Low-Rank Adaptation Secretly Imitates Differentially Private SGD

Saber Malekmohammadi, Golnoosh Farnadi

Keywords: large language models, low-rank adaptation, differential privacy, lora

TL;DR: We show that LoRA secretly imitates DPSGD algorithm and provides robustness to membership inference attacks.

Abstract: We look at low-rank adaptation methods, e.g., LoRA, from the lens of data privacy. We show theoretically that the low-rank adaptation used in LoRA leads to injection of random noise into the batch gradients w.r.t the adapters - just like what DPSGD algorithm does. We also quantify the variance of the injected noise as a decreasing function of adaptation rank. By establishing a Berry-Esseen type bound on the total variation distance between distribution of the injected noise and a Gaussian distribution with the same variance, we show that the dynamics of low-rank adaptation is very close to that when performing DPSGD w.r.t the adapters. Consequently, low-rank adaptation provides robustness to membership inference attacks.

Submission Number: 28