PaperlayerView exact revision on arXiv

Source-linked AI summary

When Privacy Hurts Mergeability: Geometry-Aware Model Merging under Differential Privacy

Jin Liu, Junkang Liu, Ning Xi, Yinbin Miao, Dawei Wei, Ke Cheng, Jianfeng Ma

arXiv:2608.26655v1cs.LG

TL;DR

Differential privacy can make independently fine-tuned task models harder to merge, beyond reducing their individual utility. DP-Merging addresses this with flatness and pretrained-anchor regularization, consistently improving merged-model performance on vision and language tasks while preserving underlying DP guarantees.

  • Problem

    The effect of differential privacy on model merging is poorly understood, despite the appeal of combining private task models without centralizing task data.

  • Method

    DP-Merging combines a DP-compatible sharpness-aware objective with reference-anchored alignment during private fine-tuning to reduce local sharpness and reference drift.

  • Results

    DP-Merging consistently improves merged-model performance across vision and language tasks and privacy budgets; on ViT-B/32, WUDI-Merging rises from 56.5% to 60.8%.

  • Takeaways & Limitations

    The results support geometry-aware private fine-tuning as a way to improve the compatibility of differentially private task models for parameter-space merging.

  • Takeaways & Limitations

    The framework assumes each task-specific fine-tuning algorithm satisfies (ε, δ)-differential privacy, with merging treated as post-processing.

Abstract

from arXiv · show

Model merging promises to construct a single multi-task model from independently fine-tuned task models without accessing the original task data. This makes it attractive when task data cannot be centralized, but released task models may still leak private fine-tuning data. Differential privacy (DP) provides a principled mechanism for limiting such leakage, yet its effect on model merging remains poorly understood. In this paper, we study the geometry of differentially private model merging and identify two geometric obstacles that make private task models difficult to merge: \emph{local sharpness}, which makes task losses sensitive to the parameter displacement induced by merging, and \emph{reference drift}, which measures the displacement of private task models from the shared pretrained initialization and amplifies cross-task interference. Based on these observations, we propose \textbf{DP-Merging}, a geometry-aware framework that improves the mergeability of differentially private task models. DP-Merging uses a DP-compatible sharpness-aware objective to guide each private task model toward flatter loss regions, and a reference-based alignment regularizer to keep task models close to the shared pretrained initialization. We derive a merge-gap upper bound showing that reducing local curvature and reference drift tightens the bound on the loss increase induced by merging. Experiments on vision and language tasks across multiple privacy budgets show that DP-Merging consistently improves private merged-model performance while preserving the privacy guarantees of the underlying DP fine-tuning procedures.

1 Introduction

The introduction argues that differential privacy can degrade model mergeability by disrupting geometric compatibility, not merely by reducing task-model accuracy. It proposes DP-Merging, which combines sharpness-aware optimization and reference alignment during private fine-tuning to improve merging while preserving privacy guarantees.

  • Motivation: Model merging combines independently fine-tuned models without joint task-data access, avoiding the data-sharing and retraining costs of multi-task learning.This makes merging attractive when task data cannot be centralized, although independently storing and deploying task models becomes costly.
  • Privacy challenge: Released task weights and task vectors can leak private fine-tuning data, motivating differential privacy as a framework for limiting such leakage.DP bounds the influence of any single training example on released models.
  • Geometric failure mode: DP-induced mergeability degradation arises because privacy fine-tuning increases local sharpness and reference drift, amplifying parameter interference after merging.The introduction frames this as a geometric compatibility problem rather than merely an accuracy loss from DP.
  • DP-Merging: DP-Merging applies a DP-compatible sharpness-aware objective and reference-based alignment regularizer during private fine-tuning to produce flatter, more geometrically aligned task models.Its merge-gap bound relates post-merging loss increase to local curvature and merge-induced parameter displacement.

2 Related Work

Related work spans non-private model merging, differentially private fine-tuning, and geometric explanations of mergeability. Existing merging methods largely target non-private models, while private fine-tuning primarily optimizes single-model privacy–utility trade-offs and prior studies connect merging success to parameter-space geometry.

  • Non-private model merging: Non-private model merging includes weight averaging, task-vector composition, and structured rules based on parameter importance or interference resolution.Representative methods include Weight Averaging, Task Arithmetic, Fisher-weighted merging, RegMean, TIES-Merging, PCB Merging, and WUDI-Merging.
  • Differentially private fine-tuning: Differentially private fine-tuning commonly uses per-example gradient clipping and Gaussian noise injection to balance privacy and utility for a single released model.Alternative paradigms include forward-pass perturbation and zeroth-order optimization.
  • Geometry of mergeability and sharpness: Prior work links mergeability to parameter-space alignment, low-loss connectivity, and loss-landscape structure, with averaging more reliable in compatible low-loss regions.Direct merging can fail when parameters are misaligned.

3 Preliminaries

The paper formalizes private task-specific fine-tuning and post-hoc merging from a shared pretrained model, with merging performed on released task vectors. It identifies local sharpness and reference drift as geometric obstacles that increase merge-induced loss and evaluates them through merge gaps and interpolation paths.

  • Private Task-specific Fine-tuning: Each task independently applies an (ε, δ)-differentially private algorithm to the shared initialization w0 and its private dataset Dt, producing wt.The empirical loss Lt serves as a proxy for task risk.
  • Differential privacy: Released task models retain (ε, δ)-DP through parallel composition, while subsequent merging is post-processing and adds no privacy loss.This holds because each private example contributes to only one task and merging uses released models plus public information.
  • Post-hoc Model Merging: A post-hoc rule constructs wmerge from released task models, equivalently combining task vectors ∆t = wt − w0 to obtain a data-free model with low average task loss.The merging rule operates in task-vector space without access to the private task data.
  • Merge Gap: The task-wise merge gap Gapt(wmerge) = Lt(wmerge) − Lt(wt) diagnoses mergeability, increasing with local curvature and displacement from wt to wmerge.Lt is used only for evaluation and is unavailable to the post-hoc merging rule.
  • Challenge 1: local sharpness: Naive DP exhibits greater local sharpness under tighter privacy budgets, whereas DP-Merging reduces sensitivity to parameter perturbations across eight vision tasks.The effect arises because gradient clipping and Gaussian noise can make private task models more sensitive to the displacement induced by merging.
  • Challenge 2: reference drift: Naive DP also produces larger reference drift under stronger privacy constraints, while DP-Merging limits drift from w0 and reduces the resulting merge-induced displacement.For weight averaging, displacement grows when task updates are large or poorly aligned.

4 DP-Merging

DP-Merging is a geometry-aware framework that addresses local sharpness and reference drift in differentially private model merging. It combines privatized sharpness-aware optimization with alignment to the shared pretrained initialization, while preserving privacy accounting and adding no privacy cost for the anchor.

  • Sharpness-aware optimization: DP-Merging optimizes private task losses in nearby adversarial neighborhoods, producing solutions locally stable against merge-induced parameter perturbations.This targets the curvature term by avoiding solutions that are optimal only at a single parameter point.
  • Sharpness-aware optimization: Each sharpness-aware update uses two clipped Gaussian-private gradient evaluations: one finds a nearby high-loss direction, and the other updates against the perturbed loss.The perturbation radius ρ_t controls the neighborhood size, and both evaluations are included in the privacy analysis.
  • Reference alignment: An alignment regularizer anchors every task model to the shared pretrained initialization, controlling displacement and reducing the distance between merged and task-specific solutions.The alignment strength is controlled by λ, and the regularizer depends only on model parameters and the public initialization.
  • Merging and privacy: Weight averaging is the default merge rule, while other post-hoc rules remain possible because the final merge processes only differentially private outputs and therefore preserves privacy guarantees.The alignment mechanism requires no communication between tasks during fine-tuning.

5 Theoretical Analysis

DP-Merging preserves the privacy guarantees of its underlying privatized gradient evaluations because its additional operations are post-processing. Its mergeability bound identifies local curvature and merging displacement as key drivers, which the sharpness-aware update and reference anchor respectively reduce.

  • Privacy guarantee: DP-Merging incurs no additional privacy loss beyond its two privatized clipped-gradient evaluations per iteration because sharpness perturbation, reference anchoring, and merging are post-processing.With disjoint task datasets, releasing all private task models also incurs no additional privacy loss by post-processing.
  • Privacy guarantee: For K iterations with Poisson sampling rate q and Gaussian noise multiplier σ, each released task model satisfies (α, Kεpair(α; q, σ))-RDP for any α > 1.The theorem assumes disjoint task datasets and that each private example belongs to at most one task.
  • Mergeability bound: The merge-gap bound decreases when local curvature βt or merging displacement ∥∆t∥2 decreases, directly motivating DP-Merging’s two geometric interventions.The sharpness-aware update targets curvature, while the reference-anchored regularizer controls task-vector norms and therefore merging displacement.
  • Uniform-case interpretation: In the uniform case, the resulting bound explains improved private mergeability by reducing curvature β and the displacement scale (G + ζ)/λ.The sharpness-aware component reduces β, whereas the anchor reduces the displacement scale.

6 Experiments

Experiments on vision and language benchmarks show that DP-Merging improves the mergeability and merged-model performance of differentially private task models across merging operators and privacy budgets. Ablations and sensitivity studies attribute these gains to sharpness-aware fine-tuning and reference-anchored alignment, with moderate hyperparameter values working best.

  • Experimental setup: Experiments cover eight vision classification datasets with CLIP-based ViT backbones and GLUE tasks with RoBERTa-Base and RoBERTa-Large.The vision backbones include ViT-B/32, ViT-B/16, and ViT-L/14.
  • Visual tasks: Under ε = 4, DP-Merging consistently improves merged accuracy over standard DP merging methods across both evaluated vision backbones.Standard merging methods show a clear drop from the DP individual reference, while DP-Merging improves accuracy under all merging operators.
  • Language tasks: At ε = 4 on GLUE with RoBERTa-Large, DP-Merging average scores range from 73.9 to 77.0, versus 71.6 to 74.7 for naive DP.The improvement holds across different merging operators.
  • Privacy-budget evaluation: DP-Merging consistently outperforms naive DP merging across privacy budgets, with larger improvements under stronger privacy constraints.Smaller ε indicates stronger privacy protection and usually introduces larger optimization perturbations through clipping and noise.
  • Ablation studies: Both sharpness-aware fine-tuning and reference-anchored alignment improve performance over naive DP.Sharpness-aware fine-tuning encourages flatter task-specific solutions and improves local robustness, while alignment limits reference drift.
  • Hyperparameter sensitivity: Moderate flatness-radius and alignment-strength values improve merged accuracy, whereas excessively large values can hurt adaptation or limit cross-task flexibility.The flatness-radius study fixes λ, and the alignment-strength study fixes ρ.
  • Robustness to merging operators: DP-Merging improves final merged models across representative data-free merging operators, indicating enhanced intrinsic mergeability of private task models.The evaluated operators include Weight Averaging, Task Arithmetic, TIES-Merging, PCB-Merging, and WUDI-Merging.

7 Conclusion

The paper shows that differentially private model merging is hindered by both DP utility loss and geometric incompatibility from local curvature and displacement from the pretrained anchor. DP-Merging addresses these issues with a flatness objective and pretrained-anchor regularization to improve robustness and control task-specific drift.

  • Conclusion: Differentially private model merging combines independently fine-tuned private models without sharing task data.The setting is motivated by the privacy of decentralized task data.
  • Conclusion: Private models are difficult to merge because DP utility loss is compounded by local curvature and displacement from the pretrained anchor.These geometric factors create incompatibility between independently fine-tuned models.
  • Conclusion: DP-Merging combines a flatness objective with a pretrained-anchor regularizer to improve robustness and control task-specific drift.The framework targets both local curvature and displacement from the shared pretrained initialization.

Supplementary Material … B.3 Implementation Details

The supplementary material documents the notation, datasets, model architectures, and implementation settings used to evaluate DP-Merging. Experiments span private vision and language task models, with merging performed only on released DP models and fixed method-specific hyperparameters.

  • LIST OF APPENDICES: The appendices organize the supplementary material around notation and experimental implementation.Table 9 summarizes the paper’s main notation.
  • B.1 Datasets: Training data remain private during DP fine-tuning, while merging accesses only released DP task models.The merging stage does not use original training data.
  • B.1 Datasets: Vision evaluation covers eight classification tasks spanning scenes, cars, remote sensing, digits, traffic signs, and textures.The tasks are SUN397, Cars, RESISC45, EuroSAT, SVHN, MNIST, GTSRB, and DTD.
  • B.1 Datasets: Language evaluation uses eight GLUE tasks, with separate private models fine-tuned under sample-level differential privacy before merging.The tasks include CoLA, SST-2, MRPC, QQP, STS-B, MNLI, RTE, and QNLI.
  • B.2 Models: Vision models use CLIP-pretrained ViT-B/32, ViT-B/16, and ViT-L/14 backbones initialized from the same public checkpoint.ViT-B/32 and ViT-B/16 have 12 layers and hidden dimension 768; ViT-L/14 has 24 layers and hidden dimension 1024.
  • B.2 Models: Language models use RoBERTa-Base and RoBERTa-Large, merging shared encoder parameters from independently DP-fine-tuned task models.RoBERTa-Base has 12 layers and hidden dimension 768, whereas RoBERTa-Large has 24 layers and hidden dimension 1024.
  • B.3 Implementation Details: Default DP fine-tuning uses gradient clipping C = 0.2, batch size 16, learning rate 1 × 10−5, weight decay 1 × 10−2, 10 training epochs/steps, and AdamW.AdamW uses (β1, β2) = (0.9, 0.999), with deviations noted in the corresponding main-text experiment descriptions.
  • B.3 Implementation Details: Merging comparisons use fixed method-specific settings, while DP-Merging consistently uses ρ = 0.05 and λ = 0.05 across tasks.Task Arithmetic uses scaling coefficient 0.3 and TIES-Merging uses pruning density 0.2; PCB Merging and WUDI-Merging use their original default configurations.

B.4 More Results on Vision Tasks … C.3 Reference Anchoring Controls Merging Displacement

Across vision and language tasks, DP-Merging improves the mergeability and performance of private task models over simple weight averaging. Its analysis shows that reference anchoring controls merging displacement while preserving the privacy guarantees of DP fine-tuning.

  • B.4 More Results on Vision Tasks: On eight vision benchmarks, DP-Merging substantially improves multi-task accuracy over simple weight averaging, whose average accuracy is 46.8%, while individual training reaches 80.0%.The passage indicates that DP-Merging variants combined with weighting or aggregation strategies improve multi-task performance, though the specific variant values are truncated.
  • B.4 More Results on Vision Tasks: Under ε = 4, loss landscapes compare Naive DP fine-tuning plus Task Arithmetic against DP-Merging plus Task Arithmetic across three ViT variants.The visualized merged models are ViT-B/32, ViT-B/16, and ViT-L/14.
  • B.5 More Results on Language Tasks: On GLUE, DP-Merging + Task Arithmetic reaches 73.9 and DP-Merging + WUDI-Merging reaches 76.5, compared with 72.3 for simple weight averaging.Individual training achieves the highest average score, 79.8.
  • C Implementation of Theoretical Analysis: Each DP-Merging iteration uses two privatized clipped-gradient evaluations, while the sharpness perturbation, reference anchoring, and merging operations are post-processing or use public information.The two adaptive private queries are accounted for under RDP, and anchoring adds no privacy loss.
  • C.1 Privacy guarantee of DP-Merging: For disjoint task datasets, releasing all private task models uses parallel composition, and deterministic model merging incurs no additional privacy loss.When privacy parameters are shared across tasks, the guarantee reduces to (εt, δt)-DP.
  • C.2 Mergeability Analysis: The merge-gap analysis bounds each task’s loss increase using displacement ∥∆t∥2 through second-order curvature and a third-order Taylor remainder.The theorem assumes local third-order smoothness and approximate stationarity, with εt capturing optimization error, clipping bias, and DP noise.
  • The third-order Taylor remainder satisfies: The third-order Taylor remainder contributes a term proportional to Mt/6 ∥∆t∥3_2 in the merge-gap bound.The bound is obtained by applying Taylor’s theorem along ∆t = wmerge − wt and averaging over tasks.
  • C.3 Reference Anchoring Controls Merging Displacement: Reference anchoring bounds task-vector displacement through the anchoring strength λ, yielding an explicit DP-Merging merge-gap bound after substitution into the general theorem.The task-vector bound relates 2λ∥wt − w0∥2 to stationarity and robust-gradient terms, while the corollary substitutes this control into the merge-gap expression.

C.4 Connection to Joint-Task Loss Linearity

Theorem C.8 connects model-merging geometry to joint-task loss linearity: flatter task losses and stronger anchoring reduce the interpolation’s linearity gap. DP-Merging therefore weakens parameter interference through reduced curvature and task-model displacement.

  • Joint-task loss linearity: A smaller |δs,t(α)| means interpolation between task models is closer to linear on the joint-task loss landscape.
  • Theorem C.8: Theorem C.8 states that flatness and anchoring imply joint-task loss linearity under locally third-order smooth task losses.The theorem accounts for third-order Taylor remainders in its bound.
  • Geometric mechanisms: Sharpness-aware training reduces dominant Hessian eigenvalues λs and λt, while reference anchoring reduces the distance ∥ws −wt∥2 between task models.
  • Geometric mechanisms: Together, reduced curvature and task-model displacement decrease the joint-task loss linearity gap and weaken parameter interference during model merging.

D Limitations and Future Work

The paper reports that DP-Merging’s effectiveness is not fully established for highly heterogeneous tasks, substantially different architectures, or settings beyond standard benchmarks and mid- to large-scale models. Future work targets adaptive, larger-scale, and uncertainty-aware merging methods to improve training stability and consistency.

  • Limitations: Parameter merging depends on task-specific compatibility, and performance on highly heterogeneous tasks or substantially different architectures remains unexplored.
  • Limitations: Experiments are limited to standard benchmarks and mid- to large-scale models, including ViT-L/14 and RoBERTa-Large.
  • Future Work: Future work will develop adaptive merging based on task similarity and parameter sensitivity, extend the approach to larger and more diverse architectures, and explore dynamic task balancing and uncertainty-aware weighting.These mechanisms are intended to improve stability and consistency across tasks during training.
Loading 2608.26655v1…