Privacy Preserving API Fine-tuning for LLMs

Philip Zmushko, Marat Mansurov, Ruslan Svirschevski, Denis Kuznedelev, Max Ryabinin, Aleksandr Beznosikov

Primary Area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Keywords: Split Learning, Vertical Federated Learning, Federated Learning, Parameter Efficient Fine-tuning, Large Language Models

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2024/AuthorGuide.

TL;DR: We develop a practical two party algorithm for fine-tuning large language models over an API by taking advantage of PEFT algorithms.

Abstract:

As deep learning models become larger and more expensive, many practitioners turn to fine-tuning APIs.
These web services allow fine-tuning a model between two parties: the client that provides the data, and the server that hosts the model.
While convenient, the fine-tuning APIs raise a new concern: the data of the client is at risk of privacy breach during the training procedure.
This challenge presents an important practical case of vertical federated learning, where the two parties perform parameter-efficient fine-tuning (PEFT) of a large pre-trained model.
In this study, we systematically search for a way to fine-tune models over an API *while keeping the labels private*.
We analyze the privacy of popular algorithms for parameter-efficient fine-tuning when training over an API.
Using this analysis, we propose P$^3$EFT, a two-party split learning algorithm that takes advantage of existing PEFT properties to maintain privacy at a lower performance overhead.
To validate our algorithm, we fine-tune DeBERTa-v2-XXLarge and Flan-T5 using LoRA adapters on a range of common NLP tasks. We find that P$^3$EFT is competitive with existing privacy-preserving methods in a two-party setup while having higher accuracy.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors' identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 5437