PaperlayerView exact revision on arXiv

Source-linked AI summary

Privacy-Preserving Split Learning for Federated LLM Fine-Tuning

Heng Jin, Chaoyu Zhang, Hexuan Yu, Wenjing Lou, Y. Thomas Hou

arXiv:2609.09794v1cs.LG

TL;DR

Split federated LLM fine-tuning exposes private inputs because autoregressive models let the server decode transmitted activations, while perturbation defenses cannot preserve both privacy and utility. PrivPair learns client-side obfuscation and recovery adapters, and experiments report strong privacy protection with modest utility loss and overhead across multiple models and datasets.

  • Problem

    Autoregressive LLM fine-tuning allows a white-box server to reconstruct labels and infer inputs from smashed data, making perturbation-based defenses insufficient.

  • Method

    PrivPair uses two lightweight client-side adapters: W1 obfuscates transmitted activations and W2 recovers returned activations for client-side training.

  • Results

    Across four LLMs and three downstream datasets, PrivPair substantially reduces reconstruction quality while preserving training utility with modest loss and client-side overhead.

  • Takeaways & Limitations

    PrivPair makes privacy-preserving split-based federated LLM fine-tuning practically viable while retaining a complete deployable model on the server.

Abstract

from arXiv · show

Fine-tuning large language models (LLMs) on domain-specific data is essential for downstream adaptation. In many deployments, a participant cannot hold the complete model locally. This happens because the model owner keeps the full model proprietary, or because the participant lacks sufficient compute resources. Split Learning (SL) addresses this by partitioning the model between the participant and a server so that only a small portion runs locally. When the underlying data is additionally distributed across multiple institutions with privacy requirements, Federated Learning (FL) further enables collaborative training across participants by sharing only model updates instead of raw data. In this combined setting, each client transmits intermediate activations to the server, and for LLM fine-tuning, this exchange poses an inherent privacy paradox. The autoregressive nature of LLMs causes the transmitted activations to leak the input, and existing perturbation-based defenses are fundamentally ineffective in this setting. We address this leakage through a learned obfuscate-and-recover scheme that protects participants' private datasets while still allowing an independently deployable model to be trained on the server side. Experiments demonstrate that our approach achieves strong privacy protection with modest utility loss and system overhead, making split-based federated LLM fine-tuning practically viable.

I. INTRODUCTION

Federated split learning combines SL’s resource savings with FL’s privacy-preserving collaboration, but autoregressive LLM fine-tuning lets servers reconstruct private inputs from transmitted activations. PrivPair addresses this tension with client-side obfuscation and recovery adapters while retaining a deployable server model.

  • I. INTRODUCTION: Federated split learning lets institutions keep raw data local while clients offload most computation to a server, addressing privacy and hardware or model-access constraints together.SL partitions the model across participant and server, while FL exchanges model updates rather than raw data.
  • I. INTRODUCTION: Autoregressive next-token training makes smashed-data leakage especially severe because labels closely mirror inputs and a white-box server can decode them.This is why perturbation-based defenses that only modify smashed data are insufficient for LLM fine-tuning.
  • I. INTRODUCTION: PrivPair uses lightweight client-side adapters to obfuscate smashed data before transmission and recover returned activations for client-side training.W1 makes activations incompatible with the server decoder, while W2 maps returned activations toward a representation compatible with the client model.
  • I. INTRODUCTION: PrivPair preserves the standard FL deployment workflow by allowing the server to retain a complete directly deployable model while adapters remain client-local.The framework retains shared A and C components while each client or trust group keeps its own adapter pair.
  • I. INTRODUCTION: The framework is evaluated against reconstruction attacks and baseline defenses, with the reported outcome of strong privacy protection, modest utility loss, and modest client-side computation.The evaluation spans four instruction-tuned LLMs and three downstream datasets.

B. Scope

PrivPair targets cut-point leakage in split federated LLM fine-tuning by separating the server’s obfuscated activation space from the client’s recoverable representation. It uses local adapters and a frozen server middle block to preserve training and deployment properties.

  • B. Scope: The method addresses cut-point leakage rather than attacks on federated model updates.The stated scope excludes gradient-inversion attacks against client uploads and focuses on data exchanged at split-learning cut points.
  • B. Scope: LLM autoregression makes perturbation defenses fundamentally limited because the server’s decoder is also the next-token predictor used for training.Stronger perturbations improve privacy but damage trainability, while weaker perturbations leave label reconstruction possible.
  • B. Scope: PrivPair obfuscates smashed data before transmission and recovers the returned activations locally, so the server operates in an obfuscated space while the client remains aligned with the original model.The recovery adapter is learned jointly with the obfuscation adapter rather than assumed to be an exact inverse.
  • B. Scope: The split model uses client components A and C around server component B, exchanging intermediate activations and gradients while federated aggregation updates client-side parameters.The protocol keeps B frozen and applies the adapter path around the server computation.
  • B. Scope: W1 is a client-side residual MLP that replaces transmitted sA with obfuscated s′A, while W2 consumes the server output and a local residual to produce recoverable activations.The local residual is never transmitted, and straight-through estimation preserves gradient flow through the adapter-wrapped path.

C. Adapter Training

PrivPair’s adapters use distinct activation-space roles: W1 balances privacy against recoverability, while W2 restores a representation usable by the client-side tail model.

  • C. Adapter Training: W1 obfuscates smashed data to hinder the server decoder while preserving enough structure for W2 to support effective training.W2 is dedicated to mapping the obfuscated server output back to a representation compatible with C.
  • C. Adapter Training: The notation distinguishes plain, W1-only, and full-adapter paths through their intermediate activations and logits.These paths provide the representations used to formulate the adapter objectives.
  • C. Adapter Training: PrivPair defines token-level softmax distributions over logits using a temperature parameter for its adapter-training objectives.The distribution is defined over valid token positions and the vocabulary.

1) Loss of W1:

W1 is trained with privacy objectives that reduce server decodability while coupling obfuscation to the recoverability required for useful fine-tuning.

  • 1) Loss of W1:: Maximizing divergence between W1-only and plain-path logits reduces the server’s ability to decode transmitted obfuscated activations.A complementary representation-level CKA term pushes obfuscated intermediate activations away from the plain representation.
  • 1) Loss of W1:: The W1 objective combines logit-level and representation-level signals to reduce decodability at two stages of the server-side model.The two signals respectively compare output distributions and intermediate activation geometry.
  • 1) Loss of W1:: W1’s loss couples privacy terms with a restoration objective so obfuscations remain difficult to decode but recoverable by W2.Without this coupling, W1 could produce transformations too difficult for W2 to map back to a trainable representation.
  • 1) Loss of W1:: The W2 coupling weight controls the privacy–utility balance: larger values favor recoverability, while smaller values permit stronger obfuscation at greater utility risk.This parameter determines how strongly W1 is biased toward obfuscations that W2 can restore.

2) Loss of W2:

W2 is trained to recover useful client-side representations from obfuscated server outputs, using reconstruction and output-distribution matching despite imperfect inversion.

  • 2) Loss of W2:: W2 combines smashed-data reconstruction with KL matching of client-tail logits to preserve trainability when exact activation recovery is unattainable.The logit-level term compensates for residual reconstruction error by matching the plain-path output distribution.
  • 2) Loss of W2:: Updating B would adapt it to W1-induced out-of-distribution inputs, while removing W1 at deployment would make those updates ineffective for the standard independently usable model.Accordingly, fine-tuning updates A and C alone.
  • 2) Loss of W2:: The protocol uses a non-private alignment dataset to train W1 and W2 before private fine-tuning, while keeping the main model parameters frozen during alignment.The alignment data need not match the private task, domain, or distribution.
  • 2) Loss of W2:: During private fine-tuning, clients update A and C through the full adapter path, keep B frozen, and aggregate client updates with FedAvg.The adapters remain local and are never uploaded to the server.

C 1: // Initial adapter alignment

The protocol alternates local adapter training with federated rounds, then periodically realigns the client adapters against updated model weights. After fine-tuning, the server retains a complete deployable model.

  • C 1: // Initial adapter alignment: Each selected client performs local training steps before uploading its client-side adapter parameters to the server.
  • C 1: // Initial adapter alignment: Clients generally maintain independent adapter pairs, although mutually trusted clients may share adapters when alignment-data policies permit.
  • C 1: // Initial adapter alignment: Periodic burst alignment retrains W1 and W2 on Dalign against current model weights to correct adapter misalignment across global rounds.
  • C 1: // Initial adapter alignment: After fine-tuning, the server holds the complete model f = fC ◦ fB ◦ fA, ready for deployment.

A. Trainability Analysis

The trainability analysis identifies how adapter Jacobians and recovery mismatch affect gradient deviations, then shows that straight-through estimation suppresses several deviation sources. The remaining error is controlled by recovered smashed-data mismatch under smoothness assumptions.

  • A. Trainability Analysis: The descent argument assumes Lipschitz-smooth Jacobians and bounded operator norms; without these conditions, gradient descent itself has no loss-decrease guarantee.
  • A. Trainability Analysis: The θA deviation contains four sources: nonidentity W1, nonidentity W2 partial Jacobians, nonzero second-input dependence, and upstream-gradient mismatch.
  • A. Trainability Analysis: The W2 deviation term vanishes whenever either W1 is identity-like or the relevant W2 partial Jacobian is suppressed.
  • A. Trainability Analysis: Under STE, sources (i)–(iii) of adapter-gradient deviation vanish, leaving only upstream-gradient and Jacobian-evaluation errors.
  • A. Trainability Analysis: ∥δgθC∥≤LC∥ŝB − sB∥, so θC gradient error is bounded by the recovery mismatch under the stated smoothness conditions.

B. Convergence Analysis

The convergence analysis extends FedAvg reasoning to non-i.i.d. clients by treating adapter-path updates as stochastic updates with deviations controlled by recovery error. Its guarantee requires standard FL assumptions plus bounded smashed-data mismatch.

  • B. Convergence Analysis: PrivPair introduces no convergence obstacle beyond the underlying FedAvg requirements within the idealized assumptions used by the analysis.
  • B. Convergence Analysis: The analysis assumes smooth local objectives, strong convexity, bounded stochastic-gradient variance and norm, and balanced random client sampling.
  • B. Convergence Analysis: The adapter-path update can be treated as a stochastic update whose deviation from the plain-path gradient is controlled by recovery error H.
  • B. Convergence Analysis: Joint training of θA and θC requires an additional bound HA on the expected squared difference between plain and obfuscated smashed data at the first cut point.

C. Comparison with Perturbation-Based Defenses

The comparison argues that perturbation-based defenses tie privacy strength to both smashed-data deviations and convergence degradation. PrivPair instead separates first-cut obfuscation from recovery error, allowing stronger privacy when recovery remains accurate.

  • C. Comparison with Perturbation-Based Defenses: In perturbation-based schemes, Hperturb is implicitly controlled by HA, coupling the two error terms through LB.
  • C. Comparison with Perturbation-Based Defenses: Larger perturbations strengthen privacy but directly worsen convergence-rate constants and reduce the descent margin.
  • C. Comparison with Perturbation-Based Defenses: PrivPair decouples HA from H, so larger first-cut deviation can be tolerated when W2 keeps recovery error H small.

A. Experimental Setup

The evaluation uses four instruction-tuned LLMs across three downstream datasets, comparing PrivPair with reconstruction defenses and training baselines under single-client and federated settings.

  • Models and Datasets: Four instruction-tuned LLMs spanning two model families and 3B–14B parameters are evaluated across three downstream datasets.The models are Llama-3.2-3B-Instruct, Llama-3.1-8B-Instruct, Ministral-3-8B-Instruct, and Ministral-3-14B-Instruct; datasets include Banking77, CLINC150, and MentalChat16K.
  • Federated Setting: The federated evaluation uses 64 clients divided into 8 groups that share local adapter pairs, while adapters remain undisclosed to the server.This setup emulates multiple client devices operating under a common adapter policy.
  • Defense Capability: Privacy is assessed using Direct Forward, TAG, LAMP, and BiSR reconstruction attacks, with mean ROUGE-1 as the primary leakage metric.All attacks are evaluated at the final checkpoint, while Direct Forward is also tracked during training.
  • Training Effectiveness: Training effectiveness is measured with classification accuracy on Banking77 and CLINC150 and ROUGE-1 on MentalChat16K against plain SL, full-model fine-tuning, baselines, and PrivPair.The comparison includes PrivPair in both single-client and federated settings.
  • Overhead and Testbed: Client overhead is evaluated through per-step computation time, memory footprint relative to plain SL, and end-to-end wall-clock training time.A physical testbed includes edge devices such as the NVIDIA Jetson Orin Nano as FL clients.

C. Defense Capability

PrivPair provides stronger reconstruction protection than the evaluated baselines while largely preserving training effectiveness, with limited client-side and training overhead.

  • PrivPair keeps Direct Forward, TAG, and LAMP reconstruction scores near zero, although BiSR remains the most difficult attack to suppress.It substantially outperforms baselines in most evaluated attack columns.
  • PrivPair achieves training effectiveness close to no-defense references across models and datasets, with federated results comparable to the single-client setting.The results indicate no clear degradation from client-specific adapters in the evaluated federated setup.
  • PrivPair simultaneously provides stronger privacy protection than every baseline and matches or exceeds their training effectiveness on most model-dataset combinations.Baselines approaching PrivPair’s privacy protection can instead collapse training utility.
  • PrivPair remains near zero throughout MentalChat16K fine-tuning, while perturbation-based defenses’ reconstruction quality rises as the decoder adapts.Figure 5 tracks sixteen-step moving-mean Direct Forward ROUGE-1 across the model suite.
  • The two client-side adapters require 144 MB on Jetson Orin Nano, about 5.4% of base memory, and increase measured client processing from 3.70 to 3.74 seconds.They add no additional communication overhead beyond alignment cost.
  • PrivPair’s main training loop is 5% to 10% slower than No Defense, excluding one-time initial alignment.This overhead is comparable to or smaller than that of NoPeek and Embedding ε-Privacy.

APPENDIX A HYPERPARAMETERS

The appendix specifies experiment settings, baseline operating-point selection, and privacy–utility comparisons, including fallback handling when NoPeek training collapses.

  • Hyperparameter settings: The experiments use model- and dataset-specific evaluation settings, including shorter generations for Banking77 and CLINC150 and longer generations for MentalChat16K.The evaluation sizes are 1,024 samples with up to 64 tokens for classification tasks, versus 256 samples with up to 256 tokens for MentalChat16K.
  • Baseline hyperparameter tuning: Baseline comparisons sweep hyperparameters broadly to avoid judging privacy–utility trade-offs from a single unfavorable setting.The procedure seeks a scanned point where each baseline is no better than PrivPair on both privacy protection and training effectiveness.
  • Baseline hyperparameter tuning: Operating points are selected from Direct Forward attack curves using onset, midpoint, and reach scales, with tables listing the resulting baseline values.The scan is performed on MentalChat16K separately for each model, and the appendix reports the resulting scales for the baseline defenses.
  • Baseline hyperparameter tuning: When a baseline’s scanned Direct Forward ROUGE-1 never reaches 0.01, its strongest scanned scale is used as the reach point.This caveat applies to some models and limits the interpretation of reach as an achieved threshold.
  • Baseline hyperparameter tuning: NoPeek can require such large midpoint and reach values that training collapses, so a lower scale is substituted when all scanned points fail.The appendix separately reports collapsed training and points worse than PrivPair in the unselected operating-point tables.
  • Privacy–utility comparison: The privacy–utility plot places final-checkpoint Direct Forward ROUGE-1 on a logarithmic horizontal axis and task utility vertically, with the top-left region preferred.Color identifies the defense method and marker shape identifies the model.
Loading 2609.09794v1…