Pith. sign in

REVIEW 16 cited by

Large Language Models Can Be Strong Differentially Private Learners

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2110.05679 v6 pith:72AYSJU3 submitted 2021-10-12 cs.LG cs.CL

Xuechen Li , Florian Tramèr , Percy Liang , Tatsunori Hashimoto This is my paper
classification cs.LGcs.CL
keywords modelslargelearningprivatedifferentiallydp-sgdlanguageoptimization
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Differentially Private (DP) learning has seen limited success for building large deep learning models of text, and straightforward attempts at applying Differentially Private Stochastic Gradient Descent (DP-SGD) to NLP tasks have resulted in large performance drops and high computational overhead. We show that this performance drop can be mitigated with (1) the use of large pretrained language models; (2) non-standard hyperparameters that suit DP optimization; and (3) fine-tuning objectives which are aligned with the pretraining procedure. With the above, we obtain NLP models that outperform state-of-the-art DP-trained models under the same privacy budget and strong non-private baselines -- by directly fine-tuning pretrained models with DP optimization on moderately-sized corpora. To address the computational challenge of running DP-SGD with large Transformers, we propose a memory saving technique that allows clipping in DP-SGD to run without instantiating per-example gradients for any linear layer in the model. The technique enables privately training Transformers with almost the same memory cost as non-private training at a modest run-time overhead. Contrary to conventional wisdom that DP optimization fails at learning high-dimensional models (due to noise that scales with dimension) empirical results reveal that private learning with pretrained language models doesn't tend to suffer from dimension-dependent performance degradation. Code to reproduce results can be found at https://github.com/lxuechen/private-transformers.

Discussion (0). Sign in to comment.

Forward citations

Cited by 16 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Instance-Optimality for Private KL Distribution Estimation

    stat.ML 2025-05 conditional novelty 7.0 of 10

    New private and non-private estimators achieve per-instance KL error within constant factors of the best possible error over a new additive local neighborhood.

  2. Efficient Differentially Private Fine-Tuning of LLMs via Reinforcement Learning

    cs.LG 2025-07 reject novelty 6.0 of 10

    RLDP uses a soft actor-critic policy to adapt per-adapter clipping and noise during DP-SGD fine-tuning of LLMs, claiming utility gains and faster convergence, but the privacy proof is internally inconsistent.

  3. What Should LLMs Forget? Quantifying Personal Data in LLMs for Right-to-Be-Forgotten Requests

    cs.CL 2025-07 conditional novelty 6.0 of 10

    WikiMem, a Wikidata-derived canary dataset and a calibrated NLL-ranking metric, identifies which human-fact associations an LLM has memorized, with higher rates for famous people and larger models.

  4. UniAud: A Unified Auditing Framework for High Auditing Power and Utility with One Training Run

    cs.CR 2025-07 conditional novelty 6.0 of 10

    UniAud uses synthetic uncorrelated canaries and self-comparison inference to reach near-optimal empirical epsilon lower bounds in one black-box DP audit run, while UniAud++ improves the utility-auditing trade-off via ...

  5. Approximating Language Model Training Data from Weights

    cs.CL 2025-06 conditional novelty 6.0 of 10

    A gradient-based greedy selection method (SELECT) recovers effective substitute fine-tuning data from two language model checkpoints, approaching the original model's performance on classification and SFT tasks.

  6. Membership Inference Attacks on Tokenizers of Large Language Models

    cs.CR 2025-10 conditional novelty 5.0 of 10

    Tokenizers leak dataset membership: using distinctive tokens that appear in a dataset's text, an attacker can detect with AUC up to 0.77 whether that dataset was part of tokenizer training.

  7. Re-examining Low Rank adaptation for private LLM fine-tuning

    cs.LG 2025-10 conditional novelty 5.0 of 10

    Denoising DP-SGD gradients with random-matrix-theory singular-value shrinkage speeds up private RoBERTa fine-tuning on GLUE, cutting steps to target accuracy by 20–100%.

  8. ISACL: Internal State Analyzer for Copyrighted Training Data Leakage

    cs.CL 2025-08 conditional novelty 5.0 of 10

    An MLP trained on LLM internal states predicts Rouge-L-defined literal copying leakage with high accuracy, but not paraphrase-level leakage.

  9. FlashDP: Private Training Large Language Models with Efficient DP-SGD

    cs.LG 2025-07 conditional novelty 5.0 of 10

    FlashDP fuses per-sample gradient computation, norm calculation, clipping, and noise addition into a cache-friendly block-wise all-reduce workflow that avoids explicit per-sample gradient storage and redundant recomputation.

  10. SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks

    cs.CR 2025-06 conditional novelty 5.0 of 10

    SOFT paraphrases low-loss fine-tuning samples before training, reducing MIA AUC from about 0.82 to about 0.54 across six datasets at roughly 7% perplexity cost.

  11. Dual-Priv Pruning : Efficient Differential Private Fine-Tuning in Multimodal Large Language Models

    cs.CR 2025-06 conditional novelty 5.0 of 10

    A framework for DP fine-tuning of MLLMs that prunes visual tokens before training and selectively applies noisy gradient updates to blocks with the largest norms, reporting modest utility and memory gains over DP-SGD.

  12. Public Data Assisted Differentially Private In-Context Learning

    cs.AI 2025-09 conditional novelty 4.0 of 10

    A private ICL algorithm that aggregates LLM responses with DPM clustering and uses public data representatives achieves near-non-private utility at epsilon=1.

  13. Get Experience from Practice: LLM Agents with Record & Replay

    cs.LG 2025-05 reject novelty 4.0 of 10

    AgentRR is a proposed paradigm that records agent traces, generalizes them into multi-level experiences, and replays them under safety checks to make LLM agents cheaper, faster, and more reliable.

  14. SoK: The Privacy Paradox of Large Language Models: Advancements, Privacy Risks, and Mitigation

    cs.CR 2025-06 conditional novelty 3.0 of 10

    A systematization-of-knowledge survey that categorizes LLM privacy risks into training data, prompts, outputs, and agents, and reviews limitations of current mitigations.

  15. How to DP-fy Your Data: A Practical Guide to Generating Synthetic Data With Differential Privacy

    cs.CR 2025-12 conditional novelty 2.0 of 10

    A practical, extremely thorough survey of differentially private synthetic data generation: methods, privacy units, evaluation metrics, and end-to-end system components across four data modalities.

  16. When FinTech Meets Privacy: Securing Financial LLMs with Differential Private Fine-Tuning

    cs.CR 2025-09 reject novelty 2.0 of 10

    DPFinLLM is a standard LoRA plus DP-SGD fine-tuning recipe applied to Llama2 and ChatGLM2 for financial sentiment; the experiments are mixed, generally below state-of-the-art, and key details are missing.

Pith tools