Research map / Federated learning and privacy / Differential privacy
DR-Encoder: Encode Low-rank Gradients with Random Prior for Large Language Models Differentially Privately
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DR-Encoder, a federated LLM fine-tuning method that trains a LoRA-gradient autoencoder on synthetic Gaussian gradients built from per-layer statistics, then adds client-level Gaussian DP noise to compressed gradients, with GDP/RDP accounting.
Problem
Federated fine-tuning of LLMs leaks sensitive client information through gradients and through learned gradient-compression autoencoders, and standard DP noise degrades utility at billion-parameter scale.
Approach
Train the gradient autoencoder only on synthetic Gaussian gradients sampled from transmitted per-layer/epoch mean and standard deviation statistics (a "random prior"), then compress LoRA gradients with this encoder and apply client-level Gaussian noise before aggregation.
Key results
- Qwen7B-DR-Encoder reaches 56.13 average on MMLU vs 56.07 for the base model and 56.77 for non-private LoRA; at epsilon=8.0 it reaches 56.48 for FedDR.
- On C-Eval with LLaMA-7B, DR-Encoder achieves 26.2 average (non-private) versus 25.8 for LoRA and 22.8 for the base model.
- Communication for the autoencoder pretraining stage is reduced from about 160 MB (FedCG) to 0.078 MB (DR-Encoder), a stated ratio of 6.10e-5.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DR-Encoder with random-prior gradient compression instead of LoRA | Qwen-7B · MMLU | Average accuracy: 56.77 -> 56.13 | Hurt |
| Use DR-Encoder with random-prior gradient compression instead of LoRA | LLaMA-7B · C-Eval | Average accuracy: 25.8 -> 26.2 | Helped |
| Use DR-Encoder instead of FedCG | Qwen-7B · MMLU | Average accuracy: 56.44 -> 56.13 | Hurt |
| Use DR-Encoder instead of FedCG | LLaMA-7B · C-Eval | Average accuracy: 26.6 -> 26.2 | Hurt |
| Add Gaussian noise to LoRA gradients for differential privacy | Qwen-7B LoRA · MMLU | Average accuracy: 56.77 -> 25.67 | Hurt |
| Set privacy budget ε=0.25 rather than ε=8.0 (ablation) | Qwen-7B DR-Encoder · MMLU | Average accuracy: 56.48 -> 51.23 | Hurt |
| Set privacy budget ε=0.25 rather than ε=8.0 (ablation) | LLaMA-7B DR-Encoder · C-Eval | Average accuracy: 26.1 -> 26.1 | No clear effect |
| Use random-prior synthetic gradients instead of transmitting raw gradients for AutoEncoder pretraining | DR-Encoder · AutoEncoder pretraining | Communication parameters: 167,772,160 -> 10,240 | Helped |
| Vary the number of Uformer blocks and downsampling/upsampling layers; select 7 Downsampling + 6 Uformer + 7 Upsampling (ablation) | DR-Encoder AutoEncoder · AutoEncoder architecture | Efficiency and efficacy | Mixed |
Surprising findings
- Directly adding Gaussian noise to LoRA gradients drops Qwen MMLU average from 56.77 to 25.67, indicating severe utility loss.
- DR-Encoder at loose budgets (epsilon 4.0 and 8.0) reportedly surpasses non-private baselines, which the authors attribute to reduced noise improving generalization.
Limitations
- Experiments only on 7B models with small sample counts (149 or 285 training samples) and few communication rounds due to limited compute.
- The reported DP privacy analysis is inconsistent across tables (RDP vs GDP epsilon values differ, and the noise scaling 2sigma/K is loosely defined), and the random prior's privacy relies on statistics that are still transmitted.
Experimental setup
Datasets: Databricks-dolly-15k MMLU-train
Benchmarks: MMLU C-Eval
Metrics: accuracy epsilon privacy budget
Baselines: Cent LoRA FedCG Base model
Builds on: LoRA FedCG Gaussian differential privacy Renyi differential privacy Uformer
Closest papers by meaning
- Differentially Private Federated Low Rank Adaptation Beyond Fixed-Matrix (NeurIPS 2025 · similarity 0.89)
- Scaling Laws for Differentially Private Language Models (ICML 2025 · similarity 0.88)
- Privacy-Preserving Instructions for Aligning Large Language Models (ICML 2024 · similarity 0.88)
- Split-and-Denoise: Protect large language model inference with local differential privacy (ICML 2024 · similarity 0.87)
- DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineer (ICLR 2024 · similarity 0.87)
- DPZero: Private Fine-Tuning of Language Models without Backpropagation (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.