PaperlayerView exact revision on arXiv

Source-linked AI summary

Safely Learning with Private Data: A Federated Learning Framework for Large Language Model

JiaYing Zheng, HaiNan Zhang, LingXiang Wang, WangJie Qiu, HongWei Zheng, ZhiMing Zheng

arXiv:2406.14898v4cs.CRcs.CL

TL;DR

Private data could improve LLMs but is distributed across privacy-sensitive silos, and existing federated or split-learning approaches face client-computation, leakage, and efficiency challenges. FL-GLM adapts split learning with local input/output blocks, encrypted communication, and server-capacity-aware parallelization. It achieves performance comparable to centralized chatGLM models while saving more than 48% of training time, though current evaluation is limited to ChatGLM-6B and remains subject to a privacy-utility trade-off.

  • Problem

    Private data is distributed across isolated silos, while traditional federated learning is computationally unsuitable for LLM clients and split learning remains vulnerable to leakage and inefficient serial training.

    Source: §1 · pp. 1–2

  • Method

    FL-GLM uses split deployment with input and output blocks on clients, encrypted client-server communication, and client-batch or server-hierarchical acceleration selected by server capacity.

    Source: §1 · p. 2

  • Results

    FL-GLM achieves performance comparable to centralized chatGLM-6B models on NLU and generation tasks and saves more than 48% of training time.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The framework provides a federated LLM training design that combines private-data locality, protection against server and peer-client attacks, and improved training efficiency.

    Source: §1 · p. 2, §5 · p. 9

    The evaluation is limited to ChatGLM-6B, remains subject to a privacy-utility trade-off, and requires further optimization of communication consumption.

    Source: Limitations · p. 10

Abstract

from arXiv · show

Private data, being larger and quality-higher than public data, can greatly improve large language models (LLM). However, due to privacy concerns, this data is often dispersed in multiple silos, making its secure utilization for LLM training a challenge. Federated learning (FL) is an ideal solution for training models with distributed private data, but traditional frameworks like FedAvg are unsuitable for LLM due to their high computational demands on clients. An alternative, split learning, offloads most training parameters to the server while training embedding and output layers locally, making it more suitable for LLM. Nonetheless, it faces significant challenges in security and efficiency. Firstly, the gradients of embeddings are prone to attacks, leading to potential reverse engineering of private data. Furthermore, the server's limitation of handle only one client's training request at a time hinders parallel training, severely impacting training efficiency. In this paper, we propose a Federated Learning framework for LLM, named FL-GLM, which prevents data leakage caused by both server-side and peer-client attacks while improving training efficiency. Specifically, we first place the input block and output block on local client to prevent embedding gradient attacks from server. Secondly, we employ key-encryption during client-server communication to prevent reverse engineering attacks from peer-clients. Lastly, we employ optimization methods like client-batching or server-hierarchical, adopting different acceleration methods based on the actual computational capabilities of the server. Experimental results on NLU and generation tasks demonstrate that FL-GLM achieves comparable metrics to centralized chatGLM model, validating the effectiveness of our federated learning framework.

1 Introduction

Private data could improve LLMs but is distributed across privacy-sensitive silos, while existing federated and split-learning approaches face client-computation, security, and efficiency constraints. FL-GLM addresses these constraints through a privacy-preserving split architecture and adaptive parallel training, achieving performance comparable to centralized chatGLM models.

Motivation

  • Private data is richer than public data but remains distributed across isolated silos, making secure language-model training difficult.Federated learning keeps data on user devices while sharing model updates.Source: §1 · pp. 1–2

Challenges

  • Traditional FedAvg and Fed-Prox require clients to train entire LLMs, whereas split learning reduces client computation by keeping most parameters on the server.Split learning still exposes embedding gradients and serializes server-side client training.Source: §1 · p. 2

FL-GLM

  • FL-GLM places input and output blocks on clients, keeps the remaining large parameters on the server, and encrypts client hidden states during communication.The design targets both server-side embedding-gradient attacks and peer-client interception.Source: §1 · p. 2

Results

  • FL-GLM achieves performance comparable to centralized chatGLM-6B models on NLU and generation tasks, while its client-batch and server-hierarchical mechanisms save more than 48% of training time.Source: §1 · p. 2

Acceleration

  • Client-batch and server-hierarchical strategies enable parallel training according to the server’s computational capacity.Client-batch suits single machines with multiple GPUs, while server-hierarchical training supports multi-machine GPU clusters.Source: §1 · p. 2

2 Related Work

Prior federated language-model methods distribute optimization while preserving user privacy, but LLM training remains constrained by client resources, communication costs, and leakage risks. FL-GLM responds by combining split deployment with encrypted communication to reduce these risks while retaining model structure.

2.1 Federated Learning in LM

  • Federated language-model training keeps data decentralized and aggregates client updates, with FedAvg and related methods extending this paradigm through weighted or layer-wise aggregation.Differential privacy has also been integrated into federated optimization methods.Source: §2.1 · pp. 2–3
  • Split learning places resource-intensive transformer computation on servers while clients train lighter layers, but FedBERT still incurs high communication costs and embedding-gradient leakage risks.FedBERT separates Embedding, Transformer, and Output layers for language-model pretraining.Source: §2.1 · p. 3

2.2 Attacks and Defenses

  • Embedding-gradient attacks can infer client words and reconstruct private text through beam search, while proposed defenses include freezing embeddings, noise, clipping, MixUp, and server-side filtering.The cited defenses can reduce model accuracy.Source: §2.2 · p. 3
  • FL-GLM moves selected head layers to clients and encrypts client-server data transfers, preventing server gradient attacks and peer information eavesdropping while limiting performance loss from structural changes.The approach retains more of the original model structure than defenses that directly modify gradients.Source: §2.2 · p. 3

3 Model

FL-GLM splits the LLM across clients and servers, encrypts transmitted smashed data, and supports serial or parallel training strategies. The design keeps client data and labels local while adapting computation and communication to server capacity.

3.1 Model Split

  • FL-GLM places the embedding, first and last LLM blocks, and final linear layer on clients, while deploying intermediate blocks on the server.For ChatGLM, the client holds the embedding layer, blocks 0 and 27, and the final linear layer; blocks 1–26 remain server-side.Source: §3.1 · p. 3, §3 · p. 3
  • Client-side processing produces smashed data, the server computes intermediate hidden states, and the client completes prediction and loss calculation while retaining data and labels.The server returns its output to the client, which applies the final block and linear layer before calculating cross-entropy loss.Source: §3.1 · pp. 3–4
  • FL-GLM supports p-tuning v2 by freezing original model parameters and training a prefix encoder that adjusts each LLM-Block output.The prefix encoder splices prefix_key and prefix_value with the original model’s key and value representations.Source: §3.1 · p. 4, Figure 2 · p. 4

3.2 Encrypted Transmission

  • RSA key encryption protects smashed data during client-server transmission by allowing public-key encryption and private-key decryption.The procedure publishes n and e, encrypts plaintext as C = m^e (Mod n), and decrypts it with the private exponent d.Source: §3.2 · p. 4

3.3 Parallel Acceleration

  • Serial training suits limited server capacity, whereas parallel strategies address split-learning constraints that prevent averaging smashed data across clients.Serial training communicates with one client at a time; parallel training instead stacks client smashed data into a larger batch or runs corresponding server-side models simultaneously.Source: §3.3 · p. 5, Figure 3 · p. 5, Figure 4 · p. 5

4 Experiments

Experiments evaluate FL-GLM across NLU, summarization, training efficiency, data heterogeneity, security, and alternative base models. FL-GLM remains comparable to centralized models while reducing training time and limiting demonstrated attack performance.

4.1 Experimental Settings

  • Evaluation uses SuperGLUE for NLU and CNN/DailyMail plus XSum for abstractive summarization, with logit or summed answer-token log-probabilities for NLU and ROUGE metrics for summarization.The experiments compare against centralized ChatGLM-6B and seven additional baselines using ChatGLM-6B as the federated base model.Source: §4.1.1 · p. 5, §4.1.2 · p. 6, §4.1.3 · p. 6

4.2.1 Metric-based Evaluation

  • FL-GLM achieves language-understanding and summarization performance comparable to centralized ChatGLM-6B, with reported NLU gaps of 0.3–1.5 points and summarization gaps no larger than 1.0.On CNN/DailyMail it obtains 39.6 ROUGE-1, 16.9 ROUGE-2, and 28.0 ROUGE-L; on XSum it obtains 37.0, 11.9, and 29.4, respectively.Source: Table 2 · p. 6, §4.2.1 · p. 7

4.3.1 Training Efficiency

  • Parallel client-batch and server-hierarchical strategies substantially reduce training time compared with serial training, while parallel speed improves with the number of clients.The reported overall analysis states that these mechanisms can save more than 48% of training time.Source: §4.3.1 · p. 7, Table 3 · p. 7
  • Across two machines, FL-GLM training is approximately five times slower than centralized training, increasing from 0.91 s/step centrally to 4.83 s/step.A single machine with two GPUs requires 1.79 s/step.Source: §4.3.1 · pp. 7–8

4.3.2 Impact of IID and non-IID

  • Under non-IID COPA data, serial and server-parallel fine-tuning lose approximately 7% performance, whereas client-batch training is not significantly affected.Stacking client features into batches lets server-side parameters learn from multiple clients and partly mitigates heterogeneity-related loss.Source: §4.3.2 · p. 8, Figure 5 · p. 8

4.3.3 Security Analysis

  • Security experiments show that an attack reaches BLEU-4 28.570 and ROUGE-1 33.290 with an embedding-only client, while FL-GLM attack metrics are all close to 0.The FL-GLM split places an LLM block with the embedding layer on the client; single-block and multi-block Transformers show similar attack performance.Source: §4.3.3 · pp. 8–9, Table 4 · p. 9

4.3.4 More Basement Model

  • With Llama2-7B-Chat, FL-Llama achieves comparable accuracy across six SuperGLUE datasets, suggesting the framework is not tied to one base-model type.The experiment uses serial training and LoRA fine-tuning with instruction prompts adapted to Meta’s templates.Source: §4.3.4 · p. 9, Table 5 · p. 9
  • On sampled Huatuo-26M data, FL-GLM degrades by no more than 0.72 versus ChatGLM-6B, while FL-Chinese-Llama declines by no more than 0.38 versus Llama2-Chinese-7B-Chat.The paper reports that ChatGLM has stronger Chinese conversational capability than Llama2-Chinese-7B-Chat and recommends ChatGLM for Chinese applications.Source: §4.3.4 · p. 9, Table 6 · p. 9

5 Conclusions

FL-GLM combines split learning, encrypted communication, and server-aware acceleration to train LLMs with limited client resources while preserving local data privacy.

  • FL-GLM places input and output blocks on clients while centralizing the remaining primary parameters on a server.Source: §5 · p. 9
  • Encryption secures information transferred between clients and the server.Source: §5 · p. 9
  • Client-batch and server-hierarchical methods are selected according to server capacity to enable parallel training and reduce training time.Source: §5 · p. 9

Limitations

FL-GLM achieves results close to centralized tests, but its current scope and efficiency remain limited.

  • FL-GLM was evaluated on SuperGLUE, CNN/DailyMail, and XSum, achieving results close to centralized tests.Source: Limitations · p. 10
  • The framework remains constrained by the privacy-utility trade-off and requires further communication-efficiency optimization.Source: Limitations · p. 10
  • FL-GLM is currently limited to ChatGLM-6B, with future work targeting models such as Llama.Source: Limitations · p. 10

Ethical Considerations

The paper presents FL-GLM as a privacy-conscious framework and bases its experiments on licensed open-source datasets rather than private data.

A P-tuning v2

P-tuning v2 adds learnable prefixes to each LLM block while freezing the model parameters, and its forward pass combines these prefixes with the model’s key and value representations.

  • P-tuning v2 adds a learnable prefix of length Lp to each LLM-Block’s attention operation while freezing model parameters.Source: A P-tuning v2 · p. 12
  • Each block’s prefix contains prefix_key and prefix_value tensors shaped by sequence length, batch size, attention heads, and head dimension.Source: A P-tuning v2 · p. 12
  • During forward computation, the prefix is spliced with frozen keys and values to form new representations used with the original query for attention and hidden-state computation.Source: A P-tuning v2 · p. 12

B Dataset

The SuperGLUE evaluation covers eight NLU tasks spanning comprehension, reasoning, entailment, coreference, lexical semantics, and yes/no question answering.

B Dataset

  • SuperGLUE includes MultiRC, ReCoRD, COPA, WSC, RTE, BoolQ, WiC, and CB.These tasks collectively assess reading comprehension, commonsense and causal reasoning, pronoun and coreference resolution, textual entailment, Boolean question answering, lexical semantics, and embedded-clause entailment.Source: B Dataset · p. 12
  • ReCoRD combines passage-based information extraction with commonsense reasoning and ambiguous-pronoun resolution.Source: B Dataset · p. 12
  • COPA evaluates causal reasoning by requiring selection between two alternative hypotheses.Source: B Dataset · p. 12
  • WSC and WiC evaluate pronoun/coreference resolution and whether words retain the same sense across contexts.Source: B Dataset · p. 12
  • RTE, BoolQ, and CB assess textual entailment, binary question answering, and entailment involving embedded clauses.Source: B Dataset · p. 12
  • The benchmark tests comprehension of complex documents through multiple-choice questions in MultiRC.Source: B Dataset · p. 12

C Impact of Average Period

FL-GLM was evaluated with 50- and 100-step averaging periods, showing task-dependent differences but little overall effect under the same training strategy.

C Impact of Average Period

D Impact of Participants

Participant scaling has little effect under serial training but slightly reduces parallel-training accuracy, with different mechanisms for client-batch and hierarchical-server strategies.

D Impact of Participants

  • The participant-scaling tests use different datasets for serial, client-batch, and server-hierarchical strategies while keeping hyperparameters such as learning rate consistent.Client-batch experiments also use equal training epochs across client counts and normalization to improve result visibility.Source: D Impact of Participants · p. 13
  • Serial-training accuracy changes minimally as client numbers increase because most parameters are trained on the server.Source: D Impact of Participants · p. 14
  • In client-batch parallel training, accuracy decreases as clients increase because larger batches reduce parameter-update frequency and encourage saddle-point convergence.Source: D Impact of Participants · p. 14, Figure 7 · p. 14
  • In hierarchical-server parallel training, more clients reduce each client’s data volume and intensify overfitting.Source: D Impact of Participants · p. 14, Figure 8 · p. 14

Related papers

Loading 2406.14898v4…