Differentially Private Fine-tuning of Language Models

Abstract

We give simpler, sparser, and faster algorithms for differentially private fine-tuning of large-scale pre-trained language models, which achieve the state-of-the-art privacy versus utility tradeoffs on many standard NLP tasks. We propose a meta-framework for this problem, inspired by the recent success of highly parameter-efficient methods for fine-tuning. Our experiments show that differentially private adaptations of these approaches outperform previous private algorithms in three important dimensions: utility, privacy, and the computational and memory cost of private training. On many commonly studied datasets, the utility of private models approaches that of non-private models. For example, on the MNLI dataset we achieve an accuracy of 87.8% using RoBERTa-Large and 83.5% using RoBERTa-Base with a privacy budget of ε = 6.7. In comparison, absent privacy constraints, RoBERTa-Large achieves an accuracy of 90.2%. Our findings are similar for natural language generation tasks. Privately fine-tuning with DART, GPT-2-Small, GPT-2-Medium, GPT-2-Large, and GPT-2-XL achieve BLEU scores of 38.5, 42.0, 43.1, and 43.8 respectively (privacy budget of ε = 6.8, δ = 1e-5) whereas the non-private baseline is 48.1. All our experiments suggest that larger models are better suited for private fine-tuning: while they are well known to achieve superior accuracy non-privately, we find that they also better maintain their accuracy when privacy is introduced.

Deduplicating Training Data Mitigates Privacy Risks in Language Models

“…Training data privacy can be protected using the differential privacy (DP) framework (Dwork et al, 2006), which ensures that the effect of any single training example on the trained model is not too large. Yu et al (2021); Li et al (2022) demonstrate the practicality of training differentially private LMs. However, the privacy guarantees achieved by differentially private training are weaker than reported when datasets contain duplicated records.…”

Mixed Differential Privacy in Computer Vision

“…Most work on Differential Privacy [6,10,22,24,32,44,47,53,53,57] uses public data either for: generic pre-training unrelated to the task [49], or to tune parameters [25,58,60], or as additional unlabeled data [37,38]. Instead, we use a small amount of labeled public data related to the task to improve the accuracy of a private model under a given privacy parameter .…”

“…DP for Language models. [34,57] show that a large language model pre-trained on generic public data can be finetuned on task-specific private data with only modest loss in accuracy. In contrast, our focus is on using small amounts of public data for fine-tuning.…”

“…Such public data are distinct from the private ones, for which we seek strong privacy guarantees. 1 In particular, using large amounts of generic public data for pre-training has recently enabled the creation of language models that achieve DP on the target task while remaining close to state-of-the-art performance [34,57]. The same strategy in vision [49], however, still yields punishing error increases (Tab.…”

What Does it Mean for a Language Model to Preserve Privacy?

“…To address these privacy concerns, there is a growing body of literature that aims to create privacypreserving language models [64,2,56,98,84,40,79]. While humans navigate the complexities of language and privacy by identifying appropriate contexts for sharing information, LMs are not currently designed to do this [14,72,66,49,66,50,41].…”