Research map / Large language models / Instruction and fine-tuning
DPZero: Private Fine-Tuning of Language Models without Backpropagation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DPZero, a differentially private zeroth-order method that privatizes only a scalar finite-difference magnitude along public random directions, achieving near dimension-independent rates for fine-tuning RoBERTa and OPT without backpropagation.
Problem
Fine-tuning LLMs faces high memory cost of backpropagation and privacy risks of memorization; existing differentially private first-order methods have dimension-dependent rates and high per-sample clipping overhead, and naive combination of DP-GD with zeroth-order gradients scales poorly with dimens
Approach
Decouple the zeroth-order gradient into a public random direction u_t and a scalar magnitude; clip and add scalar Gaussian noise only to the magnitude, and use a small clipping threshold justified by the fact that |u^T grad| concentrates at scale L (sphere tail bound), giving logarithmic dependence on d under low effective rank.
Key results
- On RoBERTa-large (355M) with eps=2, DPZero reaches 91.8 on SST-2 and 82.0 on TREC, with at most a 2.6-point accuracy drop versus non-private MeZO.
- Memory on RoBERTa-large SST-2 is 2668 MiB for DPZero versus 15820 MiB for AdamW and 17126 MiB for DP-AdamW, with near-identical runtime to MeZO (0.347 vs 0.345 s/iter).
- On OPT-6.7B, DPZero (eps=6) reaches 92.6 on SST-2 and 79.5 F1 on SQuAD, within 0.9 points of MeZO; first-order methods run out of memory on OPT-1.3B on a 24 GiB GPU.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DPZero instead of MeZO for RoBERTa fine-tuning at ε=6 | RoBERTa-355M · Six sentence-classification tasks | accuracy (%) | Mixed |
| Use DPZero instead of DP-AdamW at ε=6 | RoBERTa-355M · Six sentence-classification tasks | accuracy (%) | Mixed |
| Use DPZero with ε=2 rather than ε=6 | DPZero on RoBERTa-355M · Six sentence-classification tasks | accuracy (%) | Hurt |
| Use DPZero with ε=6 rather than non-private MeZO | OPT models · Classification and generation tasks | accuracy / F1 | No clear effect |
| Sample the update direction from a Gaussian rather than a sphere (ablation) | DPZero on RoBERTa-355M · SST-2 and SST-5 | accuracy (%): $92.2\pm0.3$ vs $91.8\pm0.1$; $91.8\pm0.1$ vs $91.5\pm0.5$; $49.3\pm0.6$ vs $49.9\pm1.3$; $47.1\pm0.9$ vs $47.4\pm1.3$ | No clear effect |
| Use DPZero rather than DPGD-0th | RoBERTa-large · TREC, ε=2 | accuracy (%): 67.0 to 82.0 | Helped |
| Increase the privacy budget from ε=2 to ε=6 | DPZero on OPT · Classification and generation tasks | accuracy / F1 | Helped |
Surprising findings
- DP first-order methods (DP-AdamW) needed more memory than non-private AdamW, while the zeroth-order approach has no clipping overhead since clipping applies only to scalar finite differences.
- Optimal clipping thresholds for DPZero were larger than for first-order methods, consistent with the theory's logarithmic dependence on dimension.
Limitations
- Theory is for full-batch updates, while experiments use mini-batches; population-loss guarantees are left for future work.
- Zeroth-order methods need many more iterations (10,000 vs 1,000 for DP first-order), and the analysis assumes smooth nonconvex objectives with a low effective-rank Hessian assumption.
Experimental setup
Datasets: SST-2 SST-5 SNLI MNLI RTE TREC BoolQ SQuAD DROP
Benchmarks: SST-2 SST-5 SNLI MNLI RTE TREC BoolQ SQuAD DROP
Metrics: accuracy f1 score gradient norm runtime per iteration memory consumption (MiB)
Baselines: MeZO DP-AdamW DP-LoRA AdamW LoRA DPGD-0th DP-GD zero-shot
Builds on: DP-GD MeZO zeroth-order SGD
Closest papers by meaning
- DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineer (ICLR 2024 · similarity 0.90)
- Revisiting Zeroth-Order Optimization for Memory-Efficient LLM Fine-Tuning: A Benchmark (ICML 2024 · similarity 0.89)
- Enhancing Zeroth-order Fine-tuning for Language Models with Low-rank Structures (ICLR 2025 · similarity 0.89)
- PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization (NeurIPS 2026 · similarity 0.88)
- Scaling Laws for Differentially Private Language Models (ICML 2025 · similarity 0.88)
- Differentially Private Bias-Term Fine-tuning of Foundation Models (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.