Research map / Federated learning and privacy / Differential privacy

PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

NeurIPS 2026 · Federated learning and privacy › Differential privacy · approach: Differentially private synthetic data · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes PACZero, a PAC-privacy zeroth-order fine-tuning method that sign-quantizes subset-aggregated ZO updates and releases one bit, with an MI-budgeted variant and a zero-MI (I=0) variant.

Problem

Private fine-tuning of LLMs with zeroth-order optimization suffers DP's harsh utility-privacy trade-off at tight epsilon; iterative PAC-private training at LLM scale was an open problem.

Approach

Sign-quantize subset-aggregated two-point ZO gradients into one bit; unanimous steps (all candidate subsets agree) cost zero conditional mutual information, and disagreement steps are either Gaussian-noised with exact binary-channel MI calibration (PACZero-MI) or replaced by a uniform coin flip (PACZero-ZPL) to reach I(S*;Y)=0.

Key results

• PACZero-ZPL (I=0) reaches 88.99±0.91% on SST-2 OPT-1.3B full fine-tuning, within 2.1pp of non-private MeZO (91.1).
• PACZero-MI reaches 89.51±1.12% on SST-2 OPT-1.3B FT at MI=0.33 nats, +2.9pp above the matched DPZero K=1 baseline (86.6).
• In-house DP-ZO reproductions at eps<1 stay near chance (~50%) for DPZero K=1 and DP-AggZO K=64 up to eps=0.5, while PACZero-ZPL matches the best in-house DP cell (88.42%) at I=0.

Surprising findings

• PACZero-MI test accuracy is nearly flat (about 3pp spread) across four decades of MI budget from 1e-4 to 0.68 nats.
• Unanimity steps (zero-MI, deterministic release) fire on roughly 34-45% of SST-2 steps and drop to 8-33% on SQuAD.

Limitations

• PACZero-ZPL's I=0 guarantee is under a specified candidate-set distribution, not a worst-case DP guarantee.
• SQuAD results trail DPZero K=1 by 6-13 F1 and were run at T=1000 vs 20000 for DPZero, so comparisons are not optimization-matched.
• Evaluated only on OPT-1.3B and OPT-6.7B with SST-2 and SQuAD; hyperparameters dev-tuned per cell.

Experimental setup

Datasets: SST-2 SQuAD

Benchmarks: SST-2 SQuAD

Metrics: accuracy F1 mutual information (nats)

Baselines: DPZero DP-AggZO MeZO DP-SGD

Builds on: PAC Privacy MeZO DPZero DP-AggZO DP-SGD

Closest papers by meaning

• DPZero: Private Fine-Tuning of Language Models without Backpropagation (ICML 2024 · similarity 0.88)
• Hidden No More: Attacking and Defending Private Third-Party LLM Inference (ICML 2025 · similarity 0.88)
• Privacy Auditing of Large Language Models (ICLR 2025 · similarity 0.87)
• Privacy-Preserving Instructions for Aligning Large Language Models (ICML 2024 · similarity 0.86)
• Split-and-Denoise: Protect large language model inference with local differential privacy (ICML 2024 · similarity 0.86)
• Square$\chi$PO: Differentially Private and Robust $\chi^2$-Preference Optimization in Offline Direct Alignment (ICML 2025 · similarity 0.86)