Federated learning (FL) is a popular paradigm for collaborative training which avoids direct data exposure between clients. However, data privacy issues still remain: FL-trained large language models are capable of memorizing and completing phrases and sentences contained in training data when given their prefixes. Thus, it is possible for adversarial and honest- but-curious clients to recover training data of other participants simply through targeted prompting. In this work, we demonstrate that a popular and simple fine-tuning strategy, low-rank adaptation (LoRA), reduces memorization during FL by a factor of up to 10 without significant performance cost. We study this effect by performing fine-tuning tasks in high-risk domains such as medicine, law, and finance. We observe a reduction in memorization for a wide variety of model families, from 1B to 70B parameters. We find that LoRA can reduce memorization in centralized learning as well, and we compare how the memorization patterns differ. Furthermore, we study the effect of hyperparameters and show that LoRA can be combined with other privacy-preserving techniques such as gradient clipping and Gaussian noise, secure aggregation, and Goldfish loss to further improve record-level privacy while maintaining performance.

翻译：联邦学习（FL）是一种避免客户端间直接数据暴露的协同训练范式。然而，数据隐私问题依然存在：经过联邦学习训练的大型语言模型在给定训练数据中短语或句子的前缀时，能够记忆并补全这些内容。因此，恶意或诚实但好奇的客户端仅通过针对性提示即可恢复其他参与者的训练数据。本研究证明，一种流行且简单的微调策略——低秩自适应（LoRA）——能在不显著影响性能的前提下，将联邦学习过程中的记忆效应降低高达10倍。我们通过在医学、法律和金融等高风险领域执行微调任务来研究这一效应，观察到从10亿到700亿参数的各种模型家族均出现记忆减少现象。我们发现LoRA在集中式学习中同样能降低记忆效应，并比较了两种场景下记忆模式的差异。此外，我们研究了超参数的影响，证明LoRA可与梯度裁剪、高斯噪声、安全聚合及Goldfish损失等其他隐私保护技术结合，在保持性能的同时进一步提升记录级隐私保护能力。