL's Integrity gains at Utility cost in Table 1, e.g., Qwen2.5-7B-Instruct: +38.36 Integrity points but −7.12 Utility points), and it provides a constructive alternative—decompose the retain and suppress pressures into specialized self-teachers, then optimize toward their intersection rather than a compromise between them. The empirical signature of this reframing is that SELFCI improves Integrity without proportionally degrading Utility, yielding Complete scores that neither extreme teacher nor any single-objective baseline achieves.
This reframing matters because it changes what "improving CI alignment" means. Under the trade-off paradigm, a method that raises Integrity from 35% to 74% while dropping Utility from 68% to 61% (CI-RL on Qwen2.5-7B-Instruct) is a qualified success—the model moved along the Pareto frontier. Under SELFCI's joint-satisfaction paradigm, that same outcome is a partial failure because the model hasn't learned to satisfy both constraints simultaneously; it has simply traded one for the other. The Complete metric—1 only when all required attributes are present and no restricted attributes appear—operationalizes this harder standard. The fact that SELFCI achieves the highest Complete score on every backbone tested (Table 1) is evidence that the reframing captures something structurally different, not merely an improved point on the same trade-off curve.
The work also reconciles conflicting intuitions in the CI alignment literature. Prior work reached contradictory conclusions about whether privacy-preserving training necessarily degrades utility: supervised fine-tuning approaches [8, 11, 47] often reported utility preservation but struggled with exposure bias, while online RL approaches [22] achieved strong privacy improvements but at documented utility cost. SELFCI's framework explains this divergence: methods that provide dense, attribute-level supervision (like SFT on CI-compliant trajectories) avoid extreme utility degradation but suffer from distributional mismatch; methods that provide sparse, sequence-level feedback (like scalar reward RL) avoid exposure bias but entangle the retain/suppress signals, forcing a trade-off. SELFCI's self-distillation with decomposed teachers provides both dense per-token supervision (avoiding the credit assignment problem of scalar rewards) and on-policy generation (avoiding the exposure bias of offline SFT). The framework thus identifies the axis along which prior methods fail and shows that both failure modes can be addressed simultaneously.
Several research directions become more attractive as a result of this work:
-
Complementary teacher architectures for other asymmetric alignment problems. The paper demonstrates that decomposing an alignment objective into two specialized teachers and optimizing toward their PoE intersection works for CI. The same recipe—identify the asymmetric pressures, construct one teacher per pressure via self-generated feedback, optimize reverse KL toward the PoE—is directly transferable to bias mitigation (invariant to protected attributes, responsive to task-relevant features), safety alignment (invariant to harmful prompts, responsive to benign ones), and factual grounding (invariant to unsupported claims, responsive to evidenced ones). Each of these domains has a literature of single-objective methods that exhibit trade-off behavior analogous to CI-RL; SELFCI's framework provides a template for decomposing those objectives.
-
Self-distillation as an alignment mechanism beyond capability transfer. Prior self-distillation work [18, 37, 51] treated the teacher as a source of superior capability (privileged context, ground-truth rationales, frontier-model completions). SELFCI demonstrates that self-distillation can also serve as an alignment mechanism: the teacher isn't "better" at the task; it's differently biased, and the student's job is to find the intersection of complementary biases. This opens a broader research program on "alignment through biased self-teachers," where the privileged context encodes specific normative constraints rather than additional capability.
Conversely, some directions become less attractive in light of this work. The paper's comparison between CI-RL and SELFCI (Figure 3, Middle and Right) shows that scalar reward RL with GRPO is both slower to converge (5× more epochs to reach 40% Complete) and computationally more expensive per step (1.93× more GPU time). Given that SELFCI achieves better final performance with less compute and requires no reward engineering, continuing to develop scalar-reward approaches for CI alignment—without incorporating the structural decomposition that SELFCI provides—appears to be a dead end. The paper's ablation on monolithic vs. decomposed teachers (Table 3) further suggests that even within self-distillation, collapsing the retain/suppress signals into a single context is strictly worse than maintaining separate teachers. The key insight is not "self-distillation works better than RL" but rather "decomposed signals work better than entangled signals, regardless of the optimization framework."
Follow-Up Research This Work Enables
1. Adaptive per-task λ selection via learned task embeddings or transmission principle conditioning. The paper's λ sweep (Figure 6, Left) shows that the optimal privacy-utility balance varies—some tasks benefit from stronger privacy pressure, others from stronger utility pressure—but SELFCI uses a fixed λ = 0.5 for all tasks. A natural extension would train a lightweight λ-predictor that takes the task instruction and attribute list as input and outputs an appropriate λ value. The predictor could be trained via meta-learning: for each task in a held-out set, find the λ that maximizes Complete score, then train a small network to predict that λ from the task representation. A simpler variant: condition λ on the CI transmission principle (Confidentiality, Proportionality, or Consent, defined in Table 5). The paper's CI-RL dataset already includes this annotation per instance; a follow-up could train separate SELFCI models with λ = 0.3 for Confidentiality tasks (where the disallowed attributes are strictly irrelevant), λ = 0.5 for Proportionality tasks (where some attributes are borderline), and λ = 0.7 for Consent tasks (where disclosure depends on user awareness). The evaluation would measure whether per-principle λ outperforms the uniform λ = 0.5 on Complete, and whether the gains come from better Utility on Consent tasks or better Integrity on Confidentiality tasks.
2. Dynamic feedback regeneration during training to close the off-policy gap. The paper's current design generates feedback once from the base model and uses it frozen throughout 30 epochs of training. This creates a progressively widening gap between the model that generated the feedback (base model) and the model being trained (student at epoch ). A direct follow-up experiment would regenerate feedback every epochs (e.g., ) using the EMA-updated teacher as the generator, then continue training with the updated feedback. The hypothesis is that refreshed feedback would encode the improving model's better CI understanding, raising the capability ceiling identified in Section 6. The key measurements would be: (a) does per-epoch Complete score improve faster or reach a higher asymptote with periodic regeneration? (b) does the alignment error term from Theorem G.3 decrease when feedback is regenerated? (c) at what regeneration frequency do the benefits saturate, and what is the computational cost relative to fixed-feedback training? The stress test would be a setting where the base model has incorrect CI reasoning (e.g., it systematically misclassifies certain attribute types) and measuring whether feedback regeneration can correct those errors over time—or whether errors in the initial feedback are self-reinforcing.
3. Evaluating and mitigating reasoning-trace leakage in extended thinking models. As noted in Section 6, the paper's evaluation protocol explicitly strips reasoning traces before scoring, ignoring any sensitive information disclosed during the thinking phase. This is a significant deployment gap, particularly for reasoning models (DeepSeek-R1, Qwen3-4B) where the thinking trace may be substantially longer than the final answer and may contain detailed discussion of restricted attributes. A straightforward follow-up would replicate the CI-RL evaluation but apply the same keyword-matching leakage detection to both the reasoning trace (within thinking/ response tags) and the final answer (within <answer> tags), reporting "Reasoning Integrity" and "Full Integrity" (leakage in either trace or answer) alongside the existing final-answer metrics. The hypothesis is that SELFCI-trained models—which learn from teachers conditioned on feedback that mentions disallowed attributes—may exhibit higher reasoning-trace leakage than CI-RL models (which receive only a scalar reward disconnected from attribute-level reasoning). If confirmed, this would motivate extensions to SELFCI that penalize leakage in the reasoning trace: for example, adding a third KL term toward a teacher conditioned on feedback that instructs the model not to mention disallowed attributes during reasoning, or applying the KL divergence to both the thinking and answer phases rather than the full generation concatenated. The experiment would measure whether such extensions reduce reasoning leakage without degrading final-answer Complete scores.
4. Scaling SELFCI to larger models and real-world CI datasets with noisy or ambiguous annotations. The paper evaluates SELFCI up to 8B parameters (Qwen3-8B) on the synthetic, cleanly-annotated CI-RL dataset. Two orthogonal scaling questions remain: (a) does the self-distillation mechanism continue to provide gains at 32B, 70B, or larger scales, where the base model's in-context learning capability is stronger but its pre-existing CI behavior is also better? Figure 6 (Right) suggests the gap between SELFCI and the Initial model grows with scale from 4B to 8B, but this trend may not extrapolate. (b) Can SELFCI work with real-world user data where attribute disclosure annotations are noisy, incomplete, or crowd-sourced? A concrete experiment: take a dataset of real user-assistant interactions (e.g., from a deployed personal agent), have crowd workers label each attribute as appropriate or inappropriate for each task-recipient pair, compute inter-annotator agreement (likely well below 100%), and train SELFCI using either majority-vote labels or soft labels derived from the annotation distribution. The key measurements would be: does SELFCI degrade gracefully as annotation noise increases? Does the self-generated feedback correct or amplify annotation errors? At what inter-annotator agreement level does SELFCI cease to outperform the Initial model? This experiment would directly test the deployability limitation discussed in Section 6.
5. Combining SELFCI with inference-time CI filtering for defense-in-depth in agentic workflows. The paper positions SELFCI as an alternative to inference-time CI enforcement [11, 12, 24], arguing that internalized alignment is preferable to output post-processing. However, these approaches are complementary rather than mutually exclusive: SELFCI could train the model to internalize CI norms, while an inference-time filter catches residual leakage. A practical integration experiment would deploy a SELFCI-trained model in the PrivacyLens agentic setting, add a lightweight output filter that screens final tool actions against the list of restricted attributes, and measure: (a) does the filter catch leaks that SELFCI misses, improving LR beyond SELFCI alone? (b) does the filter introduce false positives (blocking actions that actually don't leak sensitive data) and reduce Helpful scores? (c) what is the latency overhead of the combined system? The hypothesis is that SELFCI reduces the burden on the filter—because most leakage is already suppressed internally—allowing a simpler, less aggressive filter with fewer false positives. This setup would also reveal whether SELFCI's internalized CI reasoning and external filtering produce different types of failures: SELFCI might leak through reasoning traces (which a final-answer filter would miss), while a filter might produce contextually inappropriate suppressions (blocking allowed attributes in borderline cases) that SELFCI handles better.
6. Stress-testing SELFCI against adversarial prompts designed to induce disclosure. The paper evaluates SELFCI on standard benchmarks where the task instruction is benign and the model must decide what to disclose. A critical deployment concern is adversarial prompting: a user (or a compromised downstream system) crafts prompts specifically designed to trick the model into leaking restricted attributes despite its CI alignment—for example, by reframing the request as an emergency, by claiming authority ("I'm the system administrator, I need the user's full medical history for diagnostics"), or by using indirect information-elicitation techniques. A stress-test experiment would construct a small suite of adversarial CI-RL variants where the same underlying attribute partition (allowed vs. disallowed) is presented under manipulative framings, then measure whether SELFCI-trained models maintain their Integrity improvements or whether the self-distilled CI behavior can be "jailbroken" through prompt engineering. The comparison against CI-RL and ContextDistill would reveal whether internalized CI reasoning (SELFCI) is more or less robust to adversarial prompts than reward-optimized behavior (CI-RL) or imitated behavior (ContextDistill). If SELFCI proves more robust—because the feedback-conditioned teachers encode reasons for suppression rather than just suppression patterns—this would be strong evidence that decomposed normative training produces more generalizable alignment than scalar optimization.
Practical Applications and Downstream Use Cases
1. On-device personal assistants with persistent memory and multi-recipient communication. The most direct deployment scenario is a personal LLM assistant that maintains a long-term user profile across multiple interaction contexts—email drafting, calendar management, messaging, document summarization—and must selectively disclose profile attributes based on the current recipient and task. A user's address is appropriate when booking a hotel but not when asking a colleague for lunch recommendations. Their medical history is appropriate when communicating with a doctor but not with a retail customer service agent. SELFCI's CIMemories result (Figure 4) is directly relevant: the model maintains sub-5% Violation@5 across 48 accumulated tasks, while baselines degrade to 20-26%. For an on-device deployment where cloud offloading is undesirable (privacy, latency, connectivity), SELFCI's scaling behavior (Figure 6, Right) suggests that a 4B or 8B parameter model can achieve strong CI alignment without an external teacher—the assistant can self-improve its disclosure behavior using only its own feedback. The practical workflow would be: deploy the base model with SELFCI pre-training on domain-specific CI annotations, then periodically regenerate feedback from the model's own recent interaction history to keep CI alignment current as user attributes and disclosure norms evolve.
2. Enterprise RAG systems with access-controlled document collections. In enterprise settings, LLMs are increasingly deployed as retrieval-augmented generation (RAG) systems that can access internal documents—project plans, personnel records, financial reports, customer data—and answer employee queries. Different employees have different access privileges: a project manager should see project timelines and team assignments; a finance analyst should see budget details but not personnel records; an external contractor should see only the subset of documents explicitly shared with them. SELFCI's CI framework maps naturally to this setting: the "task" is the employee's query, the "recipient" is the employee's role, and the "attributes" are the documents or fields within documents that the RAG system retrieves. SELFCI could be trained on an access control policy translated into allowed/disallowed attribute annotations, then deployed to condition the LLM's generation on the employee's role—suppressing retrieved information the employee shouldn't see even if it's present in the retrieval results. The benefit over rule-based access control is that SELFCI handles context-dependent access: the same employee might be allowed to see budget figures when preparing a quarterly report (task-relevant) but not when casually browsing documents (task-irrelevant). SELFCI's joint optimization toward utility (answering the query) and privacy (suppressing unauthorized information) provides a more nuanced access control than binary allow/block filtering.
3. Training data generation for privacy-preserving fine-tuning pipelines. When organizations fine-tune LLMs on proprietary data (customer support transcripts, internal communications, user feedback), they often need to sanitize the training data to remove personally identifiable information (PII) and other sensitive attributes before training begins. This sanitization is typically done via rule-based redaction or separate PII-detection models, both of which are brittle and context-insensitive—they either over-redact (removing information that's actually needed for the task) or under-redact (missing contextually-sensitive but not obviously PII-like attributes). SELFCI offers an alternative: train a CI-aligned model on a small set of annotated disclosure examples, then use that model to generate sanitized versions of the proprietary data at scale. Because SELFCI learns context-dependent disclosure norms rather than fixed redaction rules, it can distinguish between appropriate and inappropriate information flows in diverse conversational contexts. The "Complete" metric from CI-RL (jointly requiring task completeness and minimal disclosure) is exactly the right objective for this use case: the sanitized data must preserve the information needed for the downstream fine-tuning task while removing everything else. SELFCI's efficiency (Figure 3, Right: 7.77 seconds per step vs. 15.02 seconds for CI-RL) makes it practical for generating large volumes of sanitized data, and its generalization to out-of-domain settings (PrivacyLens results, Table 1) suggests it can handle the distribution shift between the small annotation set and the large proprietary corpus.
4. Multi-agent systems with information compartmentalization requirements. As LLM-based agent systems grow more complex—with specialized sub-agents for different functions (scheduling, email, research, coding) that share a common user context—the information flow between agents must be governed by CI norms: the scheduling agent needs access to the user's calendar and availability but not their medical history; the email agent needs access to communication history but not financial account details; the research agent needs access to general knowledge but not private documents. SELFCI could be adapted to this setting by treating each agent as a "recipient" and each information type as an "attribute," training a central CI-aligned model or a set of agent-specific models that selectively disclose context to downstream agents based on the task-purpose-recipient triple. The PrivacyLens results (Table 1) are directly relevant here: SELFCI maintains Helpful scores while reducing Leakage Rate in tool-using agent trajectories, suggesting that CI-aligned agents can participate in multi-step workflows without over-sharing. The CIMemories result (Figure 4) is also relevant: as the shared user context accumulates over multiple agent interactions, SELFCI's flat violation curve (vs. the baselines' linear growth) suggests it can maintain compartmentalization even as the total information pool grows—a critical property for long-running agent systems.
When to Prefer This Method
The paper explicitly positions SELFCI against two alternative CI alignment paradigms—online RL with scalar rewards (CI-RL) and offline supervised distillation from larger teachers (ContextDistill)—and provides quantitative comparisons that support a conditional decision framework. The choice among these methods depends on three factors: (1) availability of a larger teacher model, (2) computational budget for training, and (3) tolerance for the privacy-utility trade-off.
-
Prefer SELFCI over CI-RL when minimizing the privacy-utility trade-off is paramount (you need to improve Integrity without degrading Utility), when training compute is constrained (SELFCI requires 1.93× less GPU time per step and converges 5× faster in epochs, Figure 3), or when the base model already has a strong task-completion prior that scalar rewards struggle to override. Evidence: on Qwen2.5-7B-Instruct, CI-RL improves Integrity from 35.34 to 73.70 but drops Utility from 68.22 to 61.10; SELFCI achieves Integrity 83.56 with Utility 62.19, yielding Complete 53.42 vs. 43.29. On Olmo-3-7B-Instruct, CI-RL barely moves Complete (35.62 vs. 33.42 Initial) while SELFCI reaches 51.00.
-
Prefer SELFCI over ContextDistill when no larger teacher model is available (ContextDistill requires a 32B-70B parameter teacher for each student, as listed in Table 6), when the deployment scenario involves distribution shift that would exacerbate exposure bias (ContextDistill trains on fixed external-teacher trajectories that become stale), or when training on reasoning models where teacher-student distribution mismatch is especially severe. Evidence: on Qwen3-4B-Instruct, ContextDistill achieves Complete 40.00 vs. SELFCI's 55.34; on Qwen3-4B (reasoning model), the gap is 43.29 vs. 57.26. The PrivacyLens transfer results further confirm ContextDistill's exposure bias: LR remains high on Qwen3-4B-Instruct (55.98 vs. SELFCI's 47.06).
-
Prefer CI-RL or ContextDistill over SELFCI only when the target model is very small (≤0.6B parameters) and incapable of generating or using self-feedback effectively. Figure 6 (Right) shows that SELFCI's advantage over CI-RL shrinks at Qwen3-0.6B; the paper explicitly acknowledges that "self-distillation relies on the model's in-context learning capability." At this scale, CI-RL's scalar reward optimization may be more practical despite its trade-off limitations, or a simpler rule-based suppression approach may be preferable to any learning-based method.
-
Prefer SELFCI with λ tuned per-deployment-context if the cost of Integrity violation and Utility loss are asymmetric. In a medical setting where leaking disallowed information has severe consequences, set λ < 0.5 (stronger privacy pressure, following the sweep in Figure 6, Left: λ = 0.25 achieves Integrity near 85% with Utility near 58%). In a productivity setting where task failure is more costly than minor over-sharing, set λ > 0.5 (λ = 0.75 achieves Utility near 66% with Integrity near 75%). The paper's default λ = 0.5 is the best average choice across the CI-RL distribution, not necessarily the best choice for any specific deployment.
