Title: Differentially Private Federated Low Rank Adaptation Beyond Fixed-Matrix
Venue: NeurIPS 2025
Accepted: yes
Keywords: Federated Learning

Low-Rank Adaptation

Differential Privacy
Abstract: Large language models (LLMs) typically require fine-tuning for domain-specific tasks, and LoRA offers a computationally efficient approach by training low-rank adaptors. LoRA is also communication-efficient for federated LLMs when multiple users collaboratively fine-tune a global LLM model without sharing their proprietary raw data. However, even the transmission of local adaptors between a server and clients risks serious privacy leakage. Applying differential privacy (DP) to federated LoRA encounters a dilemma: adding noise to both adaptors amplifies synthetic noise on the model, while fixing one adaptor impairs the learnability of fine-tuning. In this paper, we propose FedASK (Differentially Private Federated Low Rank Adaptation with Double SKetching) , a novel federated LoRA framework to enable effective updating of both low-rank adaptor matrices with robust differential privacy. Inspired by randomized SVD, our key idea is a two-stage sketching pipeline. This pipeline first aggregates carefully sketched, privacy-preserving local updates, and then reconstructs the global matrices on the server to facilitate effective updating of both adaptors. We theoretically prove FedASK's differential privacy guarantee and its exact aggregation property. Comprehensive experiments demonstrate that FedASK consistently outperforms baseline methods across a variety of privacy settings and data distributions.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe manuscript proposed a novel federated LoRA framework to enable effective updating of both low-rank adaptor matrices with robust differential privacy. The proposed method tacked a key limitation of previous methods by enabling updates of both A and B without fixing one of them. Theoretical Analysis were provided for the guarantees of robust differential privacy and precise aggregation. The proposed method achieved SOTA performance in multiple benchmark tasks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n    1. The proposed method enables the updates of both A and B, which is a critical limitations of existing methods.\n    2. The empirical performance is better than existing SOTA methods.\n\nWeaknesses:\n    1. The experiments are focused on LLMs for NLP. It would help to discuss whether the proposed method can be extended to other model families, such as vision transformers.\n    2. The discussion on computational and communication cost is limited. More discussion in terms of runtime or communication will be helpful to understanding the strengths of the proposed method.\n\nQUESTIONS:\n1. Is there an explaination for why FedProx performs better than the proposed method in some cases reported in Table 4?\n2. While aggregation fidelity with varying client numbers is shown, the impact of client number on the overall performance of the proposed method remains unclear. Could you report how the method performs across different datasets with varying numbers of clients?\n\nLIMITATIONS:\nAlthought the proposed method improved performance on benchmark datasets, the introduction of two-stage sketching and server-side SVD brings additional computation and communication cost, especially when the number of clients or model dimensions is large. More analysis on runtime or complexity will be helpful.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the trade-offs involved in applying differential privacy noise to both LoRA matrices. While doing so can lead to excessive noise amplification in the final model update, the common workaround—fixing one matrix and only training the other—significantly limits the model's learning capacity. The authors propose FedASK, a novel framework that enables the effective and differentially private updating of both LoRA matrices. The key innovation is a two-stage sketching pipeline inspired by randomized SVD. Both theoretical analysis and experimental results are presented to justify the performance and effectiveness of the proposed FedASK method, which outperforms other baseline approaches.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The paper is overall well-written and well-motivated.\n- Enhancing differential privacy while preserving model performance for efficient federated LLM fine-tuning is of significant potential impact.\n- The proposed FedASK method is intuitively easy to follow.\n- Both theoretical and experimental results are provided to justify the performance of FedASK.\n\nWeaknesses:\n- [Major concern] The two-stage pipeline of FedASK requires two rounds of communication, which may introduce significant communication overhead and bottlenecks.\n- FedASK requires additional computational load on the server side (e.g., for matrix decompositions), and this computation appears to scale with the number of participating clients.\n- The paper does not provide end-to-end wall-clock runtime or a breakdown of the execution time, which is important for understanding the practical performance of FedASK.\n\nQUESTIONS:\n- How do the method and theoretical analysis apply to models beyond dense LLMs, such as state-space models and MoE models?  \n- Are there any further optimizations that can be done to reduce the communication and computation overhead of FedASK?\n\nLIMITATIONS:\nAs mentioned in the \"Weaknesses\" section, will it be possible to add end-to-end and per-iteration breakdown wall-clock time analysis of the proposed FedASK method and other baseline methods?", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

comments: SUMMARY:
The paper introduces FedASK (Federated Low Rank Adaptation with Double SKetching), a novel framework for fine-tuning large language models (LLMs) in a federated learning (FL) setting while ensuring differential privacy (DP). It addresses the trade-off between noise amplification and learnability in federated LoRA (Low-Rank Adaptation) by enabling simultaneous updates of both low-rank matrices (A and B) with strong privacy guarantees.

STRENGTHS AND WEAKNESSES:
The strengths of this paper are as follows.
Robust Theoretical Analysis: The paper provides strong theoretical guarantees for both differential privacy (Theorem 1) and aggregation precision (Theorem 2).
Comprehensive Experiments: The empirical evaluation is thorough, using large-scale Llama-2-7B and 13B models across multiple tasks (MMLU, DROP, Human-Eval, GSM8K) and data distributions (IID and non-IID with Dirichlet α ∈ {0.1, 0.5, 1.0}).
Addressing a Key Challenge: FedASK tackles a critical dilemma in federated LoRA: balancing privacy (via DP) with model performance.

There are some Weaknesses in this paper:
Limited Model Scope: The experiments are conducted only on Llama-2 models (7B and 13B).
Fixed Local Matrix Strategy: FedASK fixes the A matrix during local updates within a communication round, which may constrain learning dynamics.
Narrow Task Focus: The evaluation focuses on standard language and reasoning tasks (MMLU, DROP, etc.).

QUESTIONS:
The paper validates FedASK on Llama-2 models (7B and 13B) for standard language and reasoning tasks (MMLU, DROP, Human-Eval, GSM8K). How does FedASK perform on other model architectures (e.g., vision transformers or diffusion models) or more complex tasks (e.g., reinforcement learning with human feedback, RLHF)?

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 2
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-04