Mitigating Unintended Memorization with LoRA in Federated Learning for LLMs
Authors: Thierry Bossy
Julien Tuấn Tú Vignoud
Tahseen Rabbani
Juan R. Troncoso Pastoriza
Martin Jaggi
Venue: Accepted by TMLR ()

Abstract: Federated learning (FL) is a popular paradigm for collaborative training which avoids direct data exposure between clients. However, data privacy issues still remain: FL-trained large language models are capable of memorizing and completing phrases and sentences contained in training data when given their prefixes. Thus, it is possible for adversarial and honest-but-curious clients to recover training data of other participants simply through targeted prompting. In this work, we demonstrate that a popular and simple fine-tuning strategy, low-rank adaptation (LoRA), reduces memorization during FL by a factor of up to 10 without significant performance cost. We study this effect by performing fine-tuning tasks in high-risk domains such as medicine, law, and finance. We observe a reduction in memorization for a wide variety of model families, from 1B to 70B parameters. We find that LoRA can reduce memorization in centralized learning as well, and we compare how the memorization patterns differ. Furthermore, we study the effect of hyperparameters and show that LoRA can be combined with other privacy-preserving techniques such as gradient clipping and Gaussian noise, secure aggregation, and Goldfish loss to further improve record-level privacy while maintaining performance.

Published in Transactions on Machine Learning Research (02/2026)
Mitigating Unintended Memorization with LoRA in Federated Learning for LLMs
Thierry Bossy* Tune Insight SA, Switzerland
thierry@tuneinssihh..com com
Julien Tuân Tú Vignoud EPFL, Switzerland
julien.vignoud wignouddepfl...c
Tahseen Rabbani
Yale University, USA
Juan R. Troncoso Tune Insight SA, Switzerland
Martin Jaggi
EPFL, Switzerland
Reviewed on OpenReview: https: // openreview. net/ forum? id= WKPyZnLIN4
//
Abstract
Federatod learning (FI. is a popular paradigm for collaborative training which avoids direct data exposure between clients. However, data privacy issues still remain: FL-trained large language models are capable of memorizing and completing phrases and sentences contained in training data when given their prefixes. Thus, it is possible for adversarial and honest- but-curious clients to recover training data of other participants simply through targeted prompting. In this work, we demonstrate that a popular and simple fine-tuning stralegy, low-rank adaptation (LoRA), reduces memorization during FL by a factor of up to without significant performance cost. We study this effect by performing finettning tasks in high-risk domains such as medicine, law, and finance. We observe a reduction in memorization for wide variety of model families, from 1B to 70B parameters. We find that LoRA reduce memorization in centralized learning well, and compare how the memorization patterns differ. Furthermore, we study the effect of hyperparameters and show that LoRA can be combined with other privacy-preserving techniques such as gradient clipping and Gaussian noise, secure aggregation, and Goldfish loss to further improve record-level privacy while maintaining performance.
1
Introduction
Large language models (LLMs) have been shown to achieve state-offthe-art performance over most relevant. natural language processing (NLP) tasks (Zhao et al. 2023). Following these advances, there significant interest fine-tuning LLMs for downstrream tasks over specialized domains such as medicine (Singhal el al. T'irunavukarasu et al., 2023 Yang al. 2022), law (Cui al., (024a) or finance (Wu
2023a
2023b
Li ct al. 2023b). Given the inherent confidentiality of user data. involved in these fields, well the
increasing number of studies showing LLMs' propensity to expose training data (Nasr el al. 2025 Carlini
et al.
2023a Hou et al.) 2025 Hayes et al.) [2225] Leybzon & Kervadec 2024 ZZng et al.) 2024 Biderman et al.
2023 there is crucial need for additional privacy mechanisms, One such mechanism for iataacoontrained
parties is fedorated learning (FL), widely-studied paradigm enabling multiple data parties, called clients, to
"Equal contribution

---

Published in Transactions on Machine Learning Research (02/2026)
collaboratively train machine learning model without sharing local data MMMMaan et al. 2016 Kairouz
et al. 2021
An early study by Thakkar et al. (2021) of a 1.3M parameter LSTM next-word predictor (Hard et al. 2019 showed that FL significantly reduces unintended memorization compared to centralized learning (CL). Yet, it is unclear whether FT. remains effective at. preventing recent multi-billion parameter models with Transformers architectures /Vaswani et al. 2023) from memorizing training data and exposing sensitive information inference time.
Moreover, there is significant interest in the FL community in leveraging parameter-efficien fine-tuning
(PEFT) techniques (Kuang et al.) 2023 Q1 et al. 2024 Wu et al. 2024 Yi et al. 2024 Sun et al. 2024 Liu et al., 2024), and in particular Low-Rank Adaplation (LoRA) (Hu et al. 2021 Indeed, LoRA and other PEFT techniques offer multiple desirable properties. By only updating a small set of parameters while koeping the pre-trained weights frozen, PEFT methods alleviate the prohibitive computational costs of training models comprised of multiple billion parameters and drastically reduce the size of the updates exchanged during the FL training. While the impact of LoRA on unintended memorization is gaining interest in centralized learning (Hou et al. 2025 Wang & Li 2025), its specific effects in FL are not well-understood yet and mainly studied in combination with differential privacy (DP) (Dwork et al., 2006) by Sun et al. (2024] and Liu et al. (2024). Both works evaluated the performance of LoRA in FL combined with DP and found non-trivial performance losses even for high privacy budgets.
In this paper, we extensively evaluate the resulting unintended memorization of FL-trained LLMs in a hata-hestroogeneous 3-client setup and show that ToRA enables significant memorization reduction for little to performance cost compared to full fine-tuning. We fine-tuned models over realistic sensitive information and measure the rale of unintended memorization in different domains such medicine, law and finance. In contrast to Thakkar et al. (2021). we extend our analysis to LoRA fine-tuning, and study memorization across a broader range of settings, model families and model sizes up to 70B parameters. Our work is complementary to [Sun et al. (0244) and Liu et al. (2024): we empirically measured memorization rather than under DP theoretical bounds, via several memorization metrics such as exact token matching, approximate reproduction Ippolito et al. (2023) and BERTScore (Zhang et al.) 2020). While DP provides theoretical bounds, we argue that complementary empirical evaluation is essential. Indeed, DP's applicability to LLM training natural language data and its subsequent formal guarantees have been questioned by [Bron el al. (2022) and Tramer et al. (024)). as it remains unclear how DP's secret boundaries should be defined given the contextual nature of language and in the light of successful personally identifiable information (PII) extraction of DP-trained LLMs (Lukas et al. 2023
Our contributions are as follows:
We empirically demonstrate that LoRA mitigates memorization in federated learning for little to no performance cost compared to full fine-tuning. This effect generalizes to datasets drawn from several sensitive data domains such as medicine, law, and finance.
We comprchensively test model sizes from 1B to 70B parameters from the Llama-2 family, Llama-3 family, and Mistral-v0.3. LoRA effectively reduces memorization across models.
We investigate the impact of the LoRA rank on memorization and compare how sensitive data memorization in federated learning differs from centralized learning.
We experimentally explore how LoRA interacts with other privacy strategics. This includes differential privacy mechanisms such as gradient noising and clipping, Goldfish loss (Hans et al. 2024), post- training noise injection and secure aggregation. We demonstrate how LoRA can work synergistically with these other approaches.
We release a repository with code and instructions to reproduce our results: https:://iitub.com Suanihnsiihh--oolll//Paaaaaaalll
2

---

Published in Transactions on Machine Learning Research (02/2026)
2 Related Work and Preliminaries
This section reviews related work and foundational concepts in LoRA, foderated learning, and memorization in large language models. Additional discussions on differential privacy, membership inference attacks, secure aggregation, and medical applications are provided in Appendix A
2.1 LoRA
To reduce computational and memory requirements when fine-tuning LLMs, Low-Rank Adaptation (LoRA) (Hu et al. 2021) was introduced to drastically reduce the number trainable parameters during fine-tuning, This is achieved by representing the weight updates AW as the product AW BA of two low-rank matrices A and B. LoRA enables efficient adaptation of LLMs to specific lasks while preserving the generalization capabilities of the underlying model, as gradients often exhibit low intrinsic dimensionality (Li et al. 2018 Aghajanyan et al.) 2020). Additionally, LoRA offers notable advantage in an FL scenario by drastically reducing the amount of data exchanged between participants during each round. In our experiments, we achieved a 130-fold reduction. Understanding LoRA's 's resultant, performance compared with full fine-tuning is still an active area of research, with preliminary results showing LoRA can match full model training on small to medium-sized datasets (Schulman & Lab 2025
Biderman el al. 2024).
The study of LoRA and memorization has been limited centralized learning, mainly by Hou al. 20255
and Wang & Li (2025). and indirectly by Biderman et al. 2024 Hou et al. (2025) compares memorization between LoRA and prompt-based fine-tuning, which consists in keeping the pre-trained model weights frozen and learning task-specific prompts. However, their study does not include a comparison with full parameter fino-tuning, which we argue is most widely used in practice along with LoRA. Recent work by Wang & Li (2025) finds that fine-tuning GPT-2 with LoRA results in lower memorization than full fine-tuning, suggesting its potential for federated learning. Bideerman et al. (2024) analyzes the trade-off between factual knowledge learning and forgetting. While they do not directly analyze training data memorization, they show that tradeoff than full fine-tuning, learning less math and code datasets but forgetting less of its pre-training knowledge.
LoRA presents better factual knowledge eearning-forgettinn
2.2 Federated Learning
Federated learning (FL) has been widely-studied for deep learning models in cross-silo settings Huang et al, (2022), in which limited number of resourcc-rich clients, such as organizations or institutions, collaboratively train ML models without sharing their data. In conventional FL, the global objective function of N clients is defined
N
min F(W) = Σ PW)) W
(1)
k=1
1= Pk- = and Su (W) is the local objective function of client k. Local training data Dx between clients is often heterogeneous. A common strategy for solving Equation is Federated Averaging (FedAvg) (McMahan al. 2016). FL. has recently been applied to LLMs Ye et al. (2024); Thakkar et al. (2021); Liu al. (2024); Ramaswamy et al. (2020) leveraging FedAvg to aggregate locally-trained model updates. Work by Thakkar et al. (2021) informed our federated training strategy by demonstrating small scale that federated averaging is especially effective at reducing memorization non-independent and identically distributed (non-IID) data. Recent work by Google and others has explored the use of FL for large-scale language model training in production environments, placing strong emphasis on
where W represents the parameters of a model, Σx
privacy protection (Hard et al. 2019 Ramaswamy et al. 2020 Thakkar et al. 2021 Xu et al.] 2023). showing growing interest in crivacy-preservinn
training mothods. While Liu al. (2024) and Sun al. (2024) studiod
LoRA with DP-SGD, this work to the best of our knowledge the first empirically measure the impact of LoRA on memorization in federated learning.
3

---

Published in Transactions on Machine Learning Research (02/2026)
2.3 Memorization
How to quantify the memorization capacity of an LLM is an active area of research. A seminal work by Carlini et al. introduced "canaries', which are synthetic, out-of-distribution pieces of text injected into training data (such as "My SSN is XXX-XX-XXXX- - (Carlini et al.) 2019). It has found use in production-level studies (Ramaswamy et al. 2020) and adjacent fields such as machine unlearning (Jagielski et al., 2022). An alternative definition of memorization [Carlini et al., 2023a), the completion metric, measures how often an LLM completes a piece of text taken from the training data when prompted on an initial portion (prefix) of it.
Memorization definition. We use the 'extractable memorization' definition of Carlini et al. (203bb) following its wide adoption (Ippolito et al. 2023 Huang et al., 2024 Hans et al. 2024 Nast et al. 2023
2025 Consider a string representable as the concatenation [p] where is a prelix of length k and s is the remainder of the string. We define the string to be memorized with k tokens of contert by a language model f if [p]|s] is contained in the training data of f, and f produces s when prompted with p using greedy decoding In other words, we consider a string from training data memorized if an LLM can generate it when prompted by prefix. We set the length of the generated suffix s to 50 tokens, in line with previous work.
3 Methodology
In a federated learning setting, training data is split among several clients. Our experiments are designed to mimic a medical scenario in which each client holds potentially sensitive data, reflecting the reality that few, if any, anonymization tools can guarantee the complete removal of sensitive information (Langarizadeh et al. 2018 Brown al.) 2022). In fact. Heider et al. (2020) evaluated three off off-tho-shelf de-identification tools on the 12b2 medical record dataset (Stubbs & Ozlem Uzuner 2015) which we use in our study and found that none could achieve complete removal. We adopt so-called cross-silo setting, where there are only a handful of participants, 3 in our case, each with a relatively large amount of data, in contrast to cross-devics FL in which data is divided among up to millions of clients. Cross-silo FL is realistic setting for medical scenario. For example, a few hospitals with confidentiality requirements may want to collaborate and train a more generalizable model. Moreover, a large number of clients is computationally prohibitive for the model scale we are studying in this work.
3.1 Quantifying memorization
Our measurement methodology is largely inspired by Carlini et al. 2023bb In short, we inject sensitive sequences, so-called "canaries" (Carlini et al. 2019 Jagiclski et al. 2023 Thakkar et al. 2021). into fine-tuning data and then measure the model's ability to regurgitate this information when prompted with the beginning of these sequences.
Canarics. Unlike prior work that evaluates the memorization of all training data (Carlini et al., 2023b Ippolito et al. 2023 Hans al., 2024), we are interested in measuring how much sensitive information is memorized. Similar to Lehman et al. (2021) and Mireshghallah et al. (2022), we inject medical records into our training set originating from the 2014 i2b2/UTHealtt corpus (Stubss & Özlem Uzuner 2015
The i2b2 dataset contains 1,304 longitudinal medical records that describe 296 patients. This approach allows us to measure memorization on sensitive data that we explicitly want to protect, while most previous
studics mcasure memorization on randomly-generated sequences (Carlini et al. 2019 Thakkar et al. 2021
or indiscriminately on the whole dataset (Wang & Li 2025 Biderman et al., 2024 Hans et al. 2024
Nasr
et al. 2025) possibly confounding the memorization necessary for downstream performance Feldman
2020
Bocause data duplication has been shown to greatly influence memorization (Carlini et al., 2023b Lee et al. 2022 Kandpal et al.] 2022), we randomly select 30% of the medical records and duplicate them tenfold within our fine-tuning data in order to study the effect of data duplication in our experiments. We also experiment with a lower duplication rate of 3 in Appendix C and found consistent results. Following Carlini et al. (023b)
Carlini et 2023a found that beam search yields slightly higher memorization values. We use greedy decoding for the
sake of simplicity.
4

---

Published in Transactions on Machine Learning Research (02/2026)
measure the effect of the context size by prompting the model each test sequence with prompts of lengths in {10, 50, 100, 200, 500). The different prompis for a given test sequence are constructed such that the suffix is kept identical while varying the prompt length. This ensures fair comparison between prompt lengths, since different sufixees may be more or less prone to regurgitation.
Memorization scores. To compare generated text with the ground truth, we rely on two metrics: (1) the exact token match rate and (2) the BLEU score, measure approximate reproduction, as prior work suggests that the exact match rate does not capture subtler forms of memorization (Ippolito et al. 2023 In line with this work, we consider sequence memorized if the generated suffix and the ground truth yield BLEU score > 0.75. For both metrics, lower is better, and a score of 1 denotes complete memorization of all (est sequences. We additionally report BERTScore (Zhang et al. 2020) in Appendix C to measure semantic similarity between model outputs and reference sequences and we find trends consistent with the aforementioned metrics.
No duplication
Documents duplicated 10x
1.2
Memorization Scores
1.0
0.8
0.6
0.4
BLEU score
0.2
Exact match rate
Full memorization
0.0
0
100
200
300
400
500
0
100
200
300
400
500
Prompt length
Prompt length
Figure 1: Sensitive medical information memorization of the full fine-tuning of Llama 2 7B in centralized learning. We report the exact match rate and BLEU score with respect. to the prompt length, with and without duplication. We also show the memorization upper bound (labeled "Full memorization" ") that is reached when every test soquence has been memorized. Most settings show signs of regurgitation yet duplicated documents present an alarming rate of memorization.
To illustrate our method, Figure D shows the memorization of the Llama 7B full fine-tuning. Multiple trends consistent with previous work: (1) there is significantly more memorization when the medical records occur multiple times in the fine-tuning data (Lee et al. 2022 Kandpal et al. 2022 Carlini et al. 2023b;; (2) longer prompts show higher memorization (the so-called 'discoverability phenomenon' ) (Carlini et al. 2023b) and (3) there is significantly more memorization with approximate generation (BLEU score)
Ippolito et al. 2023
Accuracy. We report the downstream accuracy in Appendix to ensure fair comparison between fine- tuning methods and ensure that potential privacy gains do not come the expense of decreased performance. Figure 0 shows that all fine-tuned models yield relatively similar accuracy values when comparing LoRA to full fine-tuning. This result suggests that in our setting, LoRA is competitive technique and may substitute full fine-tuning at relatively little cost.
3.2 Experimental Setup
Datasets and models. We fine-tune LLMs three medical QA datasets (MedMCQA, PubMedQA. and Medical Meadow Flashcards) augmented with sensitive sequences from the i2b2 clinical notes (Stubbs & Özlem Uxuner 2015). Evaluation is performed on a suite of medical benchmarks including MedQA, PubMedQA, MedMCQA, and MMLU-Medical (Pal et al.) 2022 Jin et al.) 2019 Han et al.) 2023). Full descriptions of datasots, pre-trained models, and licensing terms are provided in Appendix E In Appendix C we confirm that our findings generalize to other high-risk domains such as law
and finance (ConvFinQA) (Shen al. 2022 Cheng et al. 2024) and to larger model scale of 70B.
5

---

Published in Transactions on Machine Learning Research (02/2026)
Exact match rate document duplication
BLEU score c) 10x document
10x document dupl cation prompt length 500 tokens
10x document duplication
No duplication
Nemorttztti wowoorttttoogoo Stores
duplication
duppical
prompr length
9.06
140
Merroizztion
66
0.06
4.5
5.10
250
5008
02
025
2000
Liena 10:30
Liana 7B
Maraaloo 28
Liame 12:38
Liema 3.338
Liama 2:78
Munrakop 3-78
Uienn 1.2-10
Liana 3B
Limn 1B
Muarat 3:78
Liana 2.19
Natralog 3.78
Lieaa Sim.3.2..
Lianta 22238
Liane 2-18
Hatre 3.
Uieaa 3 2-10
2.0
Liam up
Lumn 2-78
Histral-0..3 5-78
Laane
Usmee
Full fine-tuning
LORA
Figure 2: LoRA vs. full fine-tuning in federated learning. LoRA results in lower unintended memorization than full fine-tuning in FL across all settings. (a)-(c): Exact match rate under increasing duplication and prompt length. (d)-(f): BLEU score under the same scttings. The memorization scores are averaged across the 5 different prompt lengths (from 10 tokens to 500 lokens). (c) and (d) show our worst case setting by using the highest prompt length (500 tokens) and a duplication rate of 10. As control, we evaluated the memorization scores before finc-tuning and found values lower than 0.0006 for the exact match rate (i.e.less 0.06% of the lested sequences resulted in a verbatim regurgitation) and BLEU scores lower than 0.003.
Cross-silo FL. We fine-tuned models with three participants, where each participant trained locally of the three datasets MedMCQA, PubMedQA, and Medical Meadow Flashcards in heterogeneous data distribution. Previous work showed the effectiveness of non-llD data at mitigating unintended memorization (hakkar et al.) 2021), therefore adopting a heterogencous sctting is a memorization-wiss best-case scenario compared to an IID selting. We split and injected i2b2 medical records into each datasel proportionally to their size. Participants fine-tuned over their local dataset for one epoch between each global weight update, for a total of five rounds. For every model, we tuned the learning rate separately on each local dataset. To better understand the privacy impact of FL itself, we compared the same experiments in conventional centralized learning in Section 4.1 where all training samples were processed by single participant.
All experiments were performed on a single NVIDIA A100 80GB GPU within an HPC cluster, except for the 70B- BBB-paraeeter model, which was fine-tuned using eight H100 GPUs. We leveraged Hugging Face's Transformers library (Wolf et al. 2020) to access and fine-tune tune pre-trained models. Further training details are included in Appendix D
4 Results
Figure 2 compares the impact on memorization of replacing full fine-tuning by LoRA in FL. Fine-tuning federated LLMs with LoRA results in lower unintended memorization than full fine-tuning across all metrics and models. In our experiments, LoRA fine-tuning reduced memorization up to 10x for negligible accuracy loss, as shown in Figure
Notably, data duplication and longer prompt lengths greatly increases unintended memorization, extending these trends from CT. (Lee et al. 2022 Carlini et al., 2023a bb to FL. Also in line with previous work, smaller models exhibit less memorization than larger ones, though we found that Llama 7B and Mistral v0.3 7B showed different memorization dynamics despite having the same size. For example, fine-tuning Llama 2 7B with LoRA show drastic memorization improvement over full fine-tuning, whereas LoRA has lower impact with Mistral v0.3 7B. Conversely, Llama 2 7B displays higher memorization rate than Mistral v0.3 7B in full fine-tuning. We discuss this result further in the Section by comparing FL and CL results.
Additionally, we found that full fne-tuning in FL still results in alarmingly high rates memorization despite the privacy-cnhancio propertics of FL. observed by Thakkar et al.) (2021). This result emphasizes the limits of FL as a privacy-preserving method. Furthermore, even LoRA exhibits some levels of memorization, despite being lower, thus showing the need for additional privacy-preserving techniques.
6

---

Published in Transactions on Machine Learning Research (02/2026)
Exact match rate DJ 10x decument duplication
BLEU score 10x derument duplication
cl decument duplication prompt 500 tokens
10x decument duplication 500
duplication
Memor Dabtor Scoros
di duplication
0.0000
BG
50075
2.00
6.5
350
60025
125
0.00
425
Lame: 10
50000
Liamo
Uiema 2-78
Mbsor Maaaraly:.3331 7B
Liama 322.0
60
Liamer 30
Uieee-33p
Laans 1B
1.0
Liame 20
Liema 2:70
Ulmaa
10.00
Uammd33 2-30
Llane-2-10
Ulaaa 3:2-0
Uam 2:30
Llans-2-30
Hesrol-B-3 3-78
Ulena 2-18
3.00
Lian
Llana
Hatroled 3-79
Full tunin
LORA
Figure 3: LoRA vs. full fine-tuning in centralized learning. LoRA consistently reduces unintended memorization compared to full fine-tuning. (a)-(c): Exact match rate under increasing duplication and prompt length. (d) (f): BLEU score under the same settings. We obtained pre-fine-tuning controls scores an order of magnitude lower than any fine-tuned model score, which additionally confirms that none of the models had already been trained on the i2b2 dataset. While some scores appear low at first glance, the lowest memorization depicted in this figure remains >0 times higher than the control.
To provide fair comparisons between multiple federated learning fine-tuning, Figure reports last federated round. This ensures that number of times. We discuss this decision further in Appendix B
reports metrics for the each model has been fine-tuned on the medical records the same
4.1 LoRA in FL vs CL
To differentiate the effects of LoRA and FL on memorization, we carried out the same experiments in centralized learning. In the CL setting, merged PubMedQA, MedMCQA and Medical Meadow Flashcards into one fine-tuning dataset, in which we injected the i2b2 medical records to benchmark memorization after fine-tuning. We used a validation split of 10% and for each model we searched for the learning rate yielding the lowest validation loss. More details on hyperparameters can be found in Appendix D
Figure 3 shows that models fine-tuned in CL with LoRA consistently exhibits lower memorization scores than full fine-tuning, suggesting the adequacy of using LoRA memorization meemorzation-mittiaaann technique in both FL and CL. Across all model sizes, data duplication and longer prompt lengths greatly increase memorization. The figure also illustrates that larger models memorize more (Carlini et al. 2023b Tirumala eet al. 2022). Contrary to our results, Wang & Li (2025) found that larger models and data duplication in CL did not affect memorization LoRA fine-tuning, with memorization scores remaining near zero for all settings while full fine-tuning memorization was increasing. We suggest that ncar-zero memorization can rcsult from the small scale of GPT-2 models, and that memorization may appear only above a certain model size. fact, the two trends do appear when they relax their definition of memorization, resulting in Llama 3 1B and 8B showing non-trivial memorization with LoRA.
Comparing memorization scores between Figure 2 and 8 we found that FL itself enhances privacy by reducing memorization compared to CL. for given fine-tuning method. This is consistent with previous work by Thakkar et al.] (2021) who suggested that FedAvg and a non-lID data distribution contribute to reducing unintended memorization. Furthermore, we found that not all trends observed in FL hold in CL. On the one hand, data duplication, longer context and considering paraphrasing all yield higher memorization scores for FL as for CL, on the other hand, Figure 2 shows that larger models do not necessarily result in more memorization with full fine-tuning in FL, as Llama 3.2 1B reached higher memorization scores than Llama 3.2 3B. This difference may stem from FL using separate learning rates for each local model, and thus each data source, while in centralized learning a single learning rate is used (since all datasets are merged into onc). This finer-grained adaptation in FL, particularly in the non-lID setting where clients train on domain-specific data, can also explain the slightly higher memorization observed when training Llama 2 7B with FL compared to CL.
Interestingly, as in FL, LoRA is less effective at reducing memorization for Mistral v0.3 7B than for Llama 2 7B in CL well. We hypothesize that architectural features may cause different memorization dynamics.
7

---

Published in Transactions on Machine Learning Research (02/2026)
Notably, Mistral v0.3 leverages sliding window attention (Beltagy et al. 2020) with Srouped-Query Attention (Ainslie et al., 2023) while Llama 2 7B uses a regular multi-head attention. We leave further analysis of the impact of architectural components on unintended memorization for future work.
To better understand the memorization dynamics in FL, we measured memorization with LoRA and full fine-tuning with respect to federated rounds, as shown in Figure + As expected, we found that memorization in FL increases monotonically with the number of rounds (which corresponds to the number of times medical records seen). Throughout the rounds, exceptions where LoRA starts with slightly higher memorization in the first second round. The choice of the number of rounds is thus critical, and we show in Table that full fine-tuning reached its bost downstream accuracy in the last two rounds, where the memorization gap wetween LoRA and full fine-tunin tuning is the greatest. In other words, LoRA most effective at reducing memorization where the models are most performant.
that LoRA memorizes less than full fine-tuning, with
Exact match with duplication
Exact match rate with 10x duplication
BLEU score with duplication
BLEU
with 10x duplication
LIama-3.2-1B
0.025
0.001
0.1
0.2
0.015
0.000
0.010
2
2
3
Llama-3.2-3B
0.030
0.002
0.025
0.001
0.020
0.015
0.000
0.0
2
2
3
Llama-2-7B
0.6
0.01
0.4
0.08
0.4
0.04
0.2
0.02
0.0
2
2
3
Mistral-v0.3-7B
0.006
0.004
0.4
0.04
0.000
0.0
2
2
Rounds
Rounds
Rounds
Rounds
Full fine-tuning
LoRA
Figure 4: Memorization evolution throughout the federated learning rounds. The FL. memorization values found in Figure ? are the values at the last round in this Figure.
To summarize our results, we found that combining LoRA with FL synergistically mitigates unin- tended memorization across varying model sizes and duplication rates. Furthermore, we show in Appendix C that these results generalize to other domains such as law and finance, to lower duplication rates, as well as to larger models such as Llama 3.1 70B in CL. Future work necessary understand differing memorization dynamics between similarly-sized models, for example by exploring the effects of differing attention mechanisms.

---

Published in Transactions on Machine Learning Research (02/2026)
4.2
The privacy-utility tradeoff
Llama 3.2, 3B, Base model
Llama 3.2, 3B, LoRA
Llama 3.2, 3B, Full FT
200
2100
0.550
480
151200
300
6007
0.525
900
Accuracy
1.50 300
0.500
0.475
0.450
0.425
0.001
0.005
0.01
0.05
0.1
0.5
Memorization (BLEU score)
Figure 5: Accuracy vs. privacy across finc-tuning steps. We tracked the accuracy and memorization (BLEU) during the Llama 3.2 3B fine-tuning (10x duplication) using full fine-tuning (Full FT) and LoRA, compared to the base model. Numbers above points indicate completed fine-tuning steps.
To assess whether the privacy gains resulting from replacing full fine-tuning with LoRA due to overfitting and is preventable by early stopping, analyzed the cullity-rrvvacy tradeoff throughout the CL fine-tuning steps. Comparing utility and privacy with respect to training steps further allows us to assess whether the privacy gains observed when training models with LoRA and CL come at the cost of utility. Figure 5 illustrates the evolution of the privacy and utility for Llama 3.2 3B for LoRA and full fine-tuning. The figure shows that LoRA consistently follows a more privacy-preservie throughout the training steps, with lower memorization scores at similar utility levels. Furthermore, after certain number of fine-tuning steps, the model's tendency to memorize data increases without significant. improvements in utility, due to overfitting. This highlights that early stopping during LLM training not only improves efficiency, but also reduces the risk of memorization.
trend than full fine-tuning
Importantly, LoRA even achieves slightly better peak accuracy than full fine-tuning. This can stem from LoRA's 's inherent resistance to overfitting, as restricting updates to a low-rank subspace acts as a form of regularization (Biderman et al.) 2024). In contrast, full fine-tuning begins to overfit after several hundred steps, which limits its attainable accuracy, Additional regularization could likely improve full fine-tuning.
4.3 The LoRA rank and memorization
We further investigated how LoRA's 's configuration influences unintended memorization. Specifically, we varied the LoRA rank measure its influence on memorization, studying values E {4, 16, 64, 128, 256, 1024). The scaling factor set to twice the rank, as recommended by [iderman et al. (2024), and the learning rate is decreased exponentially the rank increases. We applied LoRA adapters to all layers, following Biderman
ct al. 2023) and Schulman & Lab 2025)).
As shown in Table 1 increasing the rank i.e. increasing the number of weights updated during fine-tuning results in more memorization, ranging from virtually no memorization with a rank 4 to almost 50% of the modical records being memorized for rank 1024 when considering duplicated medical records. These results are consistent with Wang & Li (2025) and extend their conclusions to larger model than GPT-2. Note that in case, the highest rank did not yield the best accuracy. We further note that for most ranks,
9

---

Published in Transactions on Machine Learning Research (02/2026)
Table 1: Impact of the LoRA rank on memorization. We fine-tuned Llama 3.2 3B with LoRA centralized learning on increasing LoRA ranks. Higher ranks lead to more memorization but not necessarily better accuracy. The lower memorization scores and the highest accuracy are emphasized in bold.
Exact match rate
BLEU score
LoRA rank
Accuracy
No duplication 10x duplication
No duplication
10x duplication
0.0003
0
0.0133
0.0198
0.509
16
0.0005
0.0031
0.0167
0.0623
0.512
64
0.0031
0,2105
0.0258
0.379
0.511
128
0.0042
0.3735
0.0305
0.5111
0.510
256
0.0057
0.4895
0.0352
0.5809
0.542
1024
0.0063
0.4981
0.0409
0.6228
0.530
suboptimal learning rates can lead to relatively significant memorization with LoRA, though still lower than for full fine-tuning, highlighting the need for careful hyperparameter tuning.
4.4 Combining LoRA with other privacy-enhancing methods
Although LoRA mitigates unintended memorization on its own, we investigated whether can be combined with other privacy-presse preserving techniques without compromising performance increasing memorization. In this section, outline the different techniques evaluated, while detailed descriptions of each are provided in Appendices F
and J
Goldfish loss. If users are focused on reducing extractable memorization in pretraining, then they may be interested in Goldfish loss, while LoRA used for fine-tuning. However, we investigated its potential for fine-tuning in combination with LoRA in Appendix F and show that the combination of LoRA with Goldfish loss synergistically achieves lower memorization beyond what either strategy achieves alone.
NEFTune. We examine NEFTune in Appendix G noise-enhanced fine-tuning approach designed to improve robustness and reduce overfitting. While not a Seivacy-preserving method per se, we hypothesized that noise addition could induce some memorization reduction. In practice, we found that combining NEFTune with LoRA fine-tuning does not further decrcase the memorization and fact does not improve the performance either, the highest accuracy being reached without any noise. We hypothesize that. NEFTune's noise addition is superfluous when combined to LoRA's regularization properties that we discuss in Section 5
discuss the challenges of applying differential privacy (DP) in our federated setting and the alternative approaches we explored. DP is well-established technique that provides formal guarantees to protect individual data from being inferred through the model's output. However, integrating DP into our setup requires significant modifications to our training pipcline that are beyond the scope of this work. Nevertheless, we show that applying gradient clipping without noise addition improves both accuracy and reduces memorization during fine-tuning, albeit without formal privacy guarantees. Furthermore, show in Appendix that injecting random Gaussian noise into the model weights trade-off.
Differential Privacy. In Appendix
does not improve the
Secure Aggregation. While we observed lower memorization in FI. compared to CL (sce Section locally trained models transmitted during FL may still expose participant data if not properly protected. In Appendix J we present experiments using a secure aggregation protocol combining Fully Homomorphic Encryption (FHE) and Secure Multiparty Computation (SMPC). We find that this approach effectively mitigates privacy risks in the foderated sctting while introducing only nogligible computational overhcad.
5 Potential Theoretical Explanations
LoRA's cemorizationnmiiigataaen effect remains largely empirical and lacks theoretical foundation. Here, discuss several works that present. theoretical explanations as potential directions for future work. We
10

---

Published in Transactions on Machine Learning Research (02/2026)
address additional theoretical work on the impact of FedAvg and similarities to d-compression operators in Appendix K
LoRA as regularization. Biderman et al. (2024) presents LoRA as a competitive regularization method, and compares it to traditional regularization techniques. They find that LoRA retains more factual knowledge from its pretraining than fine-tuning with attention dropout or weight decay, and also keeps a better diversity of token generation than full fine-tuning. Indeed, our experiments show that LoRA is a competitive alternative to full fine-tuning for our medium-sized datasets, sometimes even slightly outperforming full fine-tuning. Furthermore, found that combining LoRA with NEFTune, noise- noise-based based regularization technique, does not lead to further improvement, suggesting a potential redundancy of regularization.
If we regard memorization as a function of duplication-induun LoRA sine-tunig coupled with significantly lowered memorization may signal a reduction in benign-overfitting [Bartlett et al., (020). That is, while full fine-tuning does not significantly alter model performance, the usage of full gradients may result in training overfitting without affecting generalization. As our gradients VW are low-rank, from principal component analysis (PCA) perspective, excluding minor singular vectors in an update may reduce overfitting onto training data, Indeed, (Biderman et al.
overfitting, the preserved model accuracy of
2024) shows that full-fnetuming learns updates with ranks 10 - -000 larger than LoRA and Zeng & Lee 20024 formally and empirically show that any Transformer model with hidden dimension d can be well-approximated with a LoRA rank of d/2. Thus, it is possible that LoRA reduces benign overfitting (Bartlett et al.
2020j, which occurs when
(2023a) prove that benign overfitting can preserve out-of distribution generalization for overparameterized linear models if there is a strong correlation between the dominant eigenvectors/ comppoooons/oooonnnnntso of the source and target distributions. It. is possible then that our LLMs are displaying this phenomenon: in both the centralized and FL settings, our fine-tuning datasets, while heterogeneous, contain aligned components due to their shared domain. LoRA may reduce benign overfitting by ignoring minor components, which only explain minimal (and possibly noisy) portion of the data covariance.
training data is overfitted without affecting performance. Notably, Tang et al.
LoRA as DP-SGD. Recent work by Malekmohammadii & Farnadi (2025) establishes a theoretical and empirical relationship between LoRA training and the DP-SGD algorithm. LoRA shown to be approximately equivalent to fine-tuning adapters with noisy batch gradients, where the noise variance is docrcasing function of the LoRA rank. Indeed, we found that reducing the LoRA rank reduces unintended memorization, although at the cost of decreased performance, similarly to DP-SGD. Consequently, Malekmohammadi & Farnadi (2025) showed that LoRA provides additional robustness to membership inference attacks.
6 Conclusion and Limitations
In this work, we demonstrate that LoRA in FL is capable of reducing memorization of fine-tuning sensitive training data with little to no downstream performance cost. In particular, this effect is also observable in both centralized learning, and we analyze how memorization patterns differ between the two. Moreover, it is possible to further reduce memorization by combining LoRA with ot strategies such as Goldfish loss or conventional privacy-preserving mechanisms such as Gaussian noising and gradient clipping.
Our study is limited to cross-silo settings with few clients, and further work is needed to analyze whether our findings generalize to large-scale cross-device settings. Additionally, further research on a theoretical explanation of our results neoded as well, and we discussed existing work and hypotheses for future directions in Section 5 and Appendix K such as reduction of benign overfitting (Bartlett et al. 2020), similarities between LoRA and DP-SGD [Malekmohammadi & Farnadi 2025), and connections to d-compression operators Karimireddy et al. 2019).
While we found significant memorization reduction in our study, LoRA and FL does not completely eliminate unintended memorization, even when combined with other privacy-enhancin techniques. As argued by solution to rely
Brown et al. (2022) in the context of LLM training. the only truly privacy-preservin exclusively on data that is intended to be public and LoRA should not be considered a panacea for unintended memorization, but rather privacy-wise improvement over full fine-tuning.
11

---

Published in Transactions on Machine Learning Research (02/2026)
Broader Impact Statement
This paper presents work whose goal to advance the field of Machine Learning, especially enhancing privacy. Among the many potential societal consequences of our work, we specifically acknowledge that. techniques mitigating unintended memorization can incidentally facilitate the concealment of unlawful use of copyrighted data by preventing its regurgitation post-training. However, we believe that the benefit of enhanced safeguards for confidential data protection combined with the current advances of other methods such as watermarking (Li et al. 2023a Tang et al. 2023b Cui et al. 2024b can effectively mitigate this risk and provide stronger overall data protection.
Acknowledgments
This research is conducted part of an Innovation Project supported by Innosuisse. The authors gratefully acknowledge financial support from Innosuisse under the Innovation Projects with Implementation Partner funding scheme. Additional support was provided by the European Union within the framework of the Phase IV AI Project.
References
Martin Abadi, Andy Chu, lan Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM STGSAC conference on computer and commumications security, pp. 308 318, 2016.
Armen Aghajanyan, Luke Zettlemoyer, and Sonal Gupta. Intrinsic dimensionality explains the effectiveness of language model fine-tuning. 2020. URL
http:///aaxxvv.o/aa//////ss 13255
Joshua Ainslie, James Lee-Thorp, Michiel de Jong, Yury Zemlyanskiy, Federico Lebrón, and Sumit Sanghai. Gqa: Training generalized multi-query transformer models from multi-head chockpoints, 2023. URL
http:s//aaxxv..org//b/////3//// 13245
Rodolfo Stoffel Antunes, Cristiano André da Costa, Arne Küderle, Imrana Abdullahi Yari, and Björn Eskofier. Federated learning for healthcare: Systematic review and architecture proposal. ACM Transactions on Intelligent Systems and Technology (TIST), 13(4):1 23, 2022.
Peter I. Bartlett, Philip M Long, Gábor Lugosi, and Alexander Tsigler. Benign overfitting in linear regression. Proceedings of the National Academy of Sciences, 117((8):30063 30070, 2020.
Iz Beltagy, Matthew Peters, and Arman Cohan. Longformer: The long- documeet transformer, 2020. URL https://arxi:: wwtp:/wwwwrrr/////00...... 05150
Jeremy Bernstein, Yu-Xiang Wang, Kamyar Azizadenesheli, and Animashree Anandkumar. signsgd:
Compressed optimisation for non-convex problems. In International Conference on Machine Learning, pp. 560-569. PMLR, 2018.
Dan Biderman, Jacob Portes, Jose Javier Gonzalez Ortiz, Manshocj Paul, Philip Greengard, Connor Jennings, Daniel King, Sam Havens, Vitaliy Chiley, Jonathan Frankle, Cody Blakeney, and John P. Cunningham. Lora learns less and forgets less, 2024. URL https: wttp://rr/wbb///..00/0070
Stella Biderman, USVSN Sai Prashanth, Lintang Sutawika, Hailcy Schoelkopf, Quentin Authony, Shivanshu Purohit, and Edward Raff. Emeegeet and predictable memorization large language models, 2023. URL
/ttps://arxiv. http://rrxiv.oorabbba///sa hbwp//bb//304..... 11158
Hannah Brown, Katherine Lee, Fatemehsadat Mireshghallah, Reza Shokri, and Florian Tramer. What does it mean for a language model to preserve privacy? Proceedings of the 2022 ACM conference on fairness, accourdabilily, and transporency, pp. 2280 2292, 2022.
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The sccret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pp. 267-267120 284, 2019.
12

---

Published in Transactions on Machine Learning Research (02/2026)
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models, 2023a. URL https://arxxiv.orggg aba// aba/2202 2202 07646
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang Quantifying memorization across neural language models, 2023b. URL https:
aerg/abs/2200 2202
07646
Zeming Chen, Alejandro Hernández Cano, Angelika Romanou, Antoine Bonnet, Kyle Matoba, Francesco Salvi, Matteo Pagliardini, Simin Fan, Andreas Köpf, Amirkeivan Mohtashami, Alexandre Sallinen, Alireza Sakhaeirad, Vinitra Swamy, Igor Krawczuk, Deniz Bayazit, Axel Marmet, Syrielle Montariol, Mary-Anne Hartley, Martin Jaggi, and Antoine Bosselut. Meditron-70b. Scaling medical pretraining for large language models, 2023. URL httph: .rgg abs/aaaa..1..11 16079
Daixuan Cheng, Shaohan Huang, and Furu Wei. Adapting large language models to domains via reading comprehension. arXiv preprint arXiv:2309. 09530, 2024.
Jiaxi Cui, Munan Ning, Zongjian Li, Bohua Chen, Yang Yan, Hao Li, Bin Ling, Yonghong Tian, and Li Yuan. Chatlaw: multi-agent collaborative legal assistant with knowledge graph enhanced mixture-of-experts large language model, 2024a. URL htttps//arxiv..oo wwgg/ba////a..aae/. 2atp:/2220..1002222
Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. Diffusionshield: A watermark for copyright protection against generative diffusion models, 2024b. URL /https///axxiv org/ aaaaaba//// /a0b///230...2 220/204002002222
Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke ZeWlemoyer. Qlora: Efficient finetuning of quantized 1lms. Advances in Neural Information Processing Systems, 36, 2024.
Ron Dorfman, Shay Vargaftik, Yaniv Ben-Itzhak, and Kfir Yehuda Levy. Docoft: Downlink compression for cross-device federated learning, In International Conference Machine Learning, pp. 8356 8388. PMLR, 2023.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arxiv:2477.3 2178, 2024.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pp. 265 284. Springer, 2006.
Bryn Elesedy and Mareus Hutter. U-clip: On-average unbiased stochastic gradient clipping. arXiv preprint 022771,0 2023.
Vitaly Feldman. Does learning require memorization? short tale about long tail. In Proceedings of the 52nd Anneual ACM SIGACT Symposium on Theory of Computing, pp. 954 959, 2020.
Tianyu Han, Lisa C. Adams,
Papaioannou, Paul Grundmann, Tom Oberhauser, Alexander Löser, Daniel Truhn, and Keno K. Bressem. Medalpaca an open-source collection of medical conversational ai models and training data, 2023. URL
08247
Abhimanyu Hans, Yuxin Wen, Neel Jain, John Kirchenbauer, Hamid Kazemi, Prajwal Singhania, Siddharth Singh, Gowthami Somepalli, Jonas Geiping, Abhinav Bhatele, et al. Be like a goldfish, don't memorize! mitigating memorization in generative 1mss. arXiv preprint arXiv:2406. 10209, 2024.
Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Frangoise Beaufays, Scan Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. Federated learning for mobile keyboard prediction. Xix preprint ar Xrv: 1811 03604, 2019.
13

---

Published in Transactions on Machine Learning Research (02/2026)
Jamie Hayes, Marika Swanberg, Harsh Chaudhari, Itay Yona, Ilia Shumailov, Milad Nasr, Christopher A. Choquette-hhoo, Katherine Lee, and A. Feder Cooper. Measuring memorization in language models via probabilistic extraction. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 9266 9266-9291, Albuquuerqee, New Mexico, April 2025. Association for Computational Linguistics. ISBN 979-8- 89176-189-4 1011081633/112222555 naw.l-ooaaalloon 469. URL https::/accaatthologgg 2tt.://oaaaaooooooooo///0//225 wwwp::/..rr./....aaaaaaaaaaae- naacl-long
469/
Paul M Heider, Jihad S Obeid, and Stéphane M Meystre. A comparative analysis of speed and accuracy for three off-tho-shelf DE-identification tools. AMIA Summits Transl. Sci. Proc., 2020, 2020.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding, 2021. URL htap:::///axxi.og//bbbas../ 00300000000000000
Chang Hongyan, Shahin Shamsabadi Ali, Katevas Kleomenis, Haddadi Hamed, and Shokri Reza. Context-aware membership inference attacks against pre-trained large language models. arXiv preprint arXiv:2400.19745 18745, 2024. URL attps://arxiv.orgg orgg////2////// 13745
Jie Hou, Chuxiong Wu, Lannan Luo, and Qiang Zeng. Impact of fine-tuning methods on memorization in large language models, 2025. URL https://arxiv.orrr org/
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. CoRR,
2021. URL
https: //c///arst aaaaaaxxvvv....aaaaaave awrevv.org/ab///220 2106. 216820968666666
Chao Huang, Jianwei Huang, and Xin Liu. Cross-silo federated learning: Challenges and opportunities, 2022.
URL http:///axxxvv.../bb/a/ .2299991
Jing Huang, Diyi Yang, and Christopher Potts. Demystifying verbatim memorization in large language models, 2024. URL https::/arx.v..rrg//aaaa
17817
Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and defenses in federated learning. Advances in neural information processing systems, 34:7232-722 -2411, 2021.
Daphne Ippolito, Florian Tramer, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christo- pher A. Choquette-Chon Choo, and Nicholas Carlini. Preventing verbatim memorization in language models gives false sense of privacy, 2023. URL https://arxii: http:////wwwww.o//aa////////////
bbgg/bbs//i/ 17546
Nikita Ivkin, Daniel Rothchild, Enayat Ullah, Ion Stoica, Raman Arora, et al. Communicttion-cffiicnn distributed sgd with sketching. Advances in Neural Information Processing Systems, 32, 2019.
Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, et al. Measuring forgetting of memorized training examples. arXiv preprint FTf::2277000099 2022.
Matthew Jagiclski, Om Thakkar, Florian Tramèr, Daphne Ippolito, Katherine Leo, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradoep Thakurta, Nicolas Papernot, and Chiyuan Zhang. Measuring forgetting of memorized training examples, 2023. URL https://arxiv..e org/
00099
Bargav Jayaraman and David Evans. Evaluating differentially private machine learning in practice. 28th USENIX Security Symposium (USENIX Security 19), pp. 1895-1912, 2019.
Albert Q, Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Remard Lavaud, Marie-Anee Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL https://arxiv.orrt http://w..or/abbb/1..ooooo
Di Jin, Eileen Pan, Nassim Oufattole, Wei-Hung Weng, Hanyi Fang, and Peter Szolovits. What discase does this patient have? a large-scale open domain question answering dataset from medical exams, 2020. URL https:// / http://axxxvv.oo/aa//////o/ wwtp:orr/////...aaa//
14

---

Published in Transactions on Machine Learning Research (02/2026)
Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. PubMedQA: A dataset for biomedical research question answering. In Kentaro Tnui, Jing Jiang, Vincent Ng, and Xiaojun Wan (eds.), Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 2567-2577, Hong Kong, China, November 2019. Association for Computational Linguistics. doi https: https///ccaanhooog.orr//////////
URL
1259
Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and trends@ in machine learning, 14(1-2):1-210) 2021.
Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models, 2022. URL
Sai Pranecth Karimireddy, Quentin Rebjock, Sebastian Stich, and Martin Jaggi. Error feodback fixes signsgd and other gradient compression schemes. In International Conference on Machine Learning, pp. 3252 3261. PMLR, 2019.
Jacob Devlin Ming- Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of na.cI--H.T, volume 1, pp. 2. Minncapolis, Minnesota, 2019.
Weirui Kuang, Bingchen Qian, Zitao Li, Daoyuan Chen, Dawei Gao, Xuchen Pan, Yuexiang Xie, Yaliang Li, Bolin Ding, and Jingren Zhou. Federatedscope-llm: A comprehensive package for fine-tuning large language models in federated learning, 2023. URL
Bogdan Kulynych, Hsiang Hsu, Carmela Troncoso, and Flavio Calmon. Arbitrary decisions are a hidden cost. of differentially private training. In Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transporency, pp. 1609 1620,163,--100 2023.
Mostafa Langarizadeh, Azam Orooji, and Abbas Sheikhtaheri. Effectiveness of anonymization methods in preserving patients' privacy: A systematic literature review. Stud. Health Technol. Inform., 248, 2018.
Lattigo v6. Lattigo open-source repository. Online: http:://ggtaahcccc////umsnssssss August 2024. EPFL-LDS, Tune Insight SA.
Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Gallison-Burch and Nicholas Carlini. Deduplicating training data makes language models better, 2022. URL https:
// //arxiv. atriv..orr/bb///10/ 06499
Eric Lehman, Sarthak Jain, Karl Pichotta, Yoav Goldberg, and Byron C Wallace. Does bert pretrained on clinical notes reveal sensitive data? arXiv preprint arXiv:2104.07702, 2021.
Danny D. Leybzon and Corentin Kervadec. Learning, forgetting, remembering: Insights from tracking LLM memorization during training. In Yonalan Belinkov, Najoung Kim, Jaap Jumelet, Hosein Mohebbi, Aaron Mueller, and Hanjie Chen (eds.), Proceedings of the 7th BlackbozNLP Workshop: Analyzing and Interpreting Neural Networks for NLP, pp. 43-53 57,57, Miami, Florida, US, November 2024. Association for Computational Linguistics. 10. (018886531vv/0 2024. blackboxmlpp1.44/
URL https: hottat//aclanthoology.. org/
Chunyuan Li, Heerad Farkhoor, Rosanne Liu, and Jason Yosinski. Measuring the intrinsic dimension of objective landscapes, 2018. URL https://arxiv. oww/oogg////...o.o..oo
Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. arXiv preprint 0tl:::110000077. 2021.
Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black- box dataset ownership verification via backdoor watermarking, 2023a. URL https://aaxxz ab3//bb//22000 http://///aa...to///////////////
15

---

Published in Transactions on Machine Learning Research (02/2026)
Yinheng Li, Shaofei Wang, Han Ding, and Hang Chen. Large language models in finance: A survey. In Proceedings of the Sourth ACM international conference on AT in finance, pp. 974-382, 2023b.
Xiao-Yana Liu, Rongyi Zhu, Daochen Zha, Jiechao Gao, Shan Zhong, Matt White, and Meikang Qiu. Differ- entially private low-rank adaptation of large language model using federated learning. ACM Transactions Manegement Information Systems, 2024.
llya Loshchilov and Frank Hutter. Decoupled weight decay regularization, 2019. URL https://arxiv.org. 0ts/1711.05100
Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelig Analyzing leakage of personally identifiable information in language models. In 2023 IEEE Symposium on Security and Privacy (SP), pp. 346-363. 363. IEEE, 2023.
Ashok Vardhan Makkuva, Marco Bondaschi, Thijs Vogels, Martin Jaggi, Hyeji Kim, and Michael C Gastpar. Laser: Linear compression in wircless distributed optimization. arXiv preprint arXiv:2310. 13033, 2023.
Saber Malekmohammadi and Golnoosh Farnadi. Low-rank adaptation secretly imitates differentially private sgd, 2025. URL https: /tmp:s://axxi...o www.aaavvvvooo org/ absaaa/////// 2409 17538
Ryan McKenna, Yangsibo Huang, Amer Sinha, Borja Balle, Zachary Charles, Christopher A. Choquette-Choo, Badih Ghazi, George Kaissis, Ravi Kumar, Ruibo Liu, Da Yu, and Chiyuan Zhang. Scaling laws for differentially private language models, 2025. URL httts:://arrt
org/ aa///bba/22111 18914
H. B. McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agtera Arcas. Communication- efficient. learning of deep networks from decentralized data. In International Conference on Artificial Intelligence and Statistics, 2016. URL https://api http:///pppp.mmmtttcccccccoaorrs ortg/orppuID:149555.
sewanticscoollrr
Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg- Kinkpatrkk, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. arXiv preprint NNi:2203.03922 2022.
Christian Vincent
Mouchet, Jean-Philippe Bossuat, Juan Ramón Troncoso-Pastoriza, and Jean-Pierre Hubaux. Lattigo: A multiparty homomorphic encryption library in go. In 8th Workshop on Encrypted
Computing & Applied Homomorphic Cryptography (WAHC 2020), pp. 64-70, 2020. ISBN 978-3-000667-98-4 URL httts::/infoscienntt epfl. cht....chhaaaaa wcchhannle//// 500.. /a.0://////...00.44999999999 14229//994511
doi 1e.111...85//11 1010025833/00772900 00729999
Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagiclski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette- Choo,, Eric Wallace, Florian Tramèr, and Katherine Lee. Scalable extraction of training data from (production) language models. arXiu preprint ar ar NNv:2811.17000 1703,, 2023.
Milad Nasr, Javier Rando, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette-Chie Choo, Florian Tramer, and Katherine Lee. Scalable extraction of training data from aligned, production language models. In The Thirteenth International Conference Learning Representations, 2025. URL https://openreviee .ntt:/foruumiiddvveellll222
Dinh C Nguyen, Quoe-Vies Pham, Pubndu N Pathirana, Ming Ding, Aruna Seneviratne, Zihuai Lin, Octavia Dobre, and Won-Joo Hwang. Federated learning for smart healthcare: A survey. ACM Computing Surveys (Csur), 55(3):1337, 2022.
Ankit Pal, Logesh Kumar Umapathi, and Malaikannan Sankarasubbu. Medmeqa: large-scale multi-subject multi-choice dataset for medical domain question answcring. In Gerardo Flores, George Chen, Tom Pollard, Joyce C Ho, and Tristan Naumann (eds.). Proceedings of the Conference on Health, Inference, and Learning, volume 174 of Proceedings of Machine Learning Research, pp. 248-204820 260. PMIR, 07-08 Apr 2022. URL https::/ .mr............................. m....press/i1/4/pa22222 html
Jiaxing QI, Zhongzhi Luan, Shaohan Huang, Carol Fung, Hailong Yang, and Depei Qian. Fdlora: Personalized federated learning of large language model via dual lora tuning, 2024. URL https::/ http://xxxxvv.///.a//// org/abs/ abs/
16

---

Published in Transactions on Machine Learning Research (02/2026)
Tahseen Rabbani, Brandon Feng, Yifan Yang, Arjum Rajkumar, Amitabh Varshney, and Furong Huang. Comfetch: Federated learning of large networks on memory-coosttrineed clients via sketching. orv e-prints, pp. arXiv 2109, 2021.
Swaroop Ramaswamy, Om Thakkar, Rajiv Mathews, Galen Andrew, H Brendan McMahan, and Françoise Bea- ufays. Training production language modcls without memorizing user data. orXie preprint ar arXiv:2009.000: 2020.
John Schulman and Thinking Machines Lab. Lora without regret. Thinking Machines Lab: Connectionism, 2025. 16i10.64434/bml.22000 htt.://mmm.220/ 20250929 https//rtunkngguchineeaa////// ///oo///oa/////////////.////////
Zejiang Shen, Kyle Lo, Lauren Yu, Nathan Dahlberg, Margo Schlanger, and Doug Downey. Multi-lexsum: Real-world summaries of civil rights lawsuits at multiple gramularities. arXiv preprint orXiv:2206. 10883, 2022.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 3 18, Los Alamitos, CA, USA, May 2017. IEEE Computer Society. 1o1100.100/SPP2011..11 URL https: ; 2017. .41
1ttp///0.110//PPPPP. feeoopieeeccorttteroooeee....... ora.clettt..or.l// 10. 1109/SP
Karan Singhal, Shekoofeh Azizi, Tao Tu, S. Sara Mahdavi, Jason Wei, Hyung Won Chung, Nathan Scales, Ajay Tanwani, Heather Cole-Lewis, Stephen Pfohl, Perry Payne, Martin Seneviratne, Paul Gamble, Chris Kelly, Abubakr Babiker, Nathanael Schärli, Aakanksha Chowdhery, Philip Mansfield, Dina Demner-Fushman Blaise Agüera y Arcas, Dale Webster, Greg S. Corrado, Yossi Matias, Katherine Chou, Juraj Gottweis, Nenad Tomasov, Yun Liu, Alvin Rajkomar, Joolle Barral, Christopher Semturs, Alan Karthikesalingan, and Vivek Natarajan. Large language models encode clinical knowledge. Nature, 620(7972):172) 180, July 2023a. ISSN 1476-4687. 10::10.1088 (158868821185-0233 03221992222222
URL
Karan Singhal, Shekoofeh Azizi, Tao Tu, S Sara Mahdavi, Jason Wei, Hyung Won Chung, Nathan Scales, Ajay Tanwani, Heather Cole-Lewis, Stephen Pfohl, Perry Payne, Martin Seneviratne, Paul Gamble, Chris Kelly, Abubakr Babiker, Nathanael Schärli, Aakanksha Chowdhery, Philip Mansfield, Dina Demner-Fushman Blaise Agüera y Arcas, Dale Webster, Greg S Corrado, Yossi Matias, Katherine Chou, Juraj Gottweis, Nenad Tomasev, Yun Liu, Alvin Rajkomar, Joelle Barral, Christopher Semturs, Alan Karthikesalingam, and Vivek Natarajan. Large language models encode clinical knowledge. Nature, 620(7972): August 2023b.
Karan Singhal, Tao Tu, Juraj Gottweis, Rory Sayres, Ellery Wulczyn, Le Hou, Kevin Clark, Stephen Pfohl, Heather Cole-Lewis, Darlene Neal, Mike Schackermann, Amy Wang, Mohamed Amin, Sami Lachgar, Philip Mansfield, Sushant Prakash, Bradley Green, Ewa Dominowska, Blaise Aguera y Arcas, Nenad Tomasev, Yun Liu, Renee Wong, Christopher Semturs, S. Sara Mahdavi, Joelle Barral, Dale Webster, Greg S. Corrado, Yossi Matias, Shekoofeh Azizi, Alan Karthikesalingam, and Vivek Natarajan. Towards expert-level medical question answering with large language models, 2023c. URL
2305. 09617
Amber Stubbs and Öxlem Uzuner. Annolating longitudinal clinical narratives for de-identification: The 2014 22b2/uthealte corpus. Journal of Biomedical Informatics, 58:520 S29, 2015. ISSN 1532-0464 doi doihttss: /ttp:///o...r/111100//////// wit.:..ii..11....000 .20 http::tttts///tt www.weedieecccccccccm htt.ppge//ww..iiicccdrrrrt..
pp11/S152246415001822 Supplement: Proceedings of the 2014 htw.l//ccddrrct..cccc/ccceeeeeee wtt.//occc///eeeeeeeeeeeeeceesee cct/s/cieene//rrrccllle///////// article/ shop on Challenges Natural Language Processing for Clinical Data.
Shared-Tase and Work-
Youbang Sun, Zitao Li, Yaliang Li, and Bolin Ding. Improving lora in 2024. URL
federated learning,
Qiaoyue Tang, Frederick Shpilevskiy, and Mathias Lécuyer. Dp-adambe: Your dp-adam is actually dp-sgd (unless you apply bias correction), 2023a. URL https://arxiv.. wttp://.wwrr//aa///////// http:p/p//aarrrrooo///////....3 14333
Ruixiang Tang, Qizhang Feng, Ninghao Liu, Fan Yang, and Xia Hu. Did you train on my datasot? towards public dataset protection with clean-label backdoor watermarking, 2023b. URL htttps:// /tte://///xiv..a/.a org..bo../...
2303. 11470]
17

---

Published in Transactions on Machine Learning Research (02/2026)
Om Dipakbhai Thakkar, Swaroop Ramaswamy, Rajiv Mathews, and Francoise Beaufays. Understanding unintended memorization in language models under federated learning. In Oluwaseyi Feyisetan, Sepideh Ghanavati, Shervin Malmasi, and Patricia Thaine (eds.), Proceedings of the Third Workshop on Privacy in Natural Language Processing. pp. 1-10, Online, June 2021. Association for Computational Linguistics. wttp://tw.oooooooo///......aaaaa
10.160..653/ /0/5/3/v1/222/// www.02..piiattelp--.
URL
Arun James Thirmavukarası, Darren Shu Jeng Ting, Kabilan Elangovan, Laura Gutierrez, Ting Fang Tan, and Daniel Shu Wei Ting. Large language models in medicine. Nature medicine, 29(8):1930-19) 1940, 2023.
Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems, 35:38274 38290, 2022.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajiwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open foundation and fine-tuned chat models, 2023. URL. htttss///aastiii wtt.aaiwwwwaaaaaaaaaa/aaa
09288
Florian Tramèr, Gautam Kamath, and Nicholas Carlini. Position: Considerations for differentially private learning with large-scale public pretraining, 2024. URL ltttps://axxi...rr http////www..rr/////////////////
Sherri Truex, Nathalic Baracaldo, Anjum Anwar, et al. A hybrid approach to privacy-preserving federated learning. Informatik Spektrum, 42:356-385 357, October 2019. 00010010077/002844114111124 URL https: Published: 30 August 2019.
//doi.org/10. wtt.:///....00000000000011111111 10000000000087-00--000000
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need, 2023. URL http:///aaxii..orr/////////
Fei Wang and Baochun Li. Leaner training, lower leakage: Revisiting memorization in Ilm fine-tuning with lora, 2025. URL https://arxiv. wwwp:///0..////a//.../.2
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Thoest, and Alexander M. Rush. Huggingface's transformers: State-of-the-art natural language processing, 2020. URL https://arxix: org/abs/ 1tt.//91111.071117
Chaoyi Wu, Weixiong Lin, Xiaoman Zhang, Ya Zhang, Yanfeng Wang, and Weidi Xic. Pme-llama: Towards building open-source language models for medicine, 2023a. URL https://arxiv. hwtpg//bbs/33..... 14454
Panlong Wu, Kangshuo Li, Ting Wang, Yanjie Dong, Victor C. M. Leung, and Fangxin Wang. Fedfmsl: Federated learning of foundation models with sparsely activated lora. IEEE Transactions on Mobile Computing, 23(1):115167 1111111111111,,,,, 2024. 10010..109/IMC.2222.355.23
Shijie Wu, Ozan Irsoy, Steven Lu, Vadim Dabravolski, Mark Dredze, Sebastian Gehrmann, Prabhanjan Kambadur, David Rosenberg, and Gidcon Mann. Bloomberggpt: A large language model for finance. arXiv preprinl ar Xiv: 1o0e3.17560 17564, 2023b.
Jie Xu, Benjamin S Glicksberg, Chang Su, Peter Walker, Jiang Bian, and Fei Wang. Federated learning for healtheare informatics. Journal of healtheare informaties research, 5:1-19, 2021.
18

---

Published in Transactions on Machine Learning Research (02/2026)
Zheng Xu, Yanxiang Zhang, Galen Andrew, Christopher A. Choquette-Choo, Peter Kairouz, H. Brendan McMahan, Jesse Rosenstock, and Yuanbo Zhang. Federated learning of gboard language models with differential privacy, 2023. URL
18465
Xi Yang, Aokun Chen, Nima PourNejatian, Hoo Chang Shin, Kaleb E Smith, Christopher Parisien, Colin Compas, Cheryl Martin, Anthony B Costa, Mona G Flores, al. A large language model for electronic health records. NPJ digital medicine, 5(1):194, 2022.
Rui Ye, Wenhao Wang, Jingyi Chai, Dihan Li, Zexi Li, Yinda Xu, Yaxin Du, Yanfeng Wang, and Siheng Chen. Openfedllm: Training large language models decentralized private data via federated learning, 2024. URL httts:://axxt:i www..orgggbba...... abs/ 22002.042222224
Liping Yi, Han Yu, Gang Wang, Xiaoguang Liu, and Xiaoxiao Li. pfedlora: Model--ettrrggeeoon personalized 13283
federated learning with lora tuning, 2024. URL
Shenglai Zeng, Yaxin Li, Jie Ren, Yiding Liu, Han Xu, Pengfei He, Yue Xing, Shuaiqiang Wang, Jiliang Tang, and Dawei Yin. Exploring memorization in fine-tuned language models, 2024. URL https :
//arxiv.
Yuchen Zeng and Kangwook Lee. The expressive power of low-rank adaptation, 2024.
URL
https:
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi Bertscore: Evaluating text generation with bert. arXiu preprint 1xXf::194400067 2020.
Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, et al. survey of large language models. arxiv preprint arXiv:2303.1 2023.
19

---

Published in Transactions on Machine Learning Research (02/2026)
A Further Related Work
Differential privacy. Classical (c, didfffrrrel privacy (DP) frameworks formally measure the privacy- preserving capacity of an algorithm by analyzing whether the probability of observing an output changes by when the underlying database excludes or includes user record (Dwork et al., 2006). The application of this framework to generative language tasks, in general, has proven complicated due to the rigid definition of user record [Brown et al.) 2022 Jayaraman & Evans 2019 When directly applying DP to prevent sensitive data reconstruction, it has been shown that a non-negligible compromise on privacy is required to maintain performance (Lukas et al. 2023 The conventional technique of adding Gaussian noise onto clipped gradients (Abadi et al. 2016) to boost privacy has also been shown to affect model outputs: the randomness of the noise alone can significantly alter the outputs of two equally-private models (Kulynych et al.) 2023):
McKenna et al. (0225) have recently found significant differences in the scaling laws of DP LLM training compared to models trained under traditional regime.
Membership inference attacks (MIA) rely on rigorous statistical principles to assess privacy risks in machine learning models. (Shokri ct al., 2017) introduced an approach for determining whether a specific data point was part of a model's training dataset. These attacks exploit differences in model behavior on training versus non-training data, posing significant privacy concerns for sensitive information. Building on this, (Hongyan et al.) 2024) extended these concepts to LLMs by incorporating contextual information. This study demonstrated that LLMs are particularly vulnerable to membership inference attacks, as they often retain verbatim information from their training datasets. The work highlighted the increased privacy risks associated with LLMs due to their scale and training dynamics.
Secure Aggregations. While the conventional FL ensures that raw data is not shared between participants during collective training, does not address the risk of data leakage through model updates shared prior to aggregation. For example, in the honost-uut-curiou scenario, server examines whether client data can be reconstructed (Huang et al., 2021). This vulnerability becomes particularly critical with LLMs, given their propensity for memorization. To address the privacy risks associated with local model exchanges in FL, TTrux et al. 2019) proposes hybrid approach that combines differential privacy with secure multiparty computation (SCC). In this framework, local models are encrypled and remain hidden from other participants prior to aggregation, thereby mitigating privacy leakage risks associated with individual local models by focusing them on the aggregated model during each aggregation round. While this method has been explored for general machine learning applications, the best of our knowledge, it has not yet been investigated in the context of large language models (LLMs).
Medical applications. Our emphasis medical datasets is relevant: LLMs have been shown to regurgitate sensitive medical data in Lehman et al. 20211. though their work relics on an older BERT model. Mireshghallah et al. 2022) study the success of membership inference attacks on 12b2, though they also do not use any memorization metrics. Although federated lcarning has been studied and championed as an ideal paradigm for clinical settings (Xu et al.) 2021 Nguyen el al. 2022 Antunes et al.] 2022). there is a relative lack of literature in the context of clinical memorization.
B LoRA vs Full Fine-tuning Accuracy
To compare memorization between LoRA and full fine-tuning, it is essential that we compare settings that yield similar performance, as well as for this performance to be significantly higher than the base model. We use 3-shot in-context learning without any chain-of-thoughh reasoning and average the accuracy over three seeds. Figure 0 and 7 iillstratt the resulting benchmark accuracy of the fine-tuned models evaluate in this study, in federated learning and centralized learning respectively. We compare the base model to LoRA and full fine-tuning and find that the two finc-tuning methods reach a similar downstream accuracy that is significantly higher than the base model. A breakdown per benchmark in centralized learning is included in Table 2] Every fine-tuning yields a significant accuracy improvement over the pre-trained model except for Llama 3.1 8B as shown Figure ? which performance didn't improve with fine-tuning. Hyperparameter search either resulted in a significant performance drop (with high memorization) or kept the learning rate low enough that the accuracy stayed constant and thus showed memorization. We hypothesive that part.
20

---

Published in Transactions on Machine Learning Research (02/2026)
fine-tuning
fine-tuning
LoRA
0.65
tuning
0.65
0.60
0.60
0.55
0.55
Accuracy
0.50
Accuracy
0.50
0.45
0.45
0.40
0.35
0.30
0.25
Liama- Llama-3.2-2 3.2-18
Llama-3.2 3.2-38
Llama-2-78
Mistral-vO.3-78
Llama-3.2-1 3.2---3.2-18 3.
Llama-3 3.2-38
Llama-2-78
Mistral-v0.3-78
Llama-3. 3.1-88
Figure 6: Downstream accuracy in federated learning averaged across the benchmarks. LoRA yields relatively similar accuracy full fine- tuning for several LLMs in heterogeneous FL setting. We report the out-of-the-box accuracy of the pre-trained models control. A breakdown per round is included in Table
Figure 7: Centralized learning downstream ac- curacy averaged across the 5 benchmarks. LoRA matches full fine-tuning accuracy on every model tested. A breakdown per benchmark is in- cluded in Table 2
or all of our fine-tuning dataset has already been trained on during Llama 3.1 8B's pre-training phase, though the model showed no memorization of the canaries before fine-tuning. Accordingly, we exclude Llama 3.1 8B from subsequent experiments.
Table 2: Downstream accuracy in centralized learning. Best accuracy values are marked in bold.
Model
Fine-tuning
MMI.U-medical
PubMedQA
MedMCQA
MedQA
MedQA-4
Average
No fine-tuning
0.353
0.363
0.49
0.329
0.275
0.308
Llama 3.2 IB
Full
0.456
0.616
0.431
0.322
0.379
0.441
LoRA
0.447
0.594
0.397
0.312
0.362
0.422
No fine-tuning
0.432
0.597
0.122
0.491
0.446
0.504
Llama 3.2 3B
Full
0.59
0,536
0.542
0.452
0.507
0.525
LoRA
0.608
0.676
0.512
0.448
0.5
0.549
No fine-tuning
0.381
0.426
0.452
0.380
0.292
0.353
Llama 7B
Full
0.562
0.596
0.516
0.395
0.478
0.509
LoRA
0.560
0.726
0.448
0.353
0.405
0.498
No fine-tuning
0.552
0.635
0.7
0.483
0.438
0.503
Mistral v0.3 7B
Full
0.659
0.758
0.588
0.499
0.551
0.611
LoRA
0.667
0.758
0.572
0.467
0.54
0.601
In our foderated learning experiments (Section 4 we compare memorization after 5 federated rounds. This ensures that we compare models that have been trained on the same tokens for the same number of times. Similarly, do not make use of early stopping in centralized learning. Consequently, our methodology may not stop the fine-tuning different number of rounds. To measure this, we show in Table 3 the accuracy of federated fino-tuning per round. We find that except Llama 3.2 3B, all models reach their best performance in round 4 or 5, without any method reaching its best accuracy systematically earlier. For Llama 3.2 3B, LoRA reaches its highest accuracy at round and then again round Since we compare memorization at the last round, LoRA memorization scores may be evtreestimated due overfitting, thus mnder-sstimating how LoRA mitigates memorization compared to full fine-tuning.
optimal number of steps and some model may reach their best accuracy at
21

---

Published in Transactions on Machine Learning Research (02/2026)
Table 3: Downstream accuracy per federated round. We emphasize in bold the earliest round where models reach their best accuracy.
Accuracy per round
Model
Fine-tuning
2
3
4
5
Full LoRA
0.425
0.438
0.444
0.445
0.445
Llama 3.2 1B
0.415
0.422
0.430
0.432
0.434
Full LoRA
0.541
0.561
0.554
0.573
0.578
Llama 3.2 3B
0.557
0.564
0.559
0.563
0.564
Full LoRA
0.468
0.488
0.482
0.495
0.511
Llama 2 7B
0.475
0.490
0.482
0.494
0.493
Full LoRA
0.181
0.590
0.599
0.603
0.602
Mistral v0.3 7B
0.594
0.599
0.598
0.604
0.608
C
Generalization to other domains and larger models
To assess the robustness and broader applicability of our findings, we extend our evaluation beyond the medical domain and 7B-parameter LLMs. Specifically, explore whether LoRA's memorization reduction in centralized learning persists in other high-risk domains such as law and finance, and to 70B Llama model. These additional experiments demonsttate that our conclusions generalize across both tasks and model scales.
Additional domains, To evaluate generalizability beyond medicine, we fine-tuned models on Ai2's Multi- LexSum (Shen et al. 2022 legal summarization dataset, and ConvFinQA (Cheng al. 2024), financial QA benchmark. Multi LeaSum contains long-form summarics of real-world civil rights lawsuits across multiple granularities. ConeFinQA is a conversational question-answering dataset derived from financial reports. It. tests numerical reasoning and understanding in domain-specific contexts and includes sensitive financial information. These domains are highly sensitive to privacy risks, where even partial memorization can be problematie.
Additional semantic measure. We added BERTScore (Zhang et al. 2020 as an additional metric to better capture semantic similarity and subtle variations in memorized content. Following best practices, we use the B-BERRa-zlarge-aee MNLI model. We apply score rescaling, which adjusts for baseline similarity between unrelated sentence pairs. This technique improves the comparability and interpretability of reported scores across different models and datasets.
Scaling to 70B parameters. We evaluated the LLaMA 3.1 70B Instruct model (Dubey et al. 2024 to test whether LoRA's 's memorization mitigation scales to larger models.
Table 4: Law domain memorization metrics. LoRA consistently lowers all metrics, including BLEU Score and BERT Fl score.
Model
Method
BLEU
BERTScore
Llama 3.1 70B
Full FT
0.55
0.55
Llama 3.1 70B
LoRA
0.17
0.32
Llama 3.2 3B
Full FT
0.29
0.42
Llama 3.2 3B
LoRA
0.06
0.17
Results. As shown in fable law and 5 finance, LoRA consistently lowers BLEU and BERTScore compared full fine-tuning, generalizing our findings centralized learning on our medical dataset other domains and measures. In particular, we also find that fine-tuning a 70B model with LoRA also yields lower memorization than full fine-tuning, indicating its continued effectiveness at scale. Memorization scores
22

---

Published in Transactions on Machine Learning Research (02/2026)
generally higher for the 70B model than for its 3B counterpart, except the finance dataset, where we hypothesize that the lower memorization rate is due to suboptimal default hyperparameters.
Table 5: Finance domain memorization metrics. LoRA consistently lowers all metrics, including BLEU Score and BERT F1 score.
Model
Method
BLEU
BERTScore
Llama 3.1 70B
Full FT
0.55
0.48
Llama 3.1 70B
LoRA
0.50
0.45
Llama 3.2 3B
Full FT
0.51
0.56
Llama 3.2 3B
LoRA
0.11
0.12
Lower duplication rate. Previous duplication experiments relied on duplication rate of 10. While we argue that such rate is realistic in medical datasets given the prevalence of personal health information (PHI) in medical records, further evaluate memorization with duplication rate of 3 in Table 6 These results confirm that mitigation trends still holds with a lower duplication rate than the 10x duplication used in earlier sections, consistently with previous work (Wang & Li 2025 in centralized learning.
Table 6: Medical domain memorization metrics for large model and lower duplication rate. LoRA consistently lowers all metrics, including BLEU Score and BERT F1 score.
Model
Dupl.
Method
BLEU
BERTScore
Llama 3.1 70B
None
Full FT
0.170
0.23
Llama 3.1 70B
None
LoRA
0.100
0.18
Llama 3.2 3B
None
Full FT
0.030
0.11
Llama 3.2 3B
None
LoRA
0.010
0.12
Llama 3.2 3B
Full FT
0.060
0.20
Llama 3.2 3B
3x
LoRA
0.004
0.14
D Training setup
All experiments were performed on a university-grade HPC furnished with nodes of 80GB A100 GPUs, with Python 3.1 environment, PyTorch 2.4.0 and CUDA 12.1. Fine-tuning fit on single GPU without parallelization for model sizes up 8GB. Llama 3.1 70B was fine-tuned on GPUs. A centralized fine-tuning lasts 3 GPU-hours in average. Including preliminary and failed experiments, centralized training amounts to around 350 GPU-hours. In federated experiments, each round corresponds to one epoch of each of the 3 datasets, in averaging lasting one GPU-hour, in addition to hyperparameters search amounting to roughly 20 GPU-hours per federated fine-tuning and totalling around 250 GPU-hours. Experiments on the LoRA rank, batch size, Goldfish loss, NEFTune, gradient clipping and Gaussian noise add 400 GPU-hours.
Hyperparametors. In centralized learning, we sweep the learning rate E (le- 5, 5e le 4, 5e 4} for full fine- uning experiments. For LoRA experiments, we search for learning rate values E (5e-5, le 4, 5e-4, le-3) recommended by [ideemman et al. (2024). In federated learning experiments, each dataset individually for one epoch, with the same set of values as in centralized learning.
sweep the learning rate
For all experiments we fine-tune models with the AdamW optimizer (Loshchilov & Hutter 2019) with default parameters (81 = 0.9, Bg = 0.999, e = 18- weight decay of 0,01). We used a context length of 1024 and ensured that no text inputs were longer than the context length. We use a lincar warmup of 100 steps with cosine annealing schedule. Unless mentioned otherwise, we use a global batch size of 32 with gradient accumulation and gradient checkpointing. For LoRA fine-tuning with rank of 16, alpha of 8, drop
23

---

To measure the downstream performance of the fine-tuned models, we evaluate models on 4 medical benchmarks following existing methodology (Wu al. 2023a Singhal et al., 2023c b Chen al, 2023 MedQA, PubMedQA, MedMCQA, and MMLU-Mediees Published in Transactions on Machine Learning Research (02/2026)
out 0.05 and use adapters for all projection layers. We study the impact of the LoRA rank memorization in Section 1.3
E
Datasets and pre-trained models
In this section, we describe the datasets and pre-trained models used in our experiments, including fine-tuning sourees, gencralization datascts, evaluation benchmarks, and licensing terms.
E.1 Fine-tuning Datasets
In order to reproduce a plausible FL environment with non-IID data, we select 3 popular medical datascts with different types of QA.
MedMCQA PPal al. 2022) composed of multiple-choice questions, containing almost 190k entrance exam questions (AIIMS & NEET PG). We fine-tune on the training split and leave aside validation data as downstreem evaluation benchmark.
2. PubMedQA (Jin et al., 2019) consists of Yes/No/Man Maybe questions created from PubMed abstracts. The dataset contains 1 expert-annotated (PQA-L) and 211k artificially generated QA instances (PQA-A). We include 500 questions from the train and validation sets of PQA-L and 50k questions of PQA-A.
3. Medical Meadow flashcards (Han et al. 2023) contains 39k questions created from Anki Medical Curriculum flashcards compiled by medical students. We inchude 10k instances for finc-tuning data.
E.2 Medical Benchmarks
1. MedQA's 's 4-option questions. MedQA (Jin et al. multiple-choice questions. The test set contains 1278 questions with both 4 and 5-option questions. Following Chen et al. 2023). we report each case separately, respectively MedQA-4 and MedQA.
2020 consists of US Medical License Exam (USMLE)
2. MedQA's 5-option questions.
3. PubMedQA's test set contains 500 expert-annotated questions. No artificially-gennerttee questions are used during evaluation.
4. MedMCQA's test set does not provide answer labels, therefore we rely on the validation set, containing
4183 instances, to benchmark downstream performance following Wu et al. (2023a) and Chen et al. 2023
MMLU-Medical. MMLU (Hendrycks et al.) 2021 a collection of 4-option multiple-choice exam questions covering 57 subjects. We follow Chen al. (2023 and select subset of 9 subjects that are most relevant medical and clinical knowledge: high school biology, college biology, college medicine, professional medicine, medical genetics, virology, clinical knowledge, nutrition, and anatomy, and group them into one medical-related benchmark: MMLU-Medical.
E.3 Pre-trained models
To account. for the effect of model size on memorization (Carlini et al., 2023b
Tirumala el al. 2022 we study pre-trained models ranging from 1B to 8B parameters: Llama 3.2 IB, Llama 3.2 3B, Llama 3 8B (Duboy al. 2024). Llama 2 7B (Touvron al. 2023), and Mistral 7B v0.3
(Jiang et al.] 2023). We also
include memorization-
experiments with the Llama 3.1 70B Instruct model (Dubey 2024 in Appendix C to evaluate how LoRA scales to larger-capacity models.
24

---

Published in Transactions on Machine Learning Research (02/2026)
E.4 Licenses and Terms of Use
We provide below the licenses and usage terms for all datasets and pretrained models used in our work.
E.4.1
Datasets
MedMCQA (Wu et al. 2023a
Source: httts://hugginge:
License:
Apache License 2.0
PubMedQA (Singhal et al. 2023b
Source:
https: hhaggig///uggiiggacc.e httpg///ggaacccootttattttt////// htttt//ttt////ooaooeeeaaaaaaaaaa
License:
MIT License
Medical Meadow Flashcards (Han et al. 2023
Source: https::/hhuginggfae http://ggiiggaa.....ooooaaaaaaae co/medalpaca.
License: Creative Commons license family
i2b2 2014 De-identiffcation Datasct (Stubbs & Özlem Uzuner 2015 Source: https://wwx 12b2. orgo//gg//ooo NLP OLP/HeartDiseasee License: Available under Data Use Agreement from Partners Health Access requires registration and approval.
Multi-LexSum (Shen et al.
2022
Source: https: httpss//huggingfaact co/ /ttassts//llllmmmmmll... lexsum
License: Open Data Commons License Attribution family
ConvFinQA (Cheng et al.
2024
Source:
https: //github. com cwwssrs/ ConvFiin/A
License:
MIT License
E.4.2
Pretrained Models
LLaMA 2 [Touvron al. 2023
Source:
https://www 1lama. com 11ama domnlodd
License: Llama 2 Community License Agreement
LLaMA 3 (Dubey et al.
2024)
Source:
https://ww/ 1lama. hamm/llaaadoomlloe
License: Llama 3.x Community License Agreement
Mistral 7B v0.3 (Jiang et al. 2023
Source: https://huggingfaat co//iisttallailiistrra----y/
License: Apache License 2.0
F
Goldfish loss
The Goldfish loss (Hans et al. 2024 has been introduced recently as memorization mitigating technique for pre-training language models via new next-token training objective. The training procedure randomly excludes tokens from the loss computation in order to prevent verbatim reproduction of training sequences. apply it to fine-tuning and report values for various dropping frequencies & and we use hashing context width h 13 following the authors' methodology Haas et. al. 2024). We evaluate the memorization and accuracy of Llama 3.2 3B fine-tuned with LoRA in combination with Goldfish loss. We also compare it to the same model fully fine-tuned with Goldfish loss only. Table 7 shows how combining Goldfish loss with LoRA mitigates memorization compared to full fino-tuning. By contrasting memorization scores with control values, we can also note that the Goldfish loss is effective memorization--itieee technique.
While Goldfish loss has been designed for pre-training,
25

---

Published in Transactions on Machine Learning Research (02/2026)
Table 7: Impact Goldfish loss on BLEU Scores and accuracy in LoRA Fine- Tone-Tuning. Llama 3.2 3B is fine-tuned with different dropping frequencies (k). Best accuracy marked in bold.
Goldfish
BLEU, duplication
BLBU, 10x duplication
Arcuracy
0,0133
0.0216
0,314
0.0154
0,0:22
0.549
4
0.0180
0.05433
0,531
0.0183
10
0.0256
0.1494
0.538
100
0.0266
0.2852
0.537
1000
0.0256
0.3111
0.333
10000
0.0253
0.2944
0.345
Control
0.0245
To assess the impact of LoRA in combination with Goldfish loss, we evaluated the memorization and accuracy of fine-tuning the same model using full fine-buning. Table presents the memorization scores and accuracy of the model fine-tuned with Goldfish loss alone, without LoRA. Our results indicate that while Goldfish loss reduces memorization, it does not achieve the same level of reduction the combination with LoRA, especially when duplication occurs in the fine-tuning data. In summary, combining LoRA with Goldfish loss allows a privacy-utility tradeoff that cannot be achieved using Goldfish loss alone.
Table 8: Impact of Goldfish loss BLEU Scores and accuracy in full fine-tuning. The BLEU scores and the accuracy of Llama 3.2 3B is reported for full fine-tuning across different dropping frequencies (k). Best accuracy is marked in bold.
Goldfish &
BLEU, no duplication
BLEU, 10x duplication
Accuracy
2
0.0146
0.0340
0.517
3
0.0243
0.0679
0.513
4
0.0282
0.1
0.524
5
0.0310
0.1568
0.521
0.0342
0.3006
100
0.0399
0.5821
0.534
1000
0.0425
0.6235
0.527
10000
0.0407
0.6235
0.516
Control
0.0417
0.6235
0.538
G
NEFTune
NEFTune is a regularization technique consisting in adding random noise to the embedding vectors to improve instruction fine-tuning. While not introduced as a privacy-preserving technique per se, we hypothesize that a fine-tuning regularization such as NEFTune may also reduce unintended memorization.
We display results after applying NEFTuue with noise value a E (5, 10, 30, 45). We find that adding noise does not improve accuracy when applied to domain adaptation fine-tuning. Secondly, increasing the noise does not yield better privacy, at least not until we set alpha to 45, which is greater than alpha values reported by the original work (5, 10, and 15).
H Differential Privacy
(e, Diffeeerrntaa privacy (DP) provides formal guarantees that an individual's data cannot be inferred from model's output, by quantifying the model's sensitivity to changes in input data. Following Li et al. (2021) and
Liu et al. (2024), we define sensitivity as the maximum change in model output resulting from the inclusion or removal of single data point in the training dataset. (record-level DP).
Implementing differential privacy (DP) requires modifications to the fino-tuning pipeline to measure the sensitivity of the fine-tuning process. However, the use of stochastic gradient descent (SGD), required for DP-SGD, poses challenges when fine-tuning the Llama 3.2 3B model. Despite extensive hyperparameter
26

---

Published in Transactions on Machine Learning Research (02/2026)
Table 9: NEFTuun impact on the BLEU score and accuracy when combined with LoRA. We analyze LoRA fine-tuning with Llama 3.2 3B and different noise scaling factors a.
duplication
duplication
Accuracy
Control
0.0276
0.4170
0.562
0.028/1
0.4525
0.560
10
0,0300
0.4506
0,518
0.0284
30
0.0282
0.4377
0.548
0,0248
0.3599
0.518
0.0227
0.2759
0.501
100
0.0183
0.1006
0.391
tuning, particularly of the learning rate, SGD consistently underperforms compared to Adam-based optimizers. As shown in Figure & Paged AdamW achieves substantially faster and doeper loss reduction than SGD during fine-tuning, highlighting the difficulty of maintaining optimization efficiency while measuring the sensitivity in large-scale models.
Gradient clipping. A key technique in differential privacy (DP) is gradient clipping, which constrains the magnitude of gradient updates and enables the measurement of model sensitivity during fine-tuning. In our experiments, we find that gradient clipping alone can mitigate memorization, even though it does not provide formal privacy guarantees. Using a clipping value of 0.0001 substantially reduced memorization and improved accuracy compared to the default value of 1.0. Table 10 reports the impact of different clipping values on BLEU score and accuracy during fine-tuning the Llama 3B model. These results highlight gradient. clipping as an effective privacy-onhancing mechanism in its own right, even without the addition noisc
sqd
paged, aaaam__mv
1.6
250
500
750
10000
1250
1500
1750
2000
train global
Figure 8: Loss reduction comparison between optimizers. The plot compares loss reduction during the fine-tuning of Llama 3.2 3B using different optimizers: SGD (blue) and Paged AdamW (orange).
Post-fine-tuning Gaussian noise injection
This section provides details and results the injection noise into the weights of a model after fino-tuning. Specifically, the noise sampled from a Gaussian distribution (u,, r²), where the mean μ set to 0 and o² is the variance that determines the noise's magnitude. Unlike the DP Gaussian mechanism, this approach does not provide formal privacy guarantees. However, it offers practical and computationally light method to mitigate the memorization of sensitive information, it does not require additional fine-tuning and can be directly applied to previously finc-tuned LLMs. Additionally, measuring the performance of this method can illustrate how other noise mechanisms similar to those used in DP might affect accuracy and privacy metrics.
In Table II we evaluate its effect under various noise magnitudes, along with the corresponding impact on model accuracy. We applied Gaussian noise the LoRA weights of fine-tuned Llama 3.2 3B model, as evaluated in earlier sections. We then compared the model's BLEU score and accuracy across different noise magnitudes.
27

---

Published in Transactions on Machine Learning Research (02/2026)
Table 10: Gradient clipping impact on the BLEU score and accuracy- The BLEU score and the accuracy of Llama 3.2 3B is reported for LoRA fine-tunin fine-tuning. Best accuracy is marked in bold.
Clipping
duplication
duplication
Aocuracy
1.0 x 10" (default)
0.0266
0.4235
0.520
5.0 x 10
0.0235
0.4235
0.541
10
0.0229
0.4031
0,0243
0.3827
1,0 10-2
0.0227
0.3914
0.506
5.0 x 10-3
0.0245
0.3914
0.531
1 10
0.0250
0.3352
0.519
5.0 10
0,0203
0.2914
0.528
1.0 10
0.0185
0.0926
5.0 10
0.0151
0.0438
0.506
10 10
0.0086
0.0099
0.491
5,0 10-8
0.0065
0.0080
0,149
1.0 10-6
0.0026
0.0012
0.460
x 10
0.0026
0.0012
0.392
10
0.0026
0.0012
0.377
Table 11: Impact of noise addition on BLEU score and accuracy. Llama 3.2 3B is fine-tuned with LoRA across various noise magnitudes (o)
Noise Scale (a)
BLEU, no Duplication
BLEU, Duplication
Accuracy
(no noise)
0.0206
0.3012
0.553
0.001
0.0211
0.3049
0.552
0.01
0.0206
0.2877
0.551
0.02
0.01
0.0994
0.541
0.03
0.0083
0.0111
0.511
0.0006
0.05
0,0000
0,0000
0.110
We observe that the accuracy remains unaffected up to certain noise level (o 0.01) and even shows slight improvement. However, beyond this threshold, accuracy decreases and reduction in memorization similarly follows, appearing to correlate with this decrease. These observations suggest that this mechanism effectively reduces excessive memorization in models that have overfitted onto their training data. Therefore, this approach offers an alternative to early stopping for controlling memorization which can be applied post. fine-tuning Figure g compares the privacy and utility Llama 3.2 3B subject to post-fine-tuning gaussian noise injection with the cvolution of the model fine-tuned with LoRA accross iterations. The noisy model, represented by red dots, has been fine-tuned for 2100 iterations before injecting the gaussian noise. Gaussian noise injection of standard deviations of 0.2 and 0.3 have been reported in the plot.
1.1 Privacy-Utility tradeoff with Gaussian noise injection
Figure g presents dot plot comparing the privacy-utility tradeoffs of Llama 3.2 3B when fine-tuned with LoRA versus when Gaussian noise is injected after fine-tuning with LoRA. The results indicate that Gaussian noise injection does not enhance the privacy-utility tradeoff compared to fine-tuning with LoRA.
J Secure Aggregations
Secure aggregation ensures that sensitive data remains protected by preventing the aggregator from decrypting any individual model updates. In foderated learning setup, only the aggregated global model is accossible to participants, meaning that memorization within locally trained models before aggregation does not pose a privacy risk. We also evaluate the runtime performance combining secure aggregation with LoRA in a federated learning setting, demonstrating that this added protection incurs minimal computational overbead.
Performance. To evaluate the performance impact of secure aggregation, we use Lattigo, an open-source library that enables secure protocols based multiparty homomorphic encryption Lattigo v6 Mouchet. et al.
28

---

Published in Transactions on Machine Learning Research (02/2026)
Llama 3.2, 3B, Base model
Liama 3.2, 3B, LoRA
Gaussian-noise injection
1050
2100
0.550
000
0.525
150 300 070.03
Accuracy
0.500
0.475
0.450
0.425
0.001
0.005
0.01
0.05
0.1
0.5
Memorization (BLEU score)
Figure Privacy-Utility tradeoff with post-finettuning gaussian noise injection. Accuracy and memorization (BLEU score with 10x document duplication) tradeoff of Llama 3.2 3B subject post-fine- fine- tuning gaussian noise injection with standard deviation. Values above the dots correspond to the number of iterations for LoRA fine-tuning evolution, and the standard deviation of injected noise for noisy models.
(2020). Specifically, it implements the CKKS scheme, which allows efficient encrypled computations on real- valued data, making ideal for the secure aggregation of the LoRA models trained by the clients/participa participants. In our experiments, consider 3 clients and configure CKKS parameters to enable 32-bit precision. Since our LoRA models are trained with 16-bit precision, this ensures that secure aggregation does not introduce any accuracy loss compared to standard aggregation in plaintext.
Time overhead. Secure aggregation introduces a time overhead due to encryption, homomorphic operations, and collective decryption. The duration of encrypted aggregation influenced by the number of weights being aggregated, specifically the number LoRA weights. In our experiments with Llama 3.2 3B, LoRA update contains 24,772,608 parameters, representing approximately 0.77% of the full model's parameters. In Table 12 report the aggregation times for vectors of varying sizes, corresponding to the number of LoRA weights. Aggregating three vectors of the size of our LoRA takes 11.33 seconds, which is negligible compared to the time required for local fino-tuning at each round.
Table 12: Execution Time of the Secure Aggregation Protocol. The protocol aggregates three equal-sized encrypted vectors for varying sizes.
Aggregation Length
Time Taken
10*
12.16ms
102
11.61ms
10a
11.32ms
17. 29ms
10a
10a
474.46ms
107
4.37s
2.48 x (LoRA size)
11.33s
10
K Why Does LoRA Reduce Memorization?
We continue here the theoretical discussion started in Section 5 Our experimental evaluation demonstrates
that LoRA reduces memorization in both centralized and FL settings, which naturally raises the question:
29

---

Published in Transactions on Machine Learning Research (02/2026)
why does this happen? We argue that the mechanisms by which FedAvg and LoRA mitigate memorization should be considered independently. [Crrinii et al. (2023a) empirically establish log-linear relationship between canary duplication and memorization, thus we frame our discussion of memorization in the context
of overfitting. How and why in-distribution, non-duplicated sequences can still be regurgitated (Carlini et al. question that we leave to future work.
2019
Federated learning. While it is known that FedAvg can reduce memorization for simpler LSTM-based next-word predictors (NWPs) (Ramaswamy et al. 2020 Thakkar et al., 2021), we hope that our verification of this phenomenon for LLMs on longer canaries can encourage formal investigation. Nevertheless, we note the following: in the IID FedAvg setting with identical hyperparamcter settings (same number of local updates, learning rate, and initialization) the expected value of the d-sample stochastic gradient over N clients, N 1 Σ fa,0, D&) in Equation I can resemble single stochastic gradient in centralized setting taken over single large batch of size Nk since f& and D3 are homogencous. Thus, Thakkar ct al. (2021) observe more memorization in IID settings with larger batch sizes. The non-lID setting is significantly more complex: the optimization problem and associated loss landscape of Equation [ problem. We observe in Figure? that non-lID FL significantly reduces memorization, which [Taakarr et al. (2021) also observe for their NWPs. While they do not fine-tune their learning rates eliminate this as a confounding variable, we de 2 thus suggesting that Avd itself is memorizationnrraducing mechanism.
differs from the centralized
d-compressors. Specific to FL, an alternative hypothesis is that the low-rank approximation of AW resembles 5-compression operator (Karimireddy et al. 2019), i.e., [[O) - AW] < (1 -)]|AW|1? and that low-ō compressors reduce memorization. Low-biss bias compressors, such as certain randomized projections DDofmma et al. 2023 Rabbani et al., 2021 Ivkin et al., 2019) and other low-rank approximations (Makkuva el al. 2023) have been shown to preserve model performance in non-IID distributed settings. While the effects of these other operators on memorization has not been extensively studied, the efficacy of gradient clipping in lowering memorization while maintaining accuracy (Table 10) lends further credence to this hypothesis.
Clipping is low-bias compressor for heavy-tailed gradients, which is observed for general SGD (Mireshghallah) et al. 2022) and I.M. fine-tuning (Kenton & Toutanova 2019). Further exploration of 8-compressors such as sketches, signSGD (Bernstein et al. 2018), QLoRA (Dettmers et al. 2024 and U-Clip (Elesedy & Hutter 2023) is warranted.
?While it is possible that performing centralized learning in a curriculum-style manner with heterogencous learning over training data can reduce memorization, given the small performance gap against non-IID FL, is highly unlikely that this alone can improve its significantly worse memorization scores.
30


Reviews:
[{"review_id": "FWfQnwGKT3", "reviewer": "Reviewer_MctV", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "1.**Addresses a Timely Problem**- The paper tackles the central challenge of data privacy leakage resulting from unintended memorization in the impactful and growing domain of Federated Learning (FL) for Large Language Models (LLMs). This is crucial in the current era, where high-performing LLMs pose a direct risk of exposing sensitive client information, making the work immediately relevant to high-risk domains (medicine, law, finance).\n\n2.**Impactful Empirical Finding**- The core finding—that Low-Rank Adaptation (LoRA) reduces unintended memorization by up to a factor of 10—is compelling because it is achieved with little to no reduction in model performance. This is a great finding because LoRA also significantly helps reduce communication cost (by sending only low-rank matrices) and fine-tuning cost (by only updating a small fraction of the parameters), offering a solution that is simultaneously a privacy enhancer and an efficiency accelerator in FL.\n\n3.**Investigation of Multi-Layered Privacy Interactions**- The paper investigates the relationship between LoRA and other privacy-preserving techniques like Differential Privacy (DP) (gradient clipping/noising), Secure Aggregation, and Goldfish Loss. \n\n4.**Extensive Experimental Design**- The study is scientifically sound, featuring a comprehensive set of experiments that ensures the robustness and generalizability of the findings across multiple scenarios.", "claims_and_evidence_yn": "Yes", "claims_explanation": "1.Comprehensive Scope of Empirical Validation- The authors demonstrate the efficacy of LoRA through a broad experimental setup, which ensures the generalizability and practical relevance of their primary claim:\n\n - Real-World Relevance Across Domains: The study's focus on datasets from three high-risk applied domains—health, law, and finance—provides strong evidence that the privacy benefits of LoRA hold in sensitive, real-world deployment scenarios.\n\n  - Scalability and Architectural Validation: They confirm the effect is consistent across a wide range of model architectures and scales (e.g., Llama and Mistral families, from 1B up to 70B parameters), validating that the findings are not model-specific.\n\n   - Multi-Faceted Evaluation: The use of multiple, complementary metrics (Exact Match, BLEU, BERTScore) moves beyond simple token-level checks to rigorously capture both exact and approximate unintended memorization.\n\n - Sensitivity Analysis: The authors investigated the impact of key hyperparameter design choices, such as the LoRA rank (r) and the number of FL rounds, on model behavior.\n\n- Security Risk Modeling: Testing under practical security challenges, including high data duplication (10x) and varying prompt lengths, confirms the method's resilience against common real-world attack vectors.\n\n- Comparison against Centralized Learning: The paper offers a comparative analysis of memorization in Federated Learning (FL) versus Centralized Learning (CL) comparing both the effectiveness and the mechanics of LoRA's privacy enhancement. \n\n2.Rigorous Investigation of Layered Privacy Defenses-The paper analyzes how LoRA integrates with and modifies the performance of other established privacy methods:\n\n- Hyperparameter Sweeps: The combination of LoRA with each privacy method was studied by varying the main hyperparameters (HPs) involved (e.g., DP noise levels or Goldfish loss weight). \n\n - Impact of Stacking Defenses: The comparative results delineate effective combinations (e.g., LoRA with Goldfish Loss and DP Gradient Clipping) which further improve privacy, while highlighting the nuance of ineffective stacks (like LoRA with NEFTune).", "audience_yn": "Yes", "audience_explanation": "Yes, I believe so. As discussed in the submission, the privacy implications of fine-tuning large language models (LLMs) are an active and rapidly developing research area. Recent works have begun to examine how different fine-tuning strategies affect privacy, with some focusing specifically on unintended memorization. Notably, a recent study has shown that LoRA can substantially reduce memorization risks compared to full fine-tuning in centralized learning settings. However, to the best of my knowledge, there has not yet been a systematic investigation of this question in the federated learning context. This makes the study particularly relevant, given that LoRA also offers practical advantages for FL — such as lower computational and communication costs — which further increase its potential impact and appeal to the TMLR community.", "requested_changes": "Here are a few questions I would like to discuss with the authors:\n\nQ1. The number of FL rounds (or local epochs) appears to be a critical hyperparameter, requiring a value high enough for utility but low enough to avoid unnecessarily increasing memorization. Given the cost, what strategy do the authors recommend for cost-effectively determining this optimal number of rounds?\n\nQ2. Judging from Figure 3, it appears that for some larger models, Centralized Learning with LoRA (CL LoRA) achieves a lower unintended memorization rate than Federated Learning with LoRA (FL LoRA). Is it accurate that, in these specific scenarios, the immediate privacy concern (memorization) is better addressed by CL LoRA? If so, what is the authors' hypothesis for this finding, considering that FL is generally intended to be more privacy-preserving? \n\nQ3. The paper's conclusion rests on LoRA providing a large privacy gain with minimal utility loss. While Table 4 (Law) and Table 5 (Finance) show evidence of memorization reduction, they do not report the primary task-specific utility metric (e.g., F1 score, Accuracy). Would you be able to add those?\n\nQ4. The paper observed that the effectiveness of LoRA in reducing memorization varied notably between the Llama and Mistral model families. Given this variation, I was wondering why the experimental design heavily relies on multiple models within the Llama family (1B to 70B variants) instead of including models from fundamentally different open-source architectures available at the time?", "broader_impact_concerns": "The paper discusses methods that reduce memorization and thereby improve privacy in LLM fine-tuning. While this is a positive contribution, as is often the case with privacy-oriented research, such techniques should be approached with some caution. For instance, reducing memorization can enhance data protection but may also make it more difficult to identify the use of copyrighted, restricted, or otherwise sensitive data in model training. It is therefore important to ensure that such methods do not create a false sense of security regarding data privacy or ethical compliance.", "additional_comments": "The paper is well-written and easy to follow. The authors provide an extensive literature review that clearly positions the work within existing research.", "extra_scores": {}, "extra_text": {}}, {"review_id": "rQ5ABqwThx", "reviewer": "Reviewer_Da1W", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper makes the following key contributions:\n1. Empirical demonstration that using Low-Rank Adaptation (LoRA) for fine-tuning Large Language Models (LLMs) in a Federated Learning (FL) setting significantly reduces unintended memorization of sensitive training data (by up to 10x), with little to no cost to downstream task performance.\n2. The study is extensive, validating the core finding across multiple model families (Llama-2, Llama-3, Mistral), model scales (1B to 70B parameters), and high-risk domains (medicine, law, finance).\n3. The work provides a detailed comparison of memorization patterns between Federated and Centralized Learning (CL), confirming that FL itself reduces memorization and showing that LoRA's mitigating effect is present in both settings.\n4. The paper experimentally shows that LoRA can be effectively combined with other privacy-enhancing methods. It finds synergistic effects with Goldfish loss and gradient clipping, providing a pathway for building stronger, multi-layered privacy defenses.\n\n\nKey Strengths:\n+ The work addresses a critical, real-world problem of data leakage in privacy-sensitive applications of LLMs.\n+ The experimental setup uses established models, memorization metrics (exact match, BLEU) and canaries on sensitive, real-world data (i2b2). \n+ The findings for practitioners are clear: using LoRA is a simple and efficient way to gain a significant privacy improvement during fine-tuning.\n\nKey Weaknesses:\n- The introduction's logic flow is confusing and does not effectively set up the research gap. It lacks a clear, concise explanation of how FL is implemented for LLMs in this work. \n -   The claim that LoRA's privacy effects are unstudied in FL is inaccurate and ignores relevant prior work. E.g., Sun et al. has also explored the privacy-preserving FL via LoRA. \n- The paper is predominantly empirical without any theoretical analysis. While Appendix L offers several compelling hypotheses (e.g., reduction of \"benign overfitting,\" connection to differential privacy via low-rank compression), these are not proven and remain speculative.\n- The FL setup uses only three clients. A deeper investigation into how the number of clients, data heterogeneity, and aggregation frequency affect memorization with LoRA would strengthen the FL-specific claims.", "claims_and_evidence_yn": "No", "claims_explanation": "While the core experimental evidence for LoRA reducing memorization is extensive and appears sound, the paper's clarity and contextualization are lacking, which undermines the overall conviction.\n\n* The introduction's motivation is confusing, and the FL methodology is unclear, making it difficult for the reader to fully grasp the experimental setup.\n* The evidence is presented in a vacuum regarding related work. By not engaging with papers like Sun et al., it's unclear how this work specifically advances the state-of-the-art beyond what has already been explored in \"privacy-preserving FL via LoRA.\"", "audience_yn": "Yes", "audience_explanation": "The findings are highly relevant to a significant portion of the TMLR audience. Key interested groups would include FL and LLM Practitioners, and Privacy and Security Researchers.", "requested_changes": "## Critical Changes (Required for Acceptance):\n\n- **Revise the Introduction and Motivation**: The introduction must be restructured to present a clear, logical narrative. It should: a) clearly state the problem (LLMs memorize data in FL), b) identify the specific gap (while LoRA is known for efficiency, its specific effect on memorization in FL is not well-understood, especially compared to full fine-tuning and across diverse settings), and c) precisely state the paper's contributions in light of this gap. The current motivational flow is confusing and must be improved.\n\n- **Acknowledge and Differentiate from Prior Work**: The statement \"the effects of LoRA on privacy and memorization haven’t been formally studied in federated learning settings\" must be corrected. The authors must cite and discuss relevant works like Sun et al. (\"Improving lora in privacy-preserving federated learning\") and clearly articulate how their work differs—for instance, by focusing explicitly on memorization metrics (exact match, BLEU) rather than differential privacy bounds, or by providing a much broader evaluation across model families and sizes.\n\n## Strengthening Changes (Recommended to Improve the Paper):\n\n- **Address the Limitation of a 3-Client Setup**: The paper must include a explicit discussion of this limitation. The authors should justify why this small-N setup was chosen (e.g., computational constraints, simulating a cross-silo scenario with a few hospitals) and acknowledge that the findings may not generalize to large-scale cross-device FL with hundreds or thousands of clients. This should be added to the \"Limitations\" section.\n\n- **Refine the Theoretical Discussion**: The hypotheses in Appendix L should be framed more clearly as speculative and be positioned as directions for future work.", "broader_impact_concerns": "The most significant concern is the potential for practitioners to misinterpret the findings as offering comprehensive privacy protection. While the paper demonstrates a reduction in memorization, it does not eliminate it. Nonetheless, organizations in sensitive domains such as healthcare may adopt this technique with unwarranted confidence. Without explicit warnings, this could result in privacy breaches, as determined adversaries might still be able to extract sensitive information.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "3FLPKuKfsx", "reviewer": "Reviewer_86LA", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper empirically studies the effect of federated learning on unintended memorization when using LoRA.\nThe authors provide empirical evidence that Federated LoRA memorizes less than both Federated Fine-Tuning and Centralized LoRA. Experiments are conducted on realistic datasets with large, practical LLMs such as LLaMA-2, LLaMA-3, and Mistral. The authors also explore combining LoRA with other privacy-preserving techniques.\n\nThe topic is relevant and timely. However, the findings are not particularly surprising, as prior work has already shown that, in the centralized setting, LoRA tends to memorize less than full fine-tuning (as it can be viewed as a form of noisy gradient descent; see Malekmohammadi & Farnadi, 2025), and that federated learning typically exhibits less memorization than centralized training (Thakkar et al., 2021). Based on the discussion in Appendix L, the current study does not seem to bring substantial new insights beyond these known results.\n\nWeaknesses\n- Weak discussion of empirical results.\nThe main discussion of the findings is relegated to the appendix. This part should be integrated into the main text and clearly linked to the empirical observations.\n- Unclear organization of experimental results.\nThe main message—that federated learning improves privacy compared with the centralized setting, and even more so when combined with LoRA—is not clearly conveyed. Some key results (e.g., Section 4.1 and parts of Section 4.2) are presented only for the centralized case, making it difficult to verify whether the same conclusions hold in the federated setting.\n- Questions regarding Figure 3:\n  - For LLaMA-2-7B and Mistral, federated learning occasionally shows higher memorization than the centralized setup. It is not convincing that this is solely due to differing learning rates.\n  - Why is the centralized curve stable across rounds? Some clarification is needed.\n\n- Figure 6 should appear in the main text.\nIts content is essential for the paper’s claims. It would also be helpful to include both centralized and federated scenarios in the same figure. Additionally, I was surprised to observe that, in the non-IID case, federated learning outperforms centralized learning (Tables 2 and 3), which contradicts theoretical expectations. Moreover, LoRA showing better performance than full fine-tuning (Figure 6) is counterintuitive, as LoRA is theoretically akin to DP-SGD and thus expected to yield a slight performance trade-off.\n- Experimental design could be strengthened.\nThe paper cites Thakkar et al. (2021) in Appendix L, where the experiments were carefully designed to isolate different contributing factors to memorization. A similar level of rigor in experimental design would have provided deeper insights here.", "claims_and_evidence_yn": "No", "claims_explanation": "The claims made in the submission are partially supported by empirical evidence, but the support is neither fully convincing nor clearly presented. While the experiments confirm previously known trends—such as LoRA and federated learning both reducing memorization—the empirical analysis lacks depth, and the discussion is mostly deferred to the appendix. Some results (e.g., Figures 3 and 6) even appear inconsistent or counterintuitive and are not adequately explained. Overall, the evidence provided does not convincingly substantiate the paper’s claims or bring new insights beyond prior work.", "audience_yn": "Yes", "audience_explanation": "Yes, especially those interested in privacy and efficient fine-tuning methods.", "requested_changes": "- Strengthen the discussion of empirical findings. Move the key points from Appendix L into the main text and clearly connect them with the presented results. (Critical)\n\n- Reorganize the experimental results to ensure both centralized and federated scenarios are consistently compared. Emphasize the main message that federated learning and LoRA together improve privacy. (Critical)\n\n- Improve experimental design by incorporating analyses that isolate contributing factors to memorization, following the methodological rigor of Thakkar et al. (2021). (Critical)\n\n- Enhance overall clarity and organization, ensuring that the narrative highlights the paper’s contributions and situates them in the context of existing literature.", "broader_impact_concerns": "The paper raises no immediate ethical or societal concerns", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)