LoRA能大幅降低大模型在联邦学习中的数据记忆风险。
Mitigating Unintended Memorization with LoRA in Federated Learning for LLMs
- 用低秩适配（LoRA）微调，减少模型对训练数据的记忆。
- 在医疗、金融等领域实验中，记忆风险降低最高达10倍。
- 兼容梯度裁剪等隐私技术，适合注重数据安全的场景。
联邦学习（FL）是一种避免客户端直接暴露数据的协作训练范式。然而，数据隐私问题依然存在：经过联邦训练的大语言模型会记忆训练数据中的短语和句子，并在给定前缀时还原出来。这使得恶意或好奇的客户端可通过针对性提示恢复其他参与者的训练数据。本文表明，一种流行且简单的微调方法——低秩适配（LoRA），可将联邦学习中的记忆风险降低高达10倍，同时几乎不损失性能。我们在医疗、法律和金融等高风险领域进行了微调实验，发现该效果适用于从10亿到700亿参数的多种模型架构。此外，我们还发现LoRA在集中式学习中同样能减少记忆，并比较了不同场景下的记忆模式差异。进一步研究超参数影响后发现，LoRA可与梯度裁剪、高斯噪声、安全聚合及Goldfish损失等隐私保护技术结合，显著提升记录级隐私，同时保持模型性能。
原文摘要 · Abstract (English)
Federated learning (FL) is a popular paradigm for collaborative training which avoids direct data exposure between clients. However, data privacy issues still remain: FL-trained large language models are capable of memorizing and completing phrases and sentences contained in training data when given their prefixes. Thus, it is possible for adversarial and honest- but-curious clients to recover training data of other participants simply through targeted prompting. In this work, we demonstrate that a popular and simple fine-tuning strategy, low-rank adaptation (LoRA), reduces memorization during FL by a factor of up to 10 without significant performance cost. We study this effect by performing fine-tuning tasks in high-risk domains such as medicine, law, and finance. We observe a reduction in memorization for a wide variety of model families, from 1B to 70B parameters. We find that LoRA can reduce memorization in centralized learning as well, and we compare how the memorization patterns differ. Furthermore, we study the effect of hyperparameters and show that LoRA can be combined with other privacy-preserving techniques such as gradient clipping and Gaussian noise, secure aggregation, and Goldfish loss to further improve record-level privacy while maintaining performance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。