Differential Privacy for Prompts