It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs

Abstract: Contextual Integrity (CI) defines privacy not merely as keeping information hidden, but as governing information flows according to the norms of a given context. As LLMs are increasingly deployed as personal agents handling sensitive workflows, adhering to CI becomes critical. However, even frontier models remain unreliable in making disclosure decisions, and existing mitigation strategies often degrade underlying task performance. To overcome this privacy-utility trade-off, we propose SELFCI, a complementary self-distillation framework that decouples information suppression from task resolution. SELFCI jointly optimizes two independent reverse KL divergences over distinct teacher distributions derived from feedback: one encourages preserving task-relevant information for utility, while the other enforces minimal and appropriate disclosure. This complementary formulation induces a Product-of-Experts (PoE) target, aligning the policy with the intersection of capability and privacy requirements. Empirical evaluations demonstrate that SELFCI, without relying on costly external supervision, consistently outperforms competitive baselines such as online reinforcement learning algorithms (e.g., GRPO). These trends further extend to out-of-domain settings involving agentic workflows and accumulated private context, suggesting that SELFCI provides a practical path toward CI alignment.

• The paper introduces SELFCI, a complementary self-distillation framework that decouples privacy and utility alignment for improved contextual integrity in LLMs.
• The methodology employs two feedback-conditioned self-teachers, each minimizing reverse KL divergences to create a product-of-experts target that balances task completion and sensitive data suppression.
• Empirical results show that SELFCI enhances integrity and task completeness while maintaining competitive utility and sample efficiency across diverse LLM architectures.

Complementary Self-Distillation for Contextual Integrity in LLMs

Contextual Integrity in LLM-Assisted Workflows

LLMs increasingly function as personal agents, navigating workflows involving sensitive user data. The core privacy challenge transcends simple secrecy: disclosure must conform to context-specific norms—Contextual Integrity (CI). For CI, privacy is the governed flow of information, determined by recipient, purpose, and context rather than binary concealment. The problem is inherently asymmetric: a model must retain information necessary for task completion (utility) while suppressing task-irrelevant or inappropriate information (integrity). Existing alignment strategies, including supervised fine-tuning and online RL, conflate these competing pressures into monolithic objectives, frequently leading to over-disclosure or excessive suppression, undermining either privacy or utility.

SELFCI: Complementary Self-Distillation for CI Alignment

SELFCI introduces a self-distillation framework that decouples CI alignment through two specialized, feedback-conditioned self-teachers. The approach leverages rationales generated by the model explaining contextual disclosure decisions via CI transmission principles (confidentiality, proportionality, consent). Two teacher policies are instantiated: one for task completeness (utility-oriented) and one for privacy (suppressive). The student policy is trained by jointly minimizing two independent reverse KL divergences to these teachers, mathematically equivalent to matching a product-of-experts (PoE) target. This concentrates probability mass on the intersection of utility-preserving and privacy-enforcing behaviors, aligning model outputs with CI requirements without recourse to external supervision.

Theoretical Formulation

SELFCI operationalizes CI-alignment as context-dependent invariance: the model’s predictive distribution should be invariant to the injection of disallowed information yet responsive to allowed, task-relevant attributes. Direct optimization toward allowed-only reference policies is under-specified and can bias toward suppression, degrading utility. By decomposing privilege into feedback-based context for both retain (allowed) and suppress (disallowed) attributes, SELFCI provides dense, on-policy guidance, leveraging the same model parameters for both teacher and student—fusing task-driven and privacy-driven signals. The joint loss is a weighted sum of reverse KL divergences, which, under fixed teacher distributions, is equivalent to maximizing agreement under a PoE target (see detailed derivation in Sec. F and G of the paper).

Experimental Analysis

The empirical evaluation spans instruction-tuned and reasoning models, including Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Olmo-3-7B-Instruct, Qwen3-4B-Instruct, DeepSeek-R1-Distill-Llama-8B, Olmo-3-7B-Think, Qwen3-4B. SELFCI is benchmarked against online RL (CI-RL [22]), context distillation (ContextDistill), and zero-shot initial models across CI-RL (synthetic, attribute-annotated tasks), PrivacyLens (tool-based agentic workflows), and CIMemories (accumulated user memories).

Key empirical results:

• On Qwen2.5-7B-Instruct, SELFCI increases Integrity from 35.34 to 83.56 and Complete from 23.29 to 53.42, maintaining competitive Utility.
• On Llama-3.1-8B-Instruct, SELFCI achieves 82.47 Integrity, 81.10 Utility, 66.30 Complete—outperforming baselines.
• In agentic, out-of-domain settings (PrivacyLens), SELFCI achieves lowest leakage rates (LR, ALR) and highest task fulfillment (Helpful), suggesting robust transfer of CI behavior.
• In complexity-scaled scenarios (CIMemories), SELFCI maintains Violation@5 (ever-leakage rate) below 5%, demonstrating resilience under compounded privacy challenges which cause baselines to degrade.
• SELFCI demonstrates sample efficiency, requiring fewer training epochs and less GPU time per step relative to online RL, which depends on sparse, coarse-grained rewards.

Notably, SELFCI’s decomposed teacher construction, leveraging feedback-based rationales, significantly improves CI alignment compared to single, monolithic teacher objectives, as confirmed by controlled ablations. Feedback conditioning enables better generalization, especially for models with stronger in-context capabilities.

Objective Design and Teacher Dynamics

Experimental ablations show that reverse KL on both utility and privacy teachers yields superior joint satisfaction of Utility and Integrity, as reverse KL emphasizes agreement regions analogous to PoE, while forward KL induces overly conservative suppression. Exponential moving average (EMA) updates of the teacher parameters stabilize training and retain alignment, outperforming both fixed and tokenwise interpolated teacher strategies. Coefficient sensitivity analyses reveal meaningful trade-offs: increasing the utility weight ($\lambda$ in Eq. 5) shifts the model from conservative to permissive, with $\lambda=0.5$ providing optimal Pareto balance.

Scaling studies confirm SELFCI's efficacy across model sizes. Unlike reward-based RL, which fails to generalize on larger models with strong task completion priors, SELFCI consistently improves CI alignment irrespective of scale, demonstrating practical relevance for stronger LLMs where external teachers are impractical.

Practical and Theoretical Implications

SELFCI provides a scalable, backbone-agnostic alignment framework for LLMs serving as personal agents in privacy-sensitive contexts. By leveraging self-generated, feedback-based rationales, it enables efficient adaptation without dependence on costly external supervision or manually crafted trajectories. The product-of-experts formulation represents a mathematically principled method to reconcile privacy-utility trade-offs, providing dense token-level guidance.

Practically, SELFCI shifts CI alignment from output-level constraints to internalized, context-aware decision making, opening avenues for robust privacy protection without utility degradation in real-world agentic LLM deployments. The framework is extensible: dynamic coefficient adaptation, integration with multimodal and tool-using agents, and explicit leakage analysis in intermediate traces offer fruitful directions for future research.

Theoretically, SELFCI elaborates the connection between context-dependent invariance (CI) and product-of-experts optimization, setting a foundation for formal surrogates bridging utility and privacy in generative policies. The decomposition into explicit retain/suppress signals and reliance on self-distillation highlights the importance of structured guidance in shifting model behavior under asymmetric alignment targets.

Limitations

SELFCI relies on structured synthetic data with explicit attribute partitions, which may not capture the full ambiguity and norm variability inherent in real-world privacy contexts. The approach’s reliance on in-context learning capability may constrain effectiveness for smaller models. The static weighting of utility versus privacy in the joint loss is a design parameter—dynamic adaptation could enable finer granularity. Evaluation focuses on final outputs; potential leakage in reasoning traces and intermediate states is unaddressed.

Conclusion

SELFCI offers a theoretically grounded and practically validated framework for aligning LLMs to contextual integrity requirements, achieving joint task completeness and minimal disclosure via complementary self-distillation. By optimizing toward the intersection of utility and privacy signals, SELFCI improves the privacy-utility trade-off across benchmarks, agentic workflows, and accumulated contexts. The approach's robustness, sample efficiency, and scalability suggest meaningful practical impact for personal AI agents, while its product-of-experts design and invariance-based perspective contribute to advancing the theoretical understanding of privacy alignment in high-capacity generative models (2605.20258).