FewFedPIT: Towards Privacy-preserving and Few-shot Federated Instruction Tuning

Approach

• Local aggregation sharing mixes public and private parameters before upload, while federated aggregation combines client updates across multiple rounds.These client-side operations are the central innovation of FewFedPIT relative to FedIT.Source: Figure 1 · p. 1, §1 · p. 2

Motivation

• FewFedPIT targets FedIT’s two persistent challenges: insufficient few-shot instruction data and vulnerability to training data extraction attacks.FedIT can reduce leakage relative to centralized training, but remains vulnerable to extraction attacks.Source: §1 · p. 2

Approach

• The method generates task-specific synthetic data from a global LLM and few-shot local demonstrations to expand local training data.Synthetic data are filtered for quality before updating the global LLM locally.Source: §1 · p. 2
• Parameter isolation training separately updates public parameters with synthetic data and private parameters with local data, reducing the impact of noisy synthetic examples.The local model also helps filter synthetic data and is later mixed with the locally updated global model.Source: §1 · p. 2

Results

• 6% to 13% average performance improvement and approximately 20% lower privacy leakage are reported across one general-domain and two medical datasets.The results are attributed to generating and filtering high-quality instruction data, which narrows the gap with centralized training.Source: §1 · p. 2

Federated instruction tuning

• Existing federated instruction-tuning work largely provides benchmarks and repositories rather than advanced federation algorithms for federated few-shot instruction tuning.FewFedPIT is positioned as a more privacy-preserving algorithm for this setting.Source: §2 · p. 2
• Prior federated few-shot NLP research mainly addresses classification with pretrained classifiers and extensive local unlabeled data, unlike complex instruction-tuning tasks.FewFedPIT instead uses the generative capabilities of LLMs for synthetic data generation.Source: §2 · p. 3

Training data extraction

• Training-data extraction attacks exploit LLM memorization and prompting to recover training data, while larger or overfitted models are more prone to leakage.FewFedPIT builds on the finding that federated aggregation can reduce privacy leakage compared with centralized training.Source: §2 · p. 3

LLM as a data generator

• Prior LLM data-generation approaches either upload private seed data or deploy expensive proprietary models locally, limiting their suitability for privacy-preserving settings.FewFedPIT instead uses progressively enhanced federated LLMs to generate task-specific synthetic data during training.Source: §2 · p. 3
• FewFedPIT complements federated synthetic-data generation with filtering to select high-quality examples for complex federated instruction tuning.This distinguishes it from related federated generative-model work that focuses mainly on image classification and overlooks synthetic-data noise.Source: §2 · p. 3

3.1 Preliminaries

• The federated setup distributes a backbone model and lightweight LoRA global parameters, then alternates client updates with server aggregation across communication rounds.Clients upload updated parameters, and the server aggregates them into the next round’s global parameters.Source: §3.1 · p. 3

3.2 Overview

• FewFedPIT combines synthetic data generation, parameter isolation training, and local aggregation sharing as its three client-side operations.The method maintains private parameters alongside global parameters and mixes them before server upload.Source: §3.2 · pp. 3–4

3.4 Parameter Isolation Training and Local Aggregation Sharing

• Parameter isolation trains Wg on synthetic data and Wl on private local data, mitigating noise that remains even after synthetic-data filtering.This separation also produces an improved privacy model that helps evaluate generated examples.Source: §3.2 · p. 4, §3.4 · p. 5
• Local aggregation sharing combines public and private parameters with β before upload, using synthetic-data updates as noise to reduce exposure of privacy parameters.Higher β exposes more privacy parameters and increases leakage risk; β = 1 reduces the approach to FedIT.Source: §3.2 · p. 4, §3.4 · p. 5

3.3 Synthetic Data Generation

• The method uses global parameters Wg to generate synthetic data and local parameters Wl to filter candidates, separating public-data generation from private-data evaluation.The evaluator is fine-tuned on local privacy data, while candidate quality is ranked by ascending Instruction Following Score.Source: §3.3 · pp. 4–5
• FewFedPIT generates diverse local candidates from demonstrations, filters failed or repetitive outputs, and selects high-quality synthetic examples using an LLM-based evaluator.The generator uses eight local instructions for new instruction generation, while Rouge-L and format checks remove unsuitable samples; an improved local model scores candidates with IFS.Source: §3.3 · pp. 4–5

4.1 Experimental Setup

• The evaluation uses ALPACA, MEDINSTRUCT, and MEDALPACA with realistic non-IID Dirichlet partitions, 50 cross-device or 10 cross-silo clients, and GPT-4 dual-sided judging.FewFedPIT generates 32 candidates per step, filters 16 with IFS, and uses β = 0.5 by default.Source: §4.1 · pp. 5–6

4.2 Utility Experiment

• FewFedPIT improves average WT score by 8.4% over federated algorithms, stays within 3% of Centralized, and exceeds FewFedWeight by 6.3%.Against the FedIT family, the improvement is 7% to 13% in the federated few-shot setting.Source: §4.2 · p. 6, Table 2 · p. 7

4.3 Privacy Experiment

• FewFedPIT achieves a better privacy–utility balance by lowering leakage relative to FedAvg while parameter isolation and local aggregation sharing address synthetic-data noise and exposure.FedAvg has the highest leakage, β = 0.0 the lowest, and β = {0.5, 0.7} outperforms FedAvg in utility; FedMIT does not reduce leakage comparably.Source: §4.3 · p. 7, Figure 3 · p. 7

4.4 Further Analysis

• Domain-similar synthetic data improves performance, whereas out-of-domain data causes a 4.5% gap versus FedAvg; FewFedPIT is 2.1% above +SIMD and within 2% WT of +IDEAL.These comparisons indicate that local-data similarity contributes to the quality of self-generated synthetic data.Source: §4.4 · p. 8, Figure 4 · p. 8
• Federated learning remains necessary because local self-generation improves LocIT but still trails FedAvg and FewFedPIT on data-scarce, privacy-sensitive tasks.The analysis compares local instruction tuning with local self-generation without FL against federated methods.Source: §4.2 · p. 6, §4.4 · p. 8
• IFS screens higher-quality synthetic samples more effectively than PPL, IFD, and random selection, while IFD performs worst by prioritizing difficult rather than high-quality instructions.The comparison covers MEDINSTRUCT and MEDALPACA.Source: §4.4 · p. 8, Figure 5 · p. 8

• FewFedPIT leverages LLM in-context learning to generate task-specific synthetic data for federated few-shot instruction tuning.Source: §5 · p. 8
• Parameter isolation training reduces the effect of noisy synthesized data by separating public-parameter and private-parameter updates.Source: §5 · p. 8
• Local aggregation sharing mixes public and private parameters before upload to defend against training data extraction attacks.Source: §5 · p. 8
• Experiments on three open-source datasets demonstrate improved federated few-shot performance and defense against data extraction attacks.Source: §5 · p. 8

• Synthetic data generation introduces additional inference computation and time overhead compared with FedIT.The authors state that iterative generation keeps the amount of synthetic data small and the inference time tolerable.Source: §6 · p. 9
• FewFedPIT is not perfectly resistant to training data extraction attacks, although β provides tradeoffs between model utility and privacy loss.Source: §6 · p. 9
• The attack setup measures response leakage, but limited federated-specific attack methods and real-world privacy instruction datasets constrain how fully the results reflect privacy risk.Source: §6 · p. 9

• The study uses ALPACA, MEDINSTRUCT, and MEDALPACA, downsampling them to construct federated few-shot scenarios.ALPACA and MEDINSTRUCT contain 52k examples, while MEDALPACA contains over 514k entries.Source: A Dataset and Training Details · p. 12
• KMeans-based selection promotes instruction diversity by clustering encoded instances and selecting 10 or 5 samples from each cluster, depending on the dataset.Source: A Dataset and Training Details · p. 12
• Utility evaluation uses AlpacaEval for ALPACA, MedInstructTest for MEDINSTRUCT, and 400 non-overlapping test entries for MEDALPACA.Source: A Dataset and Training Details · p. 12
• Training comparisons use dataset-specific hyperparameter sweeps, cosine learning-rate scheduling, Alpaca formatting, int8 quantization, and bfloat16 computation.Source: A Dataset and Training Details · p. 12
• Table 3 reviews the quality of generated synthetic data, while Table 4 reports TinyLlama-1.1B performance on the HuggingFace OpenLLM Benchmark using ALPACA synthetic data.Source: Table 3 · p. 12, Table 4 · p. 12

• Instruction generation randomly samples eight local instructions as in-context demonstrations for producing new instructions.Source: B Prompts · p. 12
• Input and response generation prompts the model with four examples, alternating demonstrations with and without inputs.Source: B Prompts · p. 12
• GPT-4 evaluates both methods on helpfulness, relevance, correctness, and coherence, averaging these scores to determine win, tie, and loss ratios.Two testing rounds alternate positional substitutions to mitigate positional bias.Source: B Prompts · p. 12

• Most synthetic instances are correct despite containing errors and noise.The review assesses correctness of instructions, inputs, and outputs for each generated instance.Source: C Synthetic Data Analysis · pp. 12–13
• Figure 6 specifies prompts that use eight demonstrations for new-instruction generation and four alternating input/no-input examples for input-output generation.Source: Figure 6 · p. 13
• Synthetic data generation produces helpful instruction-tuning data when used to train small LLMs.The generated data from ALPACA was evaluated on HuggingFace’s OpenLLM benchmark using TinyLlama-1.1B and related small models.Source: C Synthetic Data Analysis · p. 13