Research map / Federated learning and privacy / Differential privacy
Differentially Private Federated Low Rank Adaptation Beyond Fixed-Matrix
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FedASK, a differentially private federated LoRA method that updates both adapters via a two-stage randomized-SVD-style sketching pipeline, and reports gains over FedAvg, FFA-LoRA, FedSA-LoRA, FedProx and Scaffold on Llama-2-7B/13B.
Problem
Applying differential privacy to federated LoRA fine-tuning of LLMs is hard: noising both adapters amplifies noise quadratically, while freezing one adapter limits learnability.
Approach
A two-stage randomized-SVD-style sketching pipeline: clients locally update only B under DP-SGD with A fixed, sketch B·A products with a shared Gaussian matrix, the server orthonormalizes with QR and SVD-reconstructs both global A and B, claimed to give exact aggregation of local products.
Key results
- On Llama-2-7B under epsilon=1, FedASK reaches 45.80 MMLU versus 42.07 for FedAvg, with consistent wins across DP budgets and Dirichlet non-IID splits.
- On Llama-2-13B with epsilon=6, FedASK reaches 27.7 GSM8K versus 19.3 for FedAvg, and reports up to 46% relative gain on GSM8K.
- Aggregation cosine similarity with the ideal mean is near 1 (error ~1e-7) for FedASK with p=0, versus 0.92-0.96 for FedAvg.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FedASK instead of the strongest listed baseline | Llama-2-7B · MMLU, ε=3 | score: 43.17 -> 46.25 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-7B · DROP, ε=3 | score: 29.40 -> 32.08 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-7B · Human-Eval, ε=3 | score: 13.41 -> 15.24 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-13B · GSM8K, ε=3 | score: 20.2 -> 24.8 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-13B · GSM8K-hard, ε=3 | score: 11.3 -> 12.6 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-13B · Math, ε=3 | score: 6.4 -> 6.6 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-7B · MMLU, non-IID Dir(0.1), ε=3 | score: 44.27 -> 46.04 | Helped |
| Use FedASK instead of the strongest listed baseline | Llama-2-7B · DROP, non-IID Dir(0.1), ε=3 | score: 30.10 -> 31.01 | Helped |
| Set over-sketching parameter p from 0 to 128 (ablation) | FedASK · MMLU, non-IID α=0.1, ε=3 | score: 45.63 -> 46.06 | No clear effect |
Surprising findings
- Adding DP noise sometimes improves performance over the non-private case, which the authors attribute to implicit regularization.
- Reported results are largely uniform across sketching over-parameter p (MMLU 45.63 to 46.06), suggesting low sensitivity to p.
Limitations
- Exact aggregation theorem requires over-sketching p >= d_B - r + 2, which may be large when client subspaces are diverse.
- Privacy analysis contains approximations (high privacy regime, dominant-term simplifications) and the main results do not report DP accounting details.
- Evaluation is limited to Llama-2 models and two training datasets.
Experimental setup
Datasets: dolly-15K MetaMathQA
Benchmarks: MMLU DROP HumanEval GSM8K GSM8K-hard MATH
Metrics: accuracy cosine similarity of aggregated update
Baselines: FedAvg FFA-LoRA FedSA-LoRA FedProx Scaffold
Builds on: LoRA DP-SGD FFA-LoRA FedSA-LoRA randomized SVD
Closest papers by meaning
- Improving LoRA in Privacy-preserving Federated Learning (ICLR 2024 · similarity 0.92)
- FedSVD: Adaptive Orthogonalization for Private Federated Learning with LoRA (NeurIPS 2025 · similarity 0.92)
- Fed-SB: A Silver Bullet for Extreme Communication Efficiency and Performance in (Private) Federated LoRA Fine-Tuning (NeurIPS 2026 · similarity 0.90)
- Open LLMs are Necessary for Current Private Adaptations and Outperform their Closed Alternatives (NeurIPS 2024 · similarity 0.89)
- DR-Encoder: Encode Low-rank Gradients with Random Prior for Large Language Models Differentially Privately (AAAI 2025 · similarity 0.89)
- FLoRA: Federated Fine-Tuning Large Language Models with Heterogeneous Low-Rank Adaptations (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.