{"id":"c9ebc892-29ab-4886-8646-0ad9cef4692f","arxiv_id":"2411.15831","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"PEFT methods (LoRA, Adapter) achieve lower membership-inference AUC than full fine-tuning, indicating reduced memorisation, but DP's protective effect is weaker for PEFT models.","lead":"This paper tests whether parameter-efficient fine-tuning methods like LoRA and Adapters leak less private training data than full fine-tuning, with and without differential privacy. It finds that PEFT models are more resistant to membership-inference attacks, but that DP noise reduces leakage less effectively for PEFT than for full fine-tuning.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The privacy-leakage gap is built on single-seed AUC differences that may be within sampling noise; no variance or repeated-seed evidence is reported.","rationale":"This is a clear, methodologically understandable empirical study with a plausible mechanism: PEFT restricts capacity and should memorize fewer outliers, consistent with existing work the authors cite (e.g., LoRA learns less and forgets less). The design—full MIA plus canary-based memorisation auditing, under both DP and non-DP—is sensible, and the paper honestly notes limitations and the (IA)3/DP incompatibility. However, the numbers that carry the central claim are small differences on an AUC scale very close to 0.5, and the paper reports no measure of uncertainty anywhere. The tiny canary set (30+30) makes the memorisation audit statistically weak; a gap of 0.07 is less than one standard error of that subset AUC. For full-data MIA, one seed per configuration is insufficient because stochastic training can produce AUC shifts on this scale. The parameter-variation argument is also only partially supported: Adapter's QNLI AUC rises from 0.58 to 0.71 with bottleneck size, which is not a 'limited increase,' though LoRA is stable. The authors' own limitations paragraph acknowledges narrow scope, but the abstract's 'significantly reducing privacy leakage' goes beyond what the current evidence can establish. I therefore agree with the reader's conditional verdict and would sharpen the required revision: quantify variance, add seeds, report confidence intervals, and perform a proper statistical test on the canary subset before the headline claim can stand.","tokens_in":12550,"tokens_out":9447,"duration_ms":89413,"concrete_test":"Run the non-DP IMDb experiments for DistilBERT, LoRA(r=8), and Adapter(bottleneck=32) with 10 random seeds and the paper's hyperparameters. For each run, compute the loss-based MIA AUC on the full train/test split and on the 60-point flipped-label canary subset. Report mean and 95% CI (or bootstrap intervals) and test the canary AUC with a Mann-Whitney U test. If the full-data DistilBERT-vs-LoRA gap is not consistently larger than 0.03 with non-overlapping intervals, or the canary AUC gap is not significant at p<0.05, then the central claim of 'significantly reducing privacy leakage' is not supported by the evidence. This directly targets the single-seed, no-variance basis of the headline finding.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim—that PEFT/LoRA reduces membership-inference AUC relative to standard fine-tuning—rests on numbers such as non-DP IMDb AUC 0.59 (DistilBERT) vs 0.52 (LoRA) and 0.53 (Adapter), with no error bars, seeds, or statistical tests anywhere in Section 4. For the canary experiment described in Section 3, only 30 training and 30 test points are label-flipped; if the reported AUC is computed on this 60-point subset, the standard error of AUC under the null is about 0.075 (sqrt(61/(12*30*30))). A gap of 0.07 is therefore less than one standard error. Even on the full-data MIA, a single run per configuration cannot rule out training stochasticity, data ordering, or hyperparameter choices as the source of the observed differences. Every downstream conclusion—reduced memorisation, robustness with more parameters, weaker DP interaction—is read off these small AUC differences. This is the load-bearing weak point: the headline privacy claim is plausible but not statistically supported by the evidence presented.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper empirically evaluates whether parameter-efficient fine-tuning (PEFT) methods—Adapters, LoRA, and (IA)^3—reduce memorisation and privacy leakage relative to standard fine-tuning, both with and without differentially private (DP) training. Using DistilBERT and BERT-base on IMDb and QNLI, the authors measure task accuracy, training cost, membership-inference AUC (loss-based black-box), and AUC/accuracy on a small set of intentionally mislabelled canary samples. They report that PEFT methods, especially LoRA, achieve competitive accuracy while substantially lowering MIA AUC in non-DP settings, that DP reduces leakage across all methods, and that increasing PEFT parameter counts does not erase the privacy advantage. The paper positions PEFT as a complementary privacy-preserving alternative to DP fine-tuning.","tokens_in":12753,"tokens_out":3419,"duration_ms":30418,"significance":"If the empirical findings hold, the paper makes a useful practical contribution: it provides evidence on a question of active interest—whether PEFT methods inherently reduce memorisation relative to full fine-tuning, and how they interact with DP-SGD. The study covers three PEFT variants, two datasets, multiple DP budgets, and a canary-based memorisation audit, which is a reasonable breadth for a first investigation. The central claims are falsifiable and the evaluation protocol is standard (accuracy, MIA AUC, training cost), so the results could inform deployment decisions for privacy-sensitive fine-tuning. However, the statistical support for the headline privacy claim is currently weak: all AUC comparisons are single-run point estimates with no error bars, and the canary subset is very small. The paper also overstates the performance parity of PEFT under DP, as Adapter on QNLI is 13 points below standard fine-tuning. These issues need to be addressed before the central claims can be accepted.","major_comments":[{"comment":"The central claim that PEFT methods reduce privacy leakage rests on AUC differences such as 0.52 (LoRA) and 0.53 (Adapter) versus 0.59 (DistilBERT) on non-DP IMDb. No error bars, confidence intervals, or multi-seed results are reported anywhere in Section 4, and no significance test is applied. Given that each configuration appears to be a single run, training stochasticity and hyperparameter sensitivity cannot be ruled out as the source of these differences. The canary experiment described in Section 3 uses only 30 flipped training and 30 flipped test points; for an AUC computed on that subset, the standard error under the null is roughly sqrt(61/(12*30*30)) ≈ 0.075, so a gap of 0.07 is within one standard error. Please report per-seed AUC values, confidence intervals or bootstrap estimates, and explicitly state whether the AUC in Figure 3 is computed on the full dataset or only the 60-point poisoned subset. Without this, the headline 'significantly reducing privacy leakage' is not statistically supported.","section":"Section 4, 'Privacy Leakage: Membership Inference' (Figure 2)"},{"comment":"The abstract and Section 4 claim that PEFT methods achieve 'comparable performance' to standard fine-tuning, but Table 4 shows Adapter under DP on QNLI at 63.6% versus DistilBERT at 76.4% (ε=4.0), and on IMDb at 73.8% versus 83.6% (ε=1.0). These are substantial accuracy gaps, not comparability. The claim 'PEFT methods matched or exceeded the accuracy of standard fine-tuning' is only true for LoRA in some settings and for non-DP IMDb. Please qualify the performance conclusion to name the configurations where PEFT is competitive and where it is not, and adjust the abstract accordingly if these gaps are not addressed.","section":"Section 4, Table 4 (Performance comparison)"},{"comment":"The canary experiment is a key piece of evidence for the memorisation claim, but the methodology is under-specified. Section 3 states that the authors 'conducted a loss-based MIA on the entire dataset and then focused on the AUC scores of this poisoned subset'—it is unclear whether the AUC is computed only on the 30 mislabelled training points versus 30 mislabelled test points, or on the full dataset with membership labels restricted to those 60 points. The text reports large differences (e.g., 'elevated AUC values' for DistilBERT) but gives no numeric values in the text and no variance estimate for the 30-point estimate. With such a small subset, the AUC estimate is highly unstable; the claim of 'significantly lower AUC scores' for PEFT cannot be evaluated. Please provide the exact computation, the numerical AUC values, and a confidence interval or a permutation test.","section":"Section 4, 'Privacy Leakage: Auditing using canaries' (Figures 3 and 4)"},{"comment":"The parameter-variation experiment is used to argue that PEFT robustness is not simply due to fewer parameters, but the evidence is presented as point estimates without variance. On QNLI, Adapter AUC rises from 0.58 to 0.71 as the bottleneck size increases, which is a substantial change; on IMDb the AUC 'fluctuates'—both patterns are difficult to interpret without confidence intervals. For LoRA, the text says 'minimal AUC variation' but no numerical threshold is given. This claim feeds directly into the Section 5 discussion about architectural placement, so it needs quantitative support. Please report the AUC values for each configuration, the number of seeds, and a statistical comparison (e.g., overlapping confidence intervals) before concluding that robustness is independent of parameter count.","section":"Section 4, 'PEFT Parameter Variation' (Figure 5)"}],"minor_comments":[{"comment":"Reference [1] is listed as 'Emergent abilities of large language models' but is cited in support of the EU AI Act; this appears to be a citation error.","section":"Section 1"},{"comment":"There are several typos, including 'excells' for 'excels' and 'adressing' for 'addressing'; Section 4 has 'umber' for 'number'.","section":"Section 2"},{"comment":"The DP implementation is described as 'implemented at a sample level' but the privacy accounting method is not specified; please state which accountant (e.g., Rényi DP) and whether Poisson sampling or another subsampling scheme was used to compute the reported ε values.","section":"Section 3"},{"comment":"Figure 2 and Figure 3 are heatmaps that are difficult to read in print; the exact AUC values should also be given in a table in the text.","section":"Section 4"},{"comment":"The reason (IA)^3 is excluded from DP experiments appears in Section 3, but Table 4's N/A entries are not explained there; a brief pointer in the table caption would help.","section":"Section 4"},{"comment":"The statement that 'DP-SGD can often act as a natural regulariser' is speculative and not tested; please either support it with the data or soften the language.","section":"Section 5"}],"recommendation":"major_revision","confidential_remarks":"The paper is a workshop-style empirical study; its contribution is timely but the statistical rigour is below the bar for a full archival publication. The main issues—lack of error bars and the overstatement of performance parity under DP—are fixable with additional experiments and revised claims. If the authors can provide multi-seed variance estimates and temper the 'comparable performance' wording, the paper could become a solid empirical note. Scope-wise, the paper fits a privacy-focused ML venue, but the current evidence does not yet support the strong conclusions in the abstract."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear [Colleague],\n\nQuick take: this is a useful, well-structured empirical comparison of PEFT methods under DP, with MIA and mislabelled canaries. The combination is new as far as I know, and the authors are honest about scope. But the central claim—that PEFT, especially LoRA, reduces privacy leakage—rests on AUC differences of 0.02–0.07 from single runs with no error bars or significance tests. That is the load-bearing weak point, and it needs attention before the result can be taken as established.\n\nWhat is actually new: prior DP-PEFT work (Yu et al.) looked at utility and efficiency, not privacy leakage. Biderman et al. studied LoRA forgetting but not under DP. This paper is the first systematic look at Adapter, LoRA, and (IA)3 under DP with both a full-data loss-based MIA and a canary audit. The parameter-scaling experiment is a nice touch—it addresses the obvious confound that fewer parameters alone explain the reduced memorisation. The result that LoRA stays robust as rank increases is interesting, and the weaker DP interaction for PEFT is a genuinely useful observation for anyone designing DP-PEFT strategies.\n\nThe soft spots are real but not disqualifying. No repeated seeds, no variance, no tests. The canary subset is tiny—30 flipped samples per split—and if the AUC is computed on that 60-point set, the standard error under the null is about 0.075. So a gap of 0.07 is less than one standard error. That said, the direction of the effect is consistent across two datasets and two metrics (AUC and training accuracy on flipped samples), which gives me some confidence it is not pure noise. Still, the abstract's 'significantly reducing privacy leakage' overstates the support. Also, 'comparable performance' in the abstract is contradicted by Adapter on QNLI under DP (63.6% vs 76.4%), which the authors do not discuss.\n\nThe limitations section is honest, and the paper does not make any claims that depend on circular reasoning. The citations to their own work are background, not load-bearing.\n\nWho is this for? Anyone working on private fine-tuning. It is a workshop-level paper that could become a solid conference paper with a re-run over multiple seeds and error bars. I would send it to peer review, but with the expectation of major revision.\n\nRecommendation: engage with it, but require the authors to report variance, ideally across at least three seeds, and to soften the claims accordingly.","headline":"Plausible and clearly written, but the headline privacy gains are built on single-seed AUC differences that may be sampling noise.","tokens_in":13320,"tokens_out":3048,"would_cite":true,"duration_ms":26248,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Parameter-efficient fine-tuning with LoRA and adapters reduces membership-inference leakage and memorisation of mislabelled data compared with full-parameter fine-tuning, while matching task accuracy.","keywords":["differential privacy","parameter-efficient fine-tuning","LoRA","adapters","membership inference attacks","memorisation","data poisoning","canary insertion"],"falsifier":"Run the same IMDb and QNLI protocol across at least five random seeds and compare per-seed distributions of membership-inference AUC: if the LoRA and Adapter values around 0.52 and 0.53 overlap with DistilBERT's 0.59, the claimed privacy advantage is not supported. Separately, replace the mislabelled canaries with correctly labelled rare sensitive strings; if PEFT models extract those as readily as full fine-tuning, the reduced-memorisation claim would be an artefact of the poisoning setup rather than a general property.","tokens_in":12329,"feed_emoji":"🔒","tokens_out":8261,"duration_ms":70573,"temperature":0.7,"pith_summary":"This paper sets out to show that parameter-efficient fine-tuning (PEFT) methods such as LoRA, adapters, and (IA)3 are not only cheaper than full-model fine-tuning but also harder to attack through membership inference. On IMDb and QNLI, the authors report that PEFT models match or exceed the accuracy of a fully fine-tuned DistilBERT while achieving lower membership-inference AUC, meaning an attacker is less able to tell which examples were in the training set. In a poisoning experiment where 30 training examples were deliberately mislabelled as canaries, PEFT models stayed far closer to chance on those flipped labels, while standard fine-tuning's accuracy on the poisoned subset rose to around 0.45 to 0.60. The paper also argues that this privacy advantage is not just a side effect of having fewer parameters, because increasing LoRA's rank from 8 to 480 barely changes its attack AUC. The practical point is that PEFT can serve as a lightweight privacy mitigation on its own, and as a complement to differential privacy when formal guarantees are required.","feed_headline":"LoRA and adapters leak less training data than full fine-tuning","feed_subtitle":"On IMDb and QNLI, PEFT models match accuracy while scoring lower on membership-inference and canary memorisation tests.","key_machinery":"The load-bearing object is the loss-based membership inference attack, scored with AUC: a model that has memorised a training point assigns it unusually low loss, so the AUC measures how cleanly an attacker can separate training from non-training examples. The second mechanism is the canary test, where 30 examples from each of the training and test sets are mislabelled to create atypical feature-label pairs that a high-capacity model tends to memorise; high accuracy or high AUC on that poisoned subset is read as evidence of memorisation. The third piece is the parameter-scaling design, which varies Adapter bottleneck sizes from 32 to 512 and LoRA ranks from 8 to 480 to test whether any privacy advantage can be explained away by parameter count.","core_discovery":"The central claim, stated on the paper's own terms, is that PEFT methods memorise less of the fine-tuning data than standard full-parameter fine-tuning, and that this reduced memorisation is directly visible in two measurements: lower loss-based membership-inference AUC and lower accuracy on deliberately mislabelled canary examples. On IMDb without DP, DistilBERT's attack AUC is 0.59, while LoRA and Adapter sit at 0.52 and 0.53; on the poisoned subset, fully fine-tuned DistilBERT's training accuracy climbs from 0.20 to over 0.45 across epochs, while LoRA and Adapter stay low. Under DP, all methods show less leakage, but PEFT methods show smaller absolute reductions than standard fine-tuning, so at epsilon 8 LoRA and Adapter can end up slightly above DistilBERT; the paper interprets this as DP noise being concentrated on a smaller parameter set. Scaling experiments show that larger Adapter bottlenecks can raise AUC on QNLI from 0.58 to 0.71, whereas larger LoRA ranks leave AUC nearly flat, leading the authors to conclude that PEFT's privacy behaviour depends on where and how the adaptation modules are placed, not merely on their parameter count.","pith_inferences":["The paper reports single runs without error bars or repeated-seed variance; until the 0.59 versus 0.52 AUC gap is shown to exceed run-to-run noise, the ranking should be treated as directional, and multi-seed repetition is the natural next check.","The canary test uses mislabelled examples; an extension the authors do not run would insert correctly labelled rare strings such as IDs or email addresses and ask whether PEFT still memorises less, which is closer to real data-extraction risk.","The architecture-placement hypothesis is testable: fix LoRA's rank and attach it to query, key, value, or output projections separately, then measure whether membership-inference AUC shifts, isolating where memorisation happens.","All experiments use BERT-style encoders; the transfer to decoder-only generative models is untested, and the memorisation economics of generation could differ."],"forward_implications":["If the result holds, privacy-conscious teams can adopt LoRA or adapters as a cheap first defence against membership inference, without paying the memory and training-time costs of DP-SGD.","The accuracy results imply that PEFT under DP is not a utility sacrifice: LoRA at epsilon 4.0 reaches 85.3 percent on IMDb, above DistilBERT's 84.3 percent and BERT-base's 81.1 percent.","Because larger LoRA ranks did not raise leakage, deployers can scale LoRA capacity without obviously trading away the memorisation advantage, at least within the studied range.","The weaker DP effect on PEFT suggests that privacy accounting and noise schedules designed for full fine-tuning may not transfer directly; applying DP to PEFT needs its own recipe.","The canary results imply that PEFT models are less likely to lock in atypical label associations, which matters for datasets where rare or sensitive examples are exactly the ones an attacker targets."],"supporting_citations":[{"why":"Provides DP-SGD, the mechanism used for all differentially private fine-tuning in the paper.","marker":"[8]"},{"why":"Established that PEFT can be combined with DP for efficiency but left privacy unmeasured, the gap this paper addresses.","marker":"[12]"},{"why":"Supplies the prior observation that LoRA learns less and forgets less, which the paper extends to privacy.","marker":"[17]"},{"why":"Defines Adapters, one of the three PEFT methods evaluated.","marker":"[21]"},{"why":"Defines LoRA, the central PEFT method whose rank is varied.","marker":"[22]"},{"why":"Defines (IA)3, the third PEFT method used in the non-DP experiments.","marker":"[23]"},{"why":"Introduced membership inference attacks, the threat model being measured.","marker":"[31]"},{"why":"Introduces canary insertion, the basis for the mislabelled memorisation experiment.","marker":"[41]"},{"why":"Provides the loss-based membership inference attack whose AUC is the paper's privacy metric.","marker":"[42]"}],"fun_headline_variants":["PEFT: less memorisation, same accuracy in fine-tuning","LoRA and adapters leak less than full fine-tuning","Adapters match accuracy while reducing training data leakage","DP fine-tuning: PEFT cuts privacy risk with fewer params","Parameter-efficient fine-tuning reduces memorisation without loss"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that a score measuring how easily a model's per-example losses reveal training set membership, computed on a set of only 30 deliberately mislabelled examples, is a reliable and statistically meaningful proxy for privacy leakage, since the central comparison rests on small AUC differences reported without error bars or repeated-seed variance.","fun_headline_variants_meta":{"raw":{"variants":["PEFT: less memorisation, same accuracy in fine-tuning","LoRA and adapters leak less than full fine-tuning","Adapters match accuracy while reducing training data leakage","DP fine-tuning: PEFT cuts privacy risk with fewer params","Parameter-efficient fine-tuning reduces memorisation without loss"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000352,"raw_usage":{"total_tokens":1931,"prompt_tokens":970,"completion_tokens":961,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":586,"completion_tokens_details":{"reasoning_tokens":882}},"tokens_in":586,"tokens_out":961,"duration_ms":9123,"temperature":1.0,"reasoning_tokens":882,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:52:40.024933+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same IMDb and QNLI protocol across at least five random seeds and compare per-seed distributions of membership-inference AUC: if the LoRA and Adapter values around 0.52 and 0.53 overlap with DistilBERT's 0.59, the claimed privacy advantage is not supported. Separately, replace the mislabelled canaries with correctly labelled rare sensitive strings; if PEFT models extract those as readily as full fine-tuning, the reduced-memorisation claim would be an artefact of the poisoning setup rather than a general property.","supporting_citations":[{"cited_title":"Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning","cited_arxiv_id":null,"evidence_quote":"Defines (IA)3, the third PEFT method used in the non-DP experiments."},{"cited_title":"Membership inference attacks against machine learning models","cited_arxiv_id":null,"evidence_quote":"Introduced membership inference attacks, the threat model being measured."},{"cited_title":"Evaluating differentially private machine learning in practice","cited_arxiv_id":null,"evidence_quote":"Provides the loss-based membership inference attack whose AUC is the paper's privacy metric."},{"cited_title":"Deep learning with differential privacy","cited_arxiv_id":null,"evidence_quote":"Provides DP-SGD, the mechanism used for all differentially private fine-tuning in the paper."},{"cited_title":"Differentially private fine-tuning of language models","cited_arxiv_id":null,"evidence_quote":"Established that PEFT can be combined with DP for efficiency but left privacy unmeasured, the gap this paper addresses."},{"cited_title":"Lora learns less and forgets less","cited_arxiv_id":null,"evidence_quote":"Supplies the prior observation that LoRA learns less and forgets less, which the paper extends to privacy."},{"cited_title":"Parameter-efficient transfer learning for nlp","cited_arxiv_id":null,"evidence_quote":"Defines Adapters, one of the three PEFT methods evaluated."}],"review_version":1}