arXiv:2605.17432cs.LGcs.CR2026-05

通过选择性微调,在保护隐私的同时显著提升大模型性能。

DP-SelFT: Differentially Private Selective Fine-Tuning for Large Language Models

论文配图:DP-SelFT: Differentially Private Selective Fine-Tuning for Large Language Models
图 1 · 摘自论文原文
  • 只对关键参数层进行微调,减少隐私开销。
  • 在合成数据上筛选参数,提升抗噪声能力。
  • 适合注重隐私保护的高精度大模型应用。

大型语言模型通常通过微调适配下游任务,但微调数据常包含敏感信息,可能导致模型泄露。差分隐私(DP)可提供正式保护,但现有方法因梯度裁剪和噪声注入导致性能大幅下降。本文提出DP-SelFT框架,采用选择性微调策略,限制更新位置而非仅约束更新形式。该方法构建轻量级差分隐私合成数据集,仅在合成数据上完成参数选择,避免额外隐私损耗;通过临时训练候选层子集并评估其在合成验证集上的表现,实现层级别选择。临时训练模拟下游DP微调的扰动环境,确保所选层在裁剪与噪声下仍具学习能力。实验表明,在相同隐私保证下,DP-SelFT持续优于现有基线方法,显著改善隐私-效用权衡。

原文摘要 · Abstract (English)

Large language models (LLMs) are commonly adapted to downstream tasks through fine-tuning, but fine-tuning data often contains sensitive information that may be leaked by the resulting model. Differential privacy (DP) offers formal protection against such leakage, yet DP fine-tuning of LLMs still suffers from substantial utility degradation due to gradient clipping and noise injection. Existing work improves this trade-off by combining DP with parameter-efficient fine-tuning methods such as LoRA, which constrain the form of updates. In this work, we study a complementary direction: selective fine-tuning, which constrains where updates are applied. We propose DP-SelFT, a framework for differentially private selective fine-tuning of LLMs. DP-SelFT addresses three DP-specific challenges in parameter selection: avoiding repeated privacy cost, improving stability under noisy estimates, and selecting parameters that remain useful under clipped and noisy updates. It first constructs a lightweight DP synthetic dataset and performs selection only on this synthetic data, so the selection stage incurs no additional privacy cost. It then conducts layer-level selection by temporarily training candidate layer subsets on a synthetic training split and evaluating them on a synthetic validation split. Crucially, this temporary training is performed under a perturbation regime matched to downstream DP fine-tuning, with worst-case perturbations of the same scale as DP noise. This favors layer subsets that are not only learnable but also robust to noisy private updates. Experiments on benchmark tasks show that DP-SelFT consistently improves the privacy--utility trade-off over existing DP fine-tuning baselines under the same privacy guarantees.

差分隐私大模型微调选择性更新

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。