Source-linked AI summary
FedPrompt: Communication-Efficient and Privacy Preserving Prompt Tuning in Federated Learning
Haodong Zhao, Wei Du, Fangqi Li, Peixuan Li, Gongshen Liu
TL;DR
Federated learning for large language models faces substantial communication costs, motivating a combination with prompt tuning. FedPrompt freezes the language model and aggregates only soft prompts, achieving sharply lower communication with little accuracy loss on IID and Non-IID data while showing no high attack success rate under normal backdoor poisoning.
Problem
Federated learning with large pre-trained language models requires communicating many parameters, creating substantial communication costs despite decentralized-data privacy.
Method
FedPrompt freezes pre-trained language models and uses split aggregation to tune and aggregate only soft prompts in federated learning.
Results
0.01% of full-parameter fine-tuning parameters is communicated, with little accuracy decrease on IID and Non-IID data and no high attack success rate under normal backdoor poisoning.
Takeaways & Limitations
FedPrompt offers a communication-efficient and privacy-preserving approach to federated prompt tuning while remaining robust to the tested normal backdoor attack.
Abstract
from arXiv · showhide
Federated learning (FL) has enabled global model training on decentralized data in a privacy-preserving way by aggregating model updates. However, for many natural language processing (NLP) tasks that utilize pre-trained language models (PLMs) with large numbers of parameters, there are considerable communication costs associated with FL. Recently, prompt tuning, which tunes some soft prompts without modifying PLMs, has achieved excellent performance as a new learning paradigm. Therefore we want to combine the two methods and explore the effect of prompt tuning under FL. In this paper, we propose "FedPrompt" to study prompt tuning in a model split aggregation way using FL, and prove that split aggregation greatly reduces the communication cost, only 0.01% of the PLMs' parameters, with little decrease on accuracy both on IID and Non-IID data distribution. This improves the efficiency of FL method while also protecting the data privacy in prompt tuning. In addition, like PLMs, prompts are uploaded and downloaded between public platforms and personal users, so we try to figure out whether there is still a backdoor threat using only soft prompts in FL scenarios. We further conduct backdoor attacks by data poisoning on FedPrompt. Our experiments show that normal backdoor attack can not achieve a high attack success rate, proving the robustness of FedPrompt. We hope this work can promote the application of prompt in FL and raise the awareness of the possible security threats.
I. INTRODUCTION
FedPrompt combines federated learning with prompt tuning to reduce the communication burden of adapting large pre-trained language models while preserving decentralized-data privacy. The paper evaluates accuracy, privacy, and backdoor robustness across NLP tasks.
- I. INTRODUCTION: FedPrompt freezes pre-trained language models and tunes and aggregates only soft prompts to reduce federated-learning communication cost.This split-aggregation design adapts prompts for downstream tasks while leaving the underlying language models unchanged.
- I. INTRODUCTION: The paper also examines prompt types, hyper-parameter settings, and local differential privacy to improve performance and privacy protection.These studies extend the main communication and accuracy evaluation.
II. RELATED WORK
Prior work established prompt tuning and federated learning separately, but did not study prompt tuning in federated learning. FedPrompt addresses this gap by aggregating only trainable soft prompts rather than full language-model parameters.
- II. RELATED WORK: Federated learning aggregates client model parameters or gradients at a central server without directly sharing clients’ original data.The related-work discussion also notes that naive parameter sharing can still create privacy leakage.
- II. RELATED WORK: FedPrompt updates, aggregates, and distributes only soft-prompt parameters, whereas full PLM fine-tuning updates all model parameters.This split distinguishes the proposed method from conventional full-parameter federated fine-tuning.
- II. RELATED WORK: FedPrompt targets an unstudied combination of prompt tuning and federated learning through communication-efficient prompt aggregation.The paper explicitly identifies the absence of prior work studying prompt tuning in FL.
- II. RELATED WORK: Prompt tuning uses trainable soft prompts with templates, verbalizers, and a frozen pre-trained language model to produce task predictions.The template places input and prompt tokens, while the verbalizer maps predicted label words to classes.
B. FedPrompt
FedPrompt freezes PLM parameters and federates only task-specific soft prompts, using client-side prompt updates and server aggregation across communication rounds.
- B. FedPrompt: FedPrompt fixes PLM parameters and aggregates only trainable soft prompts for downstream tasks.The method distributes fixed PLM parameters while updating prompt parameters locally.
- B. FedPrompt: The server selects a fraction C of K clients in each of T rounds and aggregates their returned prompts using participating data amounts.The aggregation follows the server procedure after parallel client updates.
- B. FedPrompt: Each selected client receives the global prompt, replaces its local prompt, trains it locally, and returns the updated prompt to the server.Local optimization uses minibatches, local epochs, and gradient updates on the prompt.
- B. FedPrompt: FedPrompt is also designed for P-tuning and Prefix-Tuning through a similar split-aggregation procedure.
C. Poison FedPrompt
Poison FedPrompt, called FedPPT, evaluates whether malicious clients can inject a backdoor by modifying only their local training data and updating poisoned prompts.
- C. Poison FedPrompt: FedPPT models attackers controlling one or more clients that modify local training data to inject a backdoor into a prompt released to users.The threat model assumes attackers have full control of selected clients but modify only local data.
- C. Poison FedPrompt: The poisoning function inserts a trigger and replaces the original label with a target label different from the clean sample's label.A poisoned example is represented as P(x, Δ, l_t), where the modified target differs from y(x).
- C. Poison FedPrompt: Malicious clients construct modified local datasets at a specified poison rate and use them to update their prompt parameters.The modified dataset is used in each communication round for the malicious client's objective.
IV. EXPERIMENTS
The experiments investigate FedPrompt on federated NLP tasks, including sentiment analysis and sentence-pair classification, and evaluate robustness to backdoor attacks.
- IV. EXPERIMENTS: FedPrompt is evaluated on several federated NLP tasks, including sentiment analysis and sentence-pair classification.The study also conducts backdoor attacks on these tasks to assess robustness.
1) Dataset:
The evaluation covers text bi-classification and sentence-pair classification datasets distributed across ten clients under IID and Non-IID settings.
- 1) Dataset:: The dataset suite includes sentiment, toxicity, and spam detection datasets for text bi-classification.The listed datasets are SST-2, IMDB, OffensEval, Twitter, Enron, and Lingspam.
- 1) Dataset:: Sentence-pair classification uses the QNLI and RTE datasets.
- 1) Dataset:: All datasets are divided among ten clients, with IID data split into ten equal random parts and Non-IID data generated using a Dirichlet distribution over data quantities.The tasks have two labels, and the Non-IID construction varies client data quantities.
- 1) Dataset:: The experiments use representative base BERT, RoBERTa, and Google T5 models with a one-to-one verbalizer, a classification template, and 20 soft prompt tokens.
3) Baseline Algorithm:
FedPrompt evaluates communication-efficient prompt tuning under federated learning using clean and poisoned settings, comparing accuracy, attack success, and communication cost with full-parameter fine-tuning.
- Main results: 0.01% communication cost: FedPrompt matches nearly full-parameter fine-tuning’s parameter cost reduction with only about a 1% accuracy decrease on IID SST-2.In FedPrompt, learnable parameters equal communicated parameters; Table II compares this against full-parameter fine-tuning.
- Main results: More than 90% ACC is achieved on clean data for most tasks, with Non-IID performance usually less than 3% below IID performance.The reported weakness is RTE, which has only 2,240 training samples and may require a better customized prompt template.
- Backdoor evaluation: 10% poisoning produces no obvious ASR rise across tasks and models, while poisoned-data ACC drops by less than 2% in nearly all cases.The authors attribute the low backdoor impact to aggregation offsetting the backdoor.
- Communication rounds: Local ACC rises rapidly in the first round and transfers to the global model after one communication round in both IID and Non-IID settings.The reported training behavior is similar across settings without an obvious Non-IID ACC decrease.
- Communication rounds: 100% ASR appears on the malicious client after one local round, but aggregation leaves benign-client and global-model ASR low.The communication-round plots track local and global ACC and ASR during SST-2 training with BERT.
D. Number of Local Iterations
FedPrompt performs best with an intermediate number of local iterations: too few slow convergence, while too many can cause local over-fitting. Across extended experiments, 100 and 500 iterations remain weaker, whereas 1000 and 1500 do not improve further.
- D. Number of Local Iterations: 100 and 500 local iterations perform worse than the larger settings, while 1500 iterations may cause local over-fitting.The study evaluates 100, 500, 1000, and 1500 local iterations; excessive local updates can harm the global model.
- D. Number of Local Iterations: 1500 local iterations can lead to local over-fitting, which is harmful for obtaining an excellent global model.
- D. Number of Local Iterations: After extending training to 50 communication rounds, the 100- and 500-iteration settings remain below the others, while the other two settings show no further improvement.
E. Number of Soft Tokens
Increasing the number of soft tokens improves results but also increases communication cost in federated learning.
- E. Number of Soft Tokens: More soft tokens improve results but increase communication cost under FL.
F. FedPrompt with LDP
FedPrompt applies local differential privacy to protect against gradient-inversion risks while retaining a small prompt-update footprint. On SST-2, adding Laplace noise protects privacy at an accuracy cost, and the paper notes that specialized backdoor attacks remain an open concern.
- F. FedPrompt with LDP: LDP protects privacy on SST-2, with accuracy decreasing by about 5% after gradient clipping and Laplace noise addition.
- F. FedPrompt with LDP: Among the evaluated prompt methods on SST-2, prompt tuning offers the best combination of accuracy and communication cost, while P-tuning has higher accuracy but many more parameters.
- F. FedPrompt with LDP: The paper identifies further study of FL backdoor attacks as necessary despite FedPrompt's robustness to normal attacks in the reported experiments.
- F. FedPrompt with LDP: FedPrompt freezes extensive PLM parameters and aggregates only soft prompts, reducing communication cost to 0.01% of full-parameter fine-tuning.