Source-linked AI summary
Differentially Private Fine-tuning of Language Models
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, Huishuai Zhang
TL;DR
Private fine-tuning must preserve language-model utility despite privacy noise and the difficulty of acquiring private data. The paper uses parameter-efficient adaptations and a public-pretraining/private-fine-tuning framework, finding that utility often approaches non-private levels and that larger models better retain accuracy.
Problem
Private learning needs rigorous protection against sensitive-data leakage, but differential privacy generally reduces accuracy and may require more private training data.
Method
The paper combines public pretraining with private fine-tuning of newly introduced parameter-efficient components while freezing the original model parameters.
Results
87.8% MNLI accuracy is achieved with RoBERTa-Large at (ε = 6.7, δ = 1e-6), versus 90.2% without privacy, with utility approaching non-private levels across tasks.
Takeaways & Limitations
Larger models better maintain utility under privacy, while parameter-efficient methods reduce the computational and memory costs of private training.
Takeaways & Limitations
Reported full-fine-tuning performance may improve with alternative hyperparameters, including very large batch sizes; DPSGD results are also affected by precision choices.
Abstract
from arXiv · showhide
We give simpler, sparser, and faster algorithms for differentially private fine-tuning of large-scale pre-trained language models, which achieve the state-of-the-art privacy versus utility tradeoffs on many standard NLP tasks. We propose a meta-framework for this problem, inspired by the recent success of highly parameter-efficient methods for fine-tuning. Our experiments show that differentially private adaptations of these approaches outperform previous private algorithms in three important dimensions: utility, privacy, and the computational and memory cost of private training. On many commonly studied datasets, the utility of private models approaches that of non-private models. For example, on the MNLI dataset we achieve an accuracy of $87.8\%$ using RoBERTa-Large and $83.5\%$ using RoBERTa-Base with a privacy budget of $ε= 6.7$. In comparison, absent privacy constraints, RoBERTa-Large achieves an accuracy of $90.2\%$. Our findings are similar for natural language generation tasks. Privately fine-tuning with DART, GPT-2-Small, GPT-2-Medium, GPT-2-Large, and GPT-2-XL achieve BLEU scores of 38.5, 42.0, 43.1, and 43.8 respectively (privacy budget of $ε= 6.8,δ=$ 1e-5) whereas the non-private baseline is $48.1$. All our experiments suggest that larger models are better suited for private fine-tuning: while they are well known to achieve superior accuracy non-privately, we find that they also better maintain their accuracy when privacy is introduced.
1 Introduction
The paper addresses private fine-tuning of pretrained language models using parameter-efficient adaptations, aiming to preserve utility while reducing privacy-related computational and memory costs. Experiments report strong privacy–utility tradeoffs, benefits from larger models, and lightweight modular fine-tuning.
- Motivation: Differential privacy limits individual data-point influence but generally reduces test accuracy and may require more training data.Private data can be difficult to acquire, especially in privacy-sensitive settings.
- Framework: The framework pretrains models publicly, freezes original parameters, and privately fine-tunes newly introduced task-specific parameters.The resulting lightweight parameters can be released and plugged into the pretrained model for downstream tasks.
- Results: 87.8% accuracy is achieved for privately fine-tuned RoBERTa-Large on MNLI at (ε = 6.7, δ = 1e-6), versus 90.2% without privacy.The reported result is described as approaching non-private utility.
- Results: 87.8% for RoBERTa-Large versus 83.5% for RoBERTa-Base on MNLI shows that larger models retain more utility under the same privacy budget.The privacy-induced accuracy drops are 2.4% and 4.1%, respectively.
- Efficiency: Parameter-efficient approaches update only a small fraction of parameters, reducing private-training computation and memory costs while enabling modular task-specific modifications.The paper also emphasizes simpler and significantly improved algorithms for private fine-tuning.
- Results: Average accuracy reaches 90.3% at ε = 6.7, compared with 83.9% at ε = 8 for prior work across four standard NLP tasks.The paper attributes this comparison to better algorithms, larger models, and new privacy accounting techniques.
2 Preliminaries and Prior Algorithm Baselines
The paper introduces differential privacy and reviews private fine-tuning baselines. DPSGD clips per-example gradients and adds Gaussian noise, while RGP privatizes low-dimensional gradient projections through low-rank reparameterization.
- Differential Privacy: Differential privacy bounds output-distribution changes between datasets differing in one user’s data.The formal guarantee is parameterized by ε and δ.
- DPSGD: DPSGD replaces SGD with per-example gradient clipping and Gaussian noise to limit and mask individual-example contributions.Per-example clipping creates computational and memory overhead, while privacy noise grows with model-parameter count.
- RGP: RGP reparameterizes each layer as LR + W_tilde and privatizes gradients of the low-rank matrices L and R rather than the full residual.This reduces memory consumption and introduced noise, although the low-dimensional projection loses some gradient signal.
3 Our Approach
The paper introduces a meta-framework for private fine-tuning that trains a small set of additional parameters with DPSGD while freezing pre-trained weights. It instantiates this framework with parameter-efficient methods such as LoRA, adapters, and Compacters to reduce training, memory, and deployment costs.
- Meta-framework: The meta-framework adds trainable parameters θ with dim(θ) ≪ dim(WPT), runs DPSGD on θ, and freezes the pre-trained weights.The initialization ensures fine-tuning starts at the pre-trained model.
- Meta-framework: Parameter-efficient reparametrizations maintain or sometimes surpass full fine-tuning accuracy while reducing computation and memory for downstream-task adaptation.They also support lightweight, plug-in modifications to a shared base model.
- LoRA: LoRA adds a low-rank correction LiRi to selected attention weights, with small rank r reducing the number of trainable parameters.The pre-trained weights remain frozen, while Li and Ri are trained parameters.
- Adapters: Adapter fine-tuning inserts bottleneck layers with residual connections, trains adapter and layer-normalization parameters, and leaves the original model parameters frozen.The adapter uses down-projection, activation, and up-projection maps with r ≪ d.
- Compacter: Compacter reduces adapter parameters by replacing dense projection matrices with tensor products of smaller matrices using low-rank parameterized hypercomplex multiplication layers.For L adapter layers, the parameter count changes from L(2ab) to L(2(a + b)k) + n^3.
4 Experiments
The experiments evaluate parameter-efficient private fine-tuning across language understanding and generation tasks using RoBERTa and GPT-2 models. The results show strong utility, privacy, and efficiency, with larger models generally improving private performance.
- Experimental setup: The study evaluates private fine-tuning on four GLUE tasks with RoBERTa models and on E2E and DART generation tasks with GPT-2 models.RoBERTa-Base and RoBERTa-Large are evaluated for language understanding, while GPT-2 models from Small through XL are evaluated for generation.
- Language understanding results: Our methods achieve the best accuracy on all datasets while training only a tiny fraction of parameters, with larger models giving significant improvements.Private adapters perform best on RoBERTa-Base on average, while LoRA performs best for RoBERTa-Large.
- Language understanding results: Privacy-accountant advances primarily explain the improvements in ε over Yu et al. (2021b), with the experiments using the PRV Accountant.The PRV Accountant is selected because it is reported as the most efficient among the considered Fourier-based numerical composition accountants.
- Natural language generation results: Private parameter-efficient fine-tuning performs close to non-private fine-tuning, and utility generally improves as GPT-2 model size increases.On E2E, metrics saturate from GPT-2-Large to GPT-2-XL; on DART, both validation perplexity and the metric improve with model size.
- Limitations and qualifications: Full private fine-tuning may improve with different hyperparameters, including very large batch sizes, so the reported comparison is not definitive.A concurrent study found that larger batches and full precision can substantially improve DPSGD, while the authors’ updated experiments also improved by around 1%.
5 Related Work
The paper builds on private learning with public pre-training and on parameter-efficient fine-tuning. It distinguishes its approach from prior work while noting several unevaluated tuning methods.
- Private learning: Prior private language-model work largely studied LSTMs with DPSGD or related heuristics, while public pre-training was rarely used beyond hyperparameter selection.The paper situates its investigation within broader efforts to use public data for private learning.
- Private learning: Related private fine-tuning research has also examined public pre-training followed by private adaptation for image-classification models such as ResNet.Luo et al. (2021) specifically investigated parameter efficiency in private ResNet fine-tuning.
- Parameter-efficient fine-tuning: The paper does not evaluate several parameter-efficient methods, including random subspace projection, prefix and prompt tuning, bias-only tuning, and other adapter variants.These methods are identified as directions represented in related fine-tuning work.
6 Conclusion
The paper argues that combining parameter-efficient methods, privacy accounting, and larger models enables private fine-tuning with utility approaching non-private models. It presents private fine-tuning as an important direction for further research.
- Private fine-tuning can achieve utility approaching that of non-private models.
- The framework combines advances in NLP, parameter efficiency, privacy accounting, and larger models.
- Private fine-tuning is presented as a central direction for future research in private machine learning.
A Experiments with Different Privacy Parameters
The experiments evaluate the framework across privacy budgets and model sizes for language-understanding tasks. The results indicate strong performance across privacy settings, including tight privacy parameters and varied hyperparameters.
- The experiments vary privacy parameters for LoRA on language-understanding tasks using RoBERTa-Base and RoBERTa-Large.The evaluation covers MNLI, QQP, QNLI, and SST-2 for RoBERTa-Large.
- Meaningful accuracy is achieved with RoBERTa-Base even at ε = 0.5 and 1.The experiments evaluate ε values from 0.1 through 12 on MNLI and SST-2.
- The framework performs well across a wide range of ε values on MNLI and SST-2.
- Differentially private LoRA performs well across a wide range of hyperparameters on SST-2.
B On the Influence of Hyperparameters
The study examines how noise-related hyperparameters affect private fine-tuning by varying the clipping threshold and batch size while keeping the number of updates fixed.
- The study varies the clipping threshold and batch size because both directly relate to noise variance.
- The batch size is evaluated at 200, 500, 1000, 2000, and 4000 while the number of updates remains fixed.
C Fine-Tuning for Language Understanding Tasks with Large Batch Size and Full-Precision
This section re-evaluates private LoRA and Adapter fine-tuning with full precision and dataset-scaled batch sizes. The revised configuration further improves results while retaining an advantage over private full fine-tuning.
- The re-evaluation compares DP-LoRA and DP-Adapter with full-precision training and batch sizes scaled to dataset size.The full-fine-tuning differential privacy results are adopted from Li et al. (2022).
- The revised configuration further improves the strong results reported earlier.
- 89.0% accuracy on MNLI is only 1.2% below the accuracy without DP constraint.
- The proposed algorithms achieve average accuracy approximately 3% higher than private full fine-tuning.