SELFCI: Contextual Integrity in LLMs

• SELFCI is a self-distillation framework that aligns large language models with contextual privacy norms by balancing task utility and minimal, context-appropriate disclosure.
• It decouples training into two teacher policies using feedback-conditioned rationales to distinctly promote task completion and suppress inappropriate disclosure.
• The method employs a joint reverse-KL objective and a Product-of-Experts target, achieving Pareto-optimal trade-offs in benchmarks like CI-RL, PrivacyLens, and CIMemories.

Searching arXiv for SELFCI and closely related contextual-integrity alignment papers. Search results for "SELFCI contextual integrity" show the primary paper "It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs" (Park et al., 18 May 2026), along with related 2026 papers on contextual privacy reasoning and LLM privacy alignment. SELFCI is a complementary self-distillation framework for aligning LLMs with Contextual Integrity (CI), the view that privacy is not merely a matter of keeping information hidden but of governing information flows according to the norms of a given context. In the formulation introduced in "It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs" (Park et al., 18 May 2026), SELFCI addresses the setting in which an LLM assistant must complete a task while disclosing only information that is contextually relevant and appropriate. Its defining feature is a decoupled training strategy: one component preserves task-relevant information for utility, while another independently suppresses unnecessary or inappropriate disclosure.

1. Contextual Integrity as the organizing principle

Contextual Integrity frames privacy as context-dependent appropriateness of information transfer rather than blanket nondisclosure. Within this perspective, a disclosure may be essential in one setting and inappropriate in another, depending on recipient, purpose, and task. SELFCI is designed for precisely this regime: personal-agent and workflow settings in which the model must use sensitive information instrumentally without treating all private context as either always shareable or always suppressible.

The central technical problem is asymmetric. On one side, the model must satisfy task completeness/utility, retaining and using information necessary to solve the task. On the other, it must enforce minimal, context-appropriate disclosure, avoiding information that is unnecessary or norm-violating. A recurring misconception is that privacy alignment can be reduced to hiding as much information as possible. The CI formulation rejects that simplification: under CI, indiscriminate suppression can be as misaligned as indiscriminate disclosure because both violate contextual norms.

The paper positions existing approaches—supervised fine-tuning, reinforcement learning with scalar reward, and monolithic objectives—as entangling these pressures. This suggests that a single aggregate signal can obscure the boundary between what must be retained for task completion and what must be withheld for privacy compliance.

2. Complementary teachers and feedback-conditioned supervision

SELFCI implements its decoupling through complementary self-distillation. Self-distillation is used in the sense that the model serves as its own teacher by conditioning on additional privileged context, here brief rationales or feedback. The feedback is generated for each attribute in a scenario and explains either why sharing that attribute is appropriate or why it is inappropriate, grounded in concrete context and CI transmission principles such as confidentiality, proportionality, and consent.

Two distinct teacher policies are then constructed from these rationales. One teacher, denoted $\pi_{\text{allow}}$, is conditioned on rationales for allowed attributes $\mathcal{A}_{\mathcal{T}}$ and promotes task completeness. The other, denoted $\pi_{\text{disallow}}$, is conditioned on rationales for disallowed attributes $\mathcal{D}_{\mathcal{T}}$ and enforces minimal disclosure. The two teachers are not separate models in parameter space; they are instances of the same model parameters under different conditioning.

This design makes the retention/suppression split explicit. Rather than asking a single teacher to encode both “what must be said” and “what must not be said” in a single target distribution, SELFCI uses two feedback-conditioned views of the same underlying policy. A plausible implication is that this separation improves identifiability of privacy-relevant decisions at the token level, because utility-preserving and disclosure-suppressing pressures are represented independently before being recombined in optimization.

3. Joint reverse-KL objective and the Product-of-Experts target

The student policy $\pi_\theta$ is trained by jointly minimizing weighted reverse Kullback–Leibler divergences to the two teachers at every token:

$$\mathbb{E}_{y \sim \pi_\theta} \left[ \sum_{t=1}^{|y|} \Big( \lambda\, D_{\mathrm{KL}}\!\left(\pi_\theta \parallel \operatorname{stopgrad}(\pi_{\text{allow}})\right) + (1-\lambda)\, D_{\mathrm{KL}}\!\left(\pi_\theta \parallel \operatorname{stopgrad}(\pi_{\text{disallow}})\right) \Big) \right].$$

Here, $\lambda$ controls the trade-off between task focus and privacy, and stopgrad fixes the teacher targets during each update. The formulation is dense, on-policy, and token-level, in contrast to scalar-reward reinforcement learning signals.

A key theoretical result is that this weighted reverse-KL minimization is equivalent to reverse-KL minimization to a Product-of-Experts (PoE) target:

$$P^*(x) = \frac{1}{Z} P_A(x)^{\lambda} P_B(x)^{1-\lambda}.$$

In the paper’s interpretation, the PoE target concentrates probability mass where both teachers agree. For CI alignment, that agreement corresponds to outputs that are simultaneously task-complete and privacy-compliant (Park et al., 18 May 2026). This is the core mathematical rationale for the framework: the policy is not interpolated between capability and privacy in an unconstrained way, but instead is aligned to their intersection.

The coefficient sweep over $\lambda$ is reported to allow smooth trading between strictness and utility, yielding Pareto-optimal settings. This suggests that SELFCI is not committed to a single fixed privacy posture; rather, it exposes a controllable operating point within a formally defined dual-objective training scheme.

4. Formalization of the CI objective

The paper states an ideal CI condition as invariance of the output distribution to the presence of disallowed information:

$$\pi_\theta(\cdot \mid \mathcal{A}_{\mathcal{T}}, \mathcal{D}_{\mathcal{T}}, \mathcal{T}) = \pi_\theta(\cdot \mid \mathcal{A}_{\mathcal{T}}, \mathcal{T}).$$

Under this idealization, only allowed information should be causally relevant to the model’s response. SELFCI is presented as a surrogate objective for this target: the PoE-based formulation is theoretically shown in the appendix to upper-bound the ideal CI objective. In other words, progress on the optimization problem is linked to tighter guarantees on contextual integrity.

Several practical consequences follow directly from this formulation. First, the model receives context-sensitive supervision not only on what to reveal but also on why revelation or suppression is appropriate. Second, the supervision is scenario-grounded and attribute-specific rather than generic. Third, the decomposition into two teachers is reported to outperform a single monolithic teacher, and feedback in the form of rationales is reported to yield higher CI compliance than simple keyword lists. Taken together, these observations indicate that the paper treats CI alignment as a structured causal-invariance problem rather than as generic refusal or redaction behavior.

5. Empirical behavior on in-domain and out-of-domain benchmarks

The empirical evaluation covers both synthetic CI tasks and broader privacy-sensitive deployment settings. The in-domain benchmark is CI-RL, described as containing explicit synthetic CI scenarios with labeled allowed and disallowed attributes and rationales. Out-of-domain evaluation uses PrivacyLens, a tool-using agent benchmark with privacy-sensitive action traces, and CIMemories, a multi-turn benchmark with accumulated memory requiring adaptive disclosure. Reported metrics include Integrity, Utility, Complete, Leakage Rate (LR), and Helpfulness (Park et al., 18 May 2026).

The comparison set includes CI-RL, referred to as GRPO, ContextDistill, and the untrained Initial model. The reported pattern is consistent across settings: SELFCI improves simultaneous task completeness and privacy compliance without the utility degradation associated with over-suppression.

Benchmark	Baselines mentioned	Reported findings
CI-RL	Initial, CI-RL/GRPO, ContextDistill	For Qwen2.5-7B-Instruct, Complete is 53.42% for SELFCI, versus 43.29% for CI-RL and 23.29% for Initial; Integrity reaches 83.56% versus 35.34% for Initial
PrivacyLens	Initial and competitive baselines	For Qwen3-4B, LR drops from 40.97% to 32.45%, and Helpfulness is highest at 1.92
CIMemories	Baselines under memory accumulation	SELFCI keeps Violation@5 under 5% while others rise above 20%

These results support several narrower claims made in the paper. SELFCI is reported to outperform competitive online reinforcement learning baselines such as GRPO. It also outperforms external large-teacher distillation in the reported ablations, implying that self-generated, context-grounded rationales may generalize better for CI than externally supplied teacher outputs. The out-of-domain gains on agentic workflows and accumulated private context are especially significant because they indicate robustness to distribution shift and to privacy violations that compound across turns.

6. Efficiency, scope, and acronym ambiguity

SELFCI is presented as a practical alignment method because it does not rely on costly external supervision. The paper states that it requires neither costly external teacher models nor large amounts of human-labeled rationales, and that it is more sample-efficient and faster per wall-clock time and per epoch than CI-RL/GRPO because it uses dense, on-policy, token-level guidance rather than sparse, delayed scalar rewards. It is also described as applicable across model sizes, including strong models for which external distillation may be infeasible.

The framework’s intended deployment scope includes personal agents, privacy-sensitive tool use, and settings with memory accumulation, where context-specific disclosure norms must be maintained over time. A plausible implication is that SELFCI is best understood not as a refusal-tuning method but as a norm-sensitive control mechanism for information flow in long-horizon LLM behavior.

A source of ambiguity is the acronym itself. In the 2026 arXiv literature, SELFCI also appears in a different meaning within selective conformal inference: SCIP is described as recovering and improving methods in the SELFCI (Selective Conformal Inference) framework (Li et al., 26 May 2026). That usage is unrelated to the CI-alignment method described here. In the LLM privacy literature, SELFCI denotes the complementary self-distillation framework centered on dual reverse-KL objectives and a Product-of-Experts target for contextual integrity alignment.