Pith. sign in

REVIEW 4 major objections 6 minor 52 references

Efficient and Private: Memorisation under differentially private parameter-efficient fine-tuning in language models

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Parameter-efficient fine-tuning with LoRA and adapters reduces membership-inference leakage and memorisation of mislabelled data compared with full-parameter fine-tuning, while matching task accuracy.

desk verdict Plausible and clearly written, but the headline privacy gains are built on single-seed AUC differences that may be sampling noise. read the letter →

arxiv 2411.15831 v1 pith:MWSCWHWQ submitted 2024-11-24 cs.LG cs.AI

Olivia Ma , Jonathan Passerat-Palmbach , Dmitrii Usynin This is my paper · ORCID
classification cs.LGcs.AI
keywords differentialprivacyparameter-efficientfine-tuningLoRAadaptersmembershipinferenceattacksmemorisationdatapoisoningcanaryinsertion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that parameter-efficient fine-tuning (PEFT) methods such as LoRA, adapters, and (IA)3 are not only cheaper than full-model fine-tuning but also harder to attack through membership inference. On IMDb and QNLI, the authors report that PEFT models match or exceed the accuracy of a fully fine-tuned DistilBERT while achieving lower membership-inference AUC, meaning an attacker is less able to tell which examples were in the training set. In a poisoning experiment where 30 training examples were deliberately mislabelled as canaries, PEFT models stayed far closer to chance on those flipped labels, while standard fine-tuning's accuracy on the poisoned subset rose to around 0.45 to 0.60. The paper also argues that this privacy advantage is not just a side effect of having fewer parameters, because increasing LoRA's rank from 8 to 480 barely changes its attack AUC. The practical point is that PEFT can serve as a lightweight privacy mitigation on its own, and as a complement to differential privacy when formal guarantees are required.

What carries the argument

The load-bearing object is the loss-based membership inference attack, scored with AUC: a model that has memorised a training point assigns it unusually low loss, so the AUC measures how cleanly an attacker can separate training from non-training examples. The second mechanism is the canary test, where 30 examples from each of the training and test sets are mislabelled to create atypical feature-label pairs that a high-capacity model tends to memorise; high accuracy or high AUC on that poisoned subset is read as evidence of memorisation. The third piece is the parameter-scaling design, which varies Adapter bottleneck sizes from 32 to 512 and LoRA ranks from 8 to 480 to test whether any privacy advantage can be explained away by parameter count.

What would settle it

Run the same IMDb and QNLI protocol across at least five random seeds and compare per-seed distributions of membership-inference AUC: if the LoRA and Adapter values around 0.52 and 0.53 overlap with DistilBERT's 0.59, the claimed privacy advantage is not supported. Separately, replace the mislabelled canaries with correctly labelled rare sensitive strings; if PEFT models extract those as readily as full fine-tuning, the reduced-memorisation claim would be an artefact of the poisoning setup rather than a general property.

Watch

Extended reading notes

Core claim

The central claim, stated on the paper's own terms, is that PEFT methods memorise less of the fine-tuning data than standard full-parameter fine-tuning, and that this reduced memorisation is directly visible in two measurements: lower loss-based membership-inference AUC and lower accuracy on deliberately mislabelled canary examples. On IMDb without DP, DistilBERT's attack AUC is 0.59, while LoRA and Adapter sit at 0.52 and 0.53; on the poisoned subset, fully fine-tuned DistilBERT's training accuracy climbs from 0.20 to over 0.45 across epochs, while LoRA and Adapter stay low. Under DP, all methods show less leakage, but PEFT methods show smaller absolute reductions than standard fine-tuning, so at epsilon 8 LoRA and Adapter can end up slightly above DistilBERT; the paper interprets this as DP noise being concentrated on a smaller parameter set. Scaling experiments show that larger Adapter bottlenecks can raise AUC on QNLI from 0.58 to 0.71, whereas larger LoRA ranks leave AUC nearly flat, leading the authors to conclude that PEFT's privacy behaviour depends on where and how the adaptation modules are placed, not merely on their parameter count.

Load-bearing premise

The load-bearing assumption is that a score measuring how easily a model's per-example losses reveal training set membership, computed on a set of only 30 deliberately mislabelled examples, is a reliable and statistically meaningful proxy for privacy leakage, since the central comparison rests on small AUC differences reported without error bars or repeated-seed variance.

Editorial extensions

If this is right

  • If the result holds, privacy-conscious teams can adopt LoRA or adapters as a cheap first defence against membership inference, without paying the memory and training-time costs of DP-SGD.
  • The accuracy results imply that PEFT under DP is not a utility sacrifice: LoRA at epsilon 4.0 reaches 85.3 percent on IMDb, above DistilBERT's 84.3 percent and BERT-base's 81.1 percent.
  • Because larger LoRA ranks did not raise leakage, deployers can scale LoRA capacity without obviously trading away the memorisation advantage, at least within the studied range.
  • The weaker DP effect on PEFT suggests that privacy accounting and noise schedules designed for full fine-tuning may not transfer directly; applying DP to PEFT needs its own recipe.
  • The canary results imply that PEFT models are less likely to lock in atypical label associations, which matters for datasets where rare or sensitive examples are exactly the ones an attacker targets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper reports single runs without error bars or repeated-seed variance; until the 0.59 versus 0.52 AUC gap is shown to exceed run-to-run noise, the ranking should be treated as directional, and multi-seed repetition is the natural next check.
  • The canary test uses mislabelled examples; an extension the authors do not run would insert correctly labelled rare strings such as IDs or email addresses and ask whether PEFT still memorises less, which is closer to real data-extraction risk.
  • The architecture-placement hypothesis is testable: fix LoRA's rank and attach it to query, key, value, or output projections separately, then measure whether membership-inference AUC shifts, isolating where memorisation happens.
  • All experiments use BERT-style encoders; the transfer to decoder-only generative models is untested, and the memorisation economics of generation could differ.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper empirically evaluates whether parameter-efficient fine-tuning (PEFT) methods—Adapters, LoRA, and (IA)^3—reduce memorisation and privacy leakage relative to standard fine-tuning, both with and without differentially private (DP) training. Using DistilBERT and BERT-base on IMDb and QNLI, the authors measure task accuracy, training cost, membership-inference AUC (loss-based black-box), and AUC/accuracy on a small set of intentionally mislabelled canary samples. They report that PEFT methods, especially LoRA, achieve competitive accuracy while substantially lowering MIA AUC in non-DP settings, that DP reduces leakage across all methods, and that increasing PEFT parameter counts does not erase the privacy advantage. The paper positions PEFT as a complementary privacy-preserving alternative to DP fine-tuning.

Significance. If the empirical findings hold, the paper makes a useful practical contribution: it provides evidence on a question of active interest—whether PEFT methods inherently reduce memorisation relative to full fine-tuning, and how they interact with DP-SGD. The study covers three PEFT variants, two datasets, multiple DP budgets, and a canary-based memorisation audit, which is a reasonable breadth for a first investigation. The central claims are falsifiable and the evaluation protocol is standard (accuracy, MIA AUC, training cost), so the results could inform deployment decisions for privacy-sensitive fine-tuning. However, the statistical support for the headline privacy claim is currently weak: all AUC comparisons are single-run point estimates with no error bars, and the canary subset is very small. The paper also overstates the performance parity of PEFT under DP, as Adapter on QNLI is 13 points below standard fine-tuning. These issues need to be addressed before the central claims can be accepted.

major comments (4)
  1. [Section 4, 'Privacy Leakage: Membership Inference' (Figure 2)] The central claim that PEFT methods reduce privacy leakage rests on AUC differences such as 0.52 (LoRA) and 0.53 (Adapter) versus 0.59 (DistilBERT) on non-DP IMDb. No error bars, confidence intervals, or multi-seed results are reported anywhere in Section 4, and no significance test is applied. Given that each configuration appears to be a single run, training stochasticity and hyperparameter sensitivity cannot be ruled out as the source of these differences. The canary experiment described in Section 3 uses only 30 flipped training and 30 flipped test points; for an AUC computed on that subset, the standard error under the null is roughly sqrt(61/(12*30*30)) ≈ 0.075, so a gap of 0.07 is within one standard error. Please report per-seed AUC values, confidence intervals or bootstrap estimates, and explicitly state whether the AUC in Figure 3 is computed on the full dataset or only the 60-point poisoned subset. Without this, the headline 'significantly reducing privacy leakage' is not statistically supported.
  2. [Section 4, Table 4 (Performance comparison)] The abstract and Section 4 claim that PEFT methods achieve 'comparable performance' to standard fine-tuning, but Table 4 shows Adapter under DP on QNLI at 63.6% versus DistilBERT at 76.4% (ε=4.0), and on IMDb at 73.8% versus 83.6% (ε=1.0). These are substantial accuracy gaps, not comparability. The claim 'PEFT methods matched or exceeded the accuracy of standard fine-tuning' is only true for LoRA in some settings and for non-DP IMDb. Please qualify the performance conclusion to name the configurations where PEFT is competitive and where it is not, and adjust the abstract accordingly if these gaps are not addressed.
  3. [Section 4, 'Privacy Leakage: Auditing using canaries' (Figures 3 and 4)] The canary experiment is a key piece of evidence for the memorisation claim, but the methodology is under-specified. Section 3 states that the authors 'conducted a loss-based MIA on the entire dataset and then focused on the AUC scores of this poisoned subset'—it is unclear whether the AUC is computed only on the 30 mislabelled training points versus 30 mislabelled test points, or on the full dataset with membership labels restricted to those 60 points. The text reports large differences (e.g., 'elevated AUC values' for DistilBERT) but gives no numeric values in the text and no variance estimate for the 30-point estimate. With such a small subset, the AUC estimate is highly unstable; the claim of 'significantly lower AUC scores' for PEFT cannot be evaluated. Please provide the exact computation, the numerical AUC values, and a confidence interval or a permutation test.
  4. [Section 4, 'PEFT Parameter Variation' (Figure 5)] The parameter-variation experiment is used to argue that PEFT robustness is not simply due to fewer parameters, but the evidence is presented as point estimates without variance. On QNLI, Adapter AUC rises from 0.58 to 0.71 as the bottleneck size increases, which is a substantial change; on IMDb the AUC 'fluctuates'—both patterns are difficult to interpret without confidence intervals. For LoRA, the text says 'minimal AUC variation' but no numerical threshold is given. This claim feeds directly into the Section 5 discussion about architectural placement, so it needs quantitative support. Please report the AUC values for each configuration, the number of seeds, and a statistical comparison (e.g., overlapping confidence intervals) before concluding that robustness is independent of parameter count.
minor comments (6)
  1. [Section 1] Reference [1] is listed as 'Emergent abilities of large language models' but is cited in support of the EU AI Act; this appears to be a citation error.
  2. [Section 2] There are several typos, including 'excells' for 'excels' and 'adressing' for 'addressing'; Section 4 has 'umber' for 'number'.
  3. [Section 3] The DP implementation is described as 'implemented at a sample level' but the privacy accounting method is not specified; please state which accountant (e.g., Rényi DP) and whether Poisson sampling or another subsampling scheme was used to compute the reported ε values.
  4. [Section 4] Figure 2 and Figure 3 are heatmaps that are difficult to read in print; the exact AUC values should also be given in a table in the text.
  5. [Section 4] The reason (IA)^3 is excluded from DP experiments appears in Section 3, but Table 4's N/A entries are not explained there; a brief pointer in the table caption would help.
  6. [Section 5] The statement that 'DP-SGD can often act as a natural regulariser' is speculative and not tested; please either support it with the data or soften the language.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's privacy-leakage claims are empirical measurements (MIA AUC and canary accuracy), not outputs derived from fitted parameters or self-citations; the cited self-work is background and future-direction material only.

full rationale

This paper is an empirical evaluation, not a formal derivation. The central claims—that PEFT methods such as LoRA and Adapter exhibit lower membership-inference AUC and lower memorisation of mislabelled canary samples than standard fine-tuning—are read directly from measured training outcomes (Figures 2-5, Tables 4-5). No equation in the paper defines the conclusion in terms of the inputs, and no fitted parameter is later renamed as a prediction. The canary experiment is an operationalisation of memorisation: the paper intentionally mislabels 30 training and 30 test instances and then measures the model's loss-based AUC and accuracy on that subset. This is a measurement protocol, not a circular definition, because the reported values are empirical outputs that could have come out differently. The self-citations by the authors, [35] and [50], are cited for background on white-box membership inference and as a suggested direction for future architectural adaptation research; neither is load-bearing for the empirical privacy-leakage comparisons. There is no imported uniqueness theorem, no ansatz smuggled in via citation, and no renaming of a known result as a new contribution. The strongest legitimate concern is statistical robustness: the reported AUC differences are small and the paper gives no confidence intervals, multiple seeds, or significance tests. That concern, however, concerns the evidentiary weight of the measurements and belongs under correctness risk, not circularity. No load-bearing step reduces to its own inputs, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new theoretical constructs or entities are introduced. The ledger lists hand-chosen experimental hyperparameters (learning rates, canary count, DP clipping norm/delta) and domain assumptions about the validity of MIA AUC and canary-based memorisation audits.

free parameters (3)
  • Per-method learning rates (DP and non-DP) = Non-DP: Adapter 5e-4, LoRA 5e-4, (IA)3 7e-3; DP: Adapter 1e-3, LoRA 8e-4
    Learning rates differ between PEFT methods and between DP/non-DP settings (Table 2). They are hand-chosen, not fitted, but can affect the utility and memorisation comparison.
  • Number of mislabelled canary samples per split = 30
    The paper selects 30 training and 30 test samples with flipped labels (Section 3). This small, arbitrary number is used as the basis for the canary AUC and memorisation claim.
  • DP clipping norm C and delta = C=1.5, delta=10^-5
    Standard DP hyperparameters chosen by hand across all DP experiments (Section 3).
assumptions (4)
  • standard math DP-SGD as implemented in Opacus/dp-transformers provides the stated (epsilon, delta)-DP guarantee.
    The paper relies on the correctness of the DP accountant and DP-SGD implementation for its privacy guarantees (Section 3).
  • domain assumption Loss-based membership inference AUC is a valid proxy for privacy leakage and memorisation.
    The paper uses a black-box loss-based MIA and treats AUC as the primary privacy metric (Section 3, [42]).
  • domain assumption Mislabelled canary samples represent worst-case memorisation.
    The paper creates canaries by flipping labels of atypical samples (Section 3), assuming these are more prone to memorisation.
  • domain assumption Results on BERT-family encoder models generalize to other LLM architectures.
    Experiments use DistilBERT and BERT-base only, while conclusions are stated generally for LLMs (Section 5 Limitations).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient and Private: Memorisation under differentially private parameter-efficient fine-tuning in language models." pith.science (2026). https://pith.science/paper/MWSCWHWQ

@misc{pith2026241115831,
  author       = {Pith},
  title        = {Pith review of: Efficient and Private: Memorisation under differentially private parameter-efficient fine-tuning in language models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MWSCWHWQ}},
  note         = {Machine review of arXiv:2411.15831}
}
read the original abstract

Fine-tuning large language models (LLMs) for specific tasks introduces privacy risks, as models may inadvertently memorise and leak sensitive training data. While Differential Privacy (DP) offers a solution to mitigate these risks, it introduces significant computational and performance trade-offs, particularly with standard fine-tuning approaches. Previous work has primarily focused on full-parameter updates, which are computationally intensive and may not fully leverage DPs potential in large models. In this work, we address these shortcomings by investigating Parameter-Efficient Fine-Tuning (PEFT) methods under DP constraints. We show that PEFT methods achieve comparable performance to standard fine-tuning while requiring fewer parameters and significantly reducing privacy leakage. Furthermore, we incorporate a data poisoning experiment involving intentional mislabelling to assess model memorisation and directly measure privacy risks. Our findings indicate that PEFT methods not only provide a promising alternative but also serve as a complementary approach for privacy-preserving, resource-efficient fine-tuning of LLMs.

Figures

Figures reproduced from arXiv: 2411.15831 by the authors.

Figure 1
Figure 1. An overview of our method. Firstly, the pre-trained models are initialised, followed by the application of either PEFT methods or standard fine-tuning techniques. Secondly, the models are fine-tuned with/out DP. The final phase includes multiple evaluations: the poisoning attack to quantify memorisation, the parameter variation experiment to assess PEFT scalability, and performance assessment, covering accuracy, mem… view at source ↗
Figure 2
Figure 2. AUC heatmaps for IMDb and QNLI datasets. These show the AUC values (last epoch) for different models and PEFT methods under non-DP and DP settings (ε = 1.0, 4.0, 8.0). The left heatmap corresponds to the IMDb dataset, while the right heatmap corresponds to QNLI. Darker shades represent higher AUC values, indicating greater privacy leakage and lighter shades represent lower AUC values, suggesting reduced memorisation… view at source ↗
Figure 3
Figure 3. Memorisation of IMDB and QNLI datasets. These heatmaps show AUC values (last epoch) for different models and PEFT methods under non-DP and DP settings on IMDb (left) and QNLI (right) datasets. Data poisoning experiments were used to assess memorisation risks, where higher AUC values indicate greater memorisation of mislabelled data. Darker shades represent higher memorisation. We also tracked training accuracy on th… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Training accuracy on the flipped subsets for IMDb and QNLI. This figure plots the training accuracy over epochs on poisoned subsets of the IMDb (left) and QNLI (right) datasets, comparing DistilBERT, Adapter, LoRA, and (IA)3 , highlights the model’s tendency to memoris…
Figure 5
Figure 5. Figure 5: AUC results with increasing parameter count on IMDB and QNLI. The Adapter plot (left) shows AUC scores with varying bottleneck sizes, which control the intermediate feature size within Adapter layers, inserted into FF layers. The LoRA plot (right) shows AUC scores acro…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 35 canonical work pages

  1. [1]

    Chi, Tatsunori Hashimoto, Oriol Vinyals, Percy Liang, Jeff Dean, and William Fedus

    Jason Wei, Yi Tay, Rishi Bommasani, Colin Raffel, Barret Zoph, Sebastian Borgeaud, Dani Yogatama, Maarten Bosma, Denny Zhou, Donald Metzler, Ed H. Chi, Tatsunori Hashimoto, Oriol Vinyals, Percy Liang, Jeff Dean, and William Fedus. Emergent abilities of large language models. Transactions on Machine Learning Research,

    work page

  2. [2]

    European Commission. Proposal for a regulation of the european parliament and of the coun- cil laying down harmonised rules on artificial intelligence (artificial intelligence act) and amend- ing certain union legislative acts. https://eur-lex.europa.eu/resource.html?uri=cellar: e0649735-a372-11eb-9585-01aa75ed71a1.0001.02/DOC_1&format=PDF ; https://eur-l...

    work page 2021

  3. [3]

    Hadi Amini, and Yanzhao Wu

    Badhan Chandra Das, M. Hadi Amini, and Yanzhao Wu. Security and privacy challenges of large language models: A survey. arXiv preprint arXiv:2402.00888, 2024. Available at https://arxiv.org/abs/2402.00888

    arXiv 2024

  4. [4]

    Auditing Data Provenance in Text-Generation Models

    Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. arXiv preprint arXiv:1811.00513, 2019

    work page Pith review arXiv 2019

  5. [5]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21) , pages 2633–2650. USENIX Association, aug 2021

    work page 2021

  6. [6]

    Quantifying privacy risks of masked language models using membership inference attacks

    Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors, Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 8332–8347, Abu ...

    work page 2022

  7. [7]

    Exploring memorization in fine-tuned language models

    Shenglai Zeng, Yaxin Li, Jie Ren, Yiding Liu, Han Xu, Pengfei He, Yue Xing, Shuaiqiang Wang, Jiliang Tang, and Dawei Yin. Exploring memorization in fine-tuned language models. arXiv preprint arXiv:2310.06714, 2023

    arXiv 2023

  8. [8]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318. ACM, 2016

    work page 2016

Show all 52 references
  1. [9]

    The Algorithmic F oundations of Differential Privacy

    Cynthia Dwork and Aaron Roth. The Algorithmic F oundations of Differential Privacy. Now Publishers Inc., Hanover, MA, USA, 2014. Available at https://www.cis.upenn.edu/~aaroth/Papers/privacybook. pdf

    2014

  2. [10]

    Training text-to-text transformers with privacy guarantees

    Natalia Ponomareva, Jasmijn Bastings, and Sergei Vassilvitskii. Training text-to-text transformers with privacy guarantees. In Findings of the Association for Computational Linguistics: ACL 2022 , pages 2182–2193, 2022

    2022

  3. [11]

    Differential privacy has disparate impact on model accuracy

    Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy. Advances in neural information processing systems , 32, 2019

    2019

  4. [12]

    Differentially private fine-tuning of language models

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. In International Conference on Learning Representations (ICLR) , 2022

    2022

  5. [13]

    Differentially private bias-term only fine-tuning of foundation models

    Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Differentially private bias-term only fine-tuning of foundation models. arXiv preprint arXiv:2210.00036, 2022

    2022 arXiv

  6. [14]

    Hashimoto

    Xuechen Li, Florian Tramèr, Percy Liang, and Tatsunori B. Hashimoto. Large language models can be strong differentially private learners. arXiv preprint arXiv:2110.05679, 2021. 10 The 6th AAAI Workshop on Privacy-Preserving Artificial Intelligence PPAI-25

    2021 arXiv

  7. [15]

    Parameter-efficient fine-tuning for large models: A comprehensive survey

    Zeyu Han, Chao Gao, Jinyang Liu, Jeff Zhang, and Sai Qian Zhang. Parameter-efficient fine-tuning for large models: A comprehensive survey. arXiv preprint arXiv:2403.14608, 2024. 25 pages, 12 figures

    2024 arXiv

  8. [16]

    Parameter efficient fine tuning: A comprehensive analysis across applications, April 2024

    Charith Chandra, Sai Balne, Sreyoshi Bhaduri, Tamoghna Roy, Vinija Jain, and Aman Chadha. Parameter efficient fine tuning: A comprehensive analysis across applications, April 2024. ResearchGate preprint

    2024

  9. [17]

    Lora learns less and forgets less

    Dan Biderman, Jose Ortiz, Jacob Portes, Mansheej Paul, Philip Greengard, Connor Jennings, Daniel King, Sam Havens, Vitaliy Chiley, Jonathan Frankle, Cody Blakeney, and John Cunningham. Lora learns less and forgets less. ArXiv, May 2024

    2024

  10. [18]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography, Third Theory of Cryptography Conference, TCC 2006 , volume 3876 of Lecture Notes in Computer Science , pages 265–284. Springer, 2006

    2006

  11. [19]

    Tianqing Zhu, Gang Li, Wanlei Zhou, and Philip S. Yu. Differentially private deep learning. In Differential Privacy and Applications, volume 69 of Advances in Information Security , pages 67–82. Springer, 2017. First Online: 23 August 2017

    2017

  12. [20]

    Opacus: User-friendly differential privacy library in pytorch

    Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Karthik Prasad, Mani Malek Esmaeili, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in pytorch. In NeurIPS, 2021

    2021

  13. [21]

    Parameter-efficient transfer learning for nlp

    Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin de Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter-efficient transfer learning for nlp. In International Conference on Machine Learning, pages 2790–2799. PMLR, 2019

    2019

  14. [22]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Zhize Li, Lei Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Zhize Li, Lei Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  15. [23]

    Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning

    Haokun Liu, Derek Tam, Muqeeth Mohammed, Jay Mohta, Tenghao Huang, Mohit Bansal, and Colin Raffel. Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning. In Advances in Neural Information Processing Systems, 2022

    2022

  16. [24]

    G-adapter: Towards structure-aware parameter-efficient transfer learning for graph transformer networks

    Anchun Gui, Jinqiang Ye, and Han Xiao. G-adapter: Towards structure-aware parameter-efficient transfer learning for graph transformer networks. ArXiv, abs/2305.10329, 2023

    2023 arXiv

  17. [25]

    Narayanan

    Tiantian Feng and Shrikanth S. Narayanan. Peft-ser: On the use of parameter efficient transfer learning approaches for speech emotion recognition using pre-trained speech models. ArXiv, abs/2306.05350, 2023

    2023 arXiv

  18. [26]

    Adamix: Mixture-of- adaptations for parameter-efficient model tuning

    Yaqing Wang, Subhabrata Mukherjee, Xiaodong Liu, Jing Gao, and Jianfeng Gao. Adamix: Mixture-of- adaptations for parameter-efficient model tuning. ArXiv, abs/2210.17451, 2022

    2022 arXiv

  19. [27]

    Pruning meets low-rank parameter-efficient fine-tuning

    Mingyang Zhang, Hao Chen, Chunhua Shen, Zhen Yang, Linlin Ou, Xinyi Yu, and Bohan Zhuang. Pruning meets low-rank parameter-efficient fine-tuning. ArXiv, abs/2305.18403, 2023

    2023 arXiv

  20. [28]

    Minxin Du, Xiang Yue, Sherman S. M. Chow, Tianhao Wang, Chenyu Huang, and Huan Sun. Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS...

    2023

  21. [29]

    Sasi Kumar Murakonda and R. Shokri. Ml privacy meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning. arXiv preprint arXiv:2007.09339, 2020

    2007 arXiv

  22. [30]

    Introducing a new privacy testing library in tensorflow, 2020

    Shuang Song and David Marn. Introducing a new privacy testing library in tensorflow, 2020. Available on TensorFlow blog or documentation

    2020

  23. [31]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. Proceedings of the IEEE Symposium on Security and Privacy (SP) , pages 3–18, 2017

    2017

  24. [32]

    Practical membership inference attacks against fine-tuned large language models via self-prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical membership inference attacks against fine-tuned large language models via self-prompt calibration. arXiv preprint arXiv:2311.06062, abs/2311.06062, 2023

    2023 arXiv

  25. [33]

    An empirical analysis of memorization in fine-tuned autoregressive language models

    Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David Evans, and Taylor Berg-Kirkpatrick. An empirical analysis of memorization in fine-tuned autoregressive language models. Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP)...

    2022

  26. [34]

    Effects of differential privacy and data skewness on membership inference vulnerability

    Sherri Truex, Ling Liu, Mehmet Gursoy, Wenqi Wei, and Lei Yu. Effects of differential privacy and data skewness on membership inference vulnerability. In 2019 First IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) ,...

    2019

  27. [35]

    Sok: Memorisation in machine learning

    Dmitrii Usynin, Moritz Knolle, and Georgios Kaissis. Sok: Memorisation in machine learning. arXiv preprint arXiv:2311.03075, 2023

    2023 arXiv

  28. [36]

    Sok: Membership inference is harder than previously thought

    Antreas Dionysiou and Elias Athanasopoulos. Sok: Membership inference is harder than previously thought. Proceedings on Privacy Enhancing Technologies, 3:286–306, 2023

    2023

  29. [37]

    Low-cost high-power membership inference by boosting relativity

    Sajjad Zarifzadeh, Philippe Cheng-Jie Marc Liu, and Reza Shokri. Low-cost high-power membership inference by boosting relativity. 2023

    2023

  30. [38]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  31. [39]

    Learning to poison large language models during instruction tuning

    Yao Qiang, Xiangyu Zhou, Saleh Zare Zade, Mohammad Amin Roshani, Prashant Khanduri, Douglas Zytko, and Dongxiao Zhu. Learning to poison large language models during instruction tuning. arXiv preprint arXiv:2402.13459, 2024

    2024 arXiv

  32. [40]

    Amplifying membership exposure via data poisoning

    Yufei Chen, Chao Shen, Yun Shen, Cong Wang, and Yang Zhang. Amplifying membership exposure via data poisoning. In Proceedings of the 36th International Conference on Neural Information Processing Systems , NIPS ’22, Red Hook, NY , USA, 2024. Curran Associates Inc

    2024

  33. [41]

    The secret sharer: Evaluating and testing unintended memorization in neural networks

    Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19) , pages 267–284, 2019

    2019

  34. [42]

    Evaluating differentially private machine learning in practice

    Bargav Jayaraman and David Evans. Evaluating differentially private machine learning in practice. In 28th USENIX Security Symposium (USENIX Security 19) , pages 1895–1912, Santa Clara, CA, aug 2019. USENIX Association

    1912

  35. [43]

    Membership inference attacks against language models via neighbourhood comparison

    Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. Membership inference attacks against language models via neighbourhood comparison. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, Findi...

    2023

  36. [44]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter

    Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108, 2019

    1910 arXiv

  37. [45]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Langu...

    2019

  38. [46]

    Peft: State-of-the-art parameter-efficient fine-tuning methods

    Sourab Mangrulkar, Sylvain Gugger, Lysandre Debut, Younes Belkada, Sayak Paul, and Benjamin Bossan. Peft: State-of-the-art parameter-efficient fine-tuning methods. https://github.com/huggingface/peft, 2022

    2022

  39. [47]

    Mind the privacy unit! user-level differential privacy for language model fine-tuning

    Lynn Chua, Badih Ghazi, Yangsibo Huang, Pritish Kamath, Ravi Kumar, Daogao Liu, Pasin Manurangsi, Amer Sinha, and Chiyuan Zhang. Mind the privacy unit! user-level differential privacy for language model fine-tuning. arXiv preprint arXiv:2406.14322, 2024

    2024 arXiv

  40. [48]

    Inan, and Andre Manoel

    Lukas Wutschitz, Huseyin A. Inan, and Andre Manoel. dp-transformers: Training transformer models with dif- ferential privacy. https://www.microsoft.com/en-us/research/project/dp-transformers , August 2022

    2022

  41. [49]

    Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mari...

    2020

  42. [50]

    Zen and the art of model adaptation: Low-utility-cost attack mitigations in collaborative machine learning

    Dmitrii Usynin, Daniel Rueckert, Jonathan Passerat-Palmbach, and Georgios Kaissis. Zen and the art of model adaptation: Low-utility-cost attack mitigations in collaborative machine learning. Proceedings on Privacy Enhancing Technologies, 2022

    2022

  43. [51]

    Reconstructing training data from trained neural networks

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neural networks. Advances in Neural Information Processing Systems , 35:22911–22924, 2022. 12 The 6th AAAI Workshop on Privacy-Preserving Artificial Intelligence

    2022

  44. [2022]

    Survey Certification

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.