Promoting Data and Model Privacy in Federated Learning through Quantized L o RA (2024)

Abstract: Conventional federated learning primarily aims to secure the privacy of data distributed across multiple edge devices, with the global model dispatched to edge devices for parameter updates during the learning process. However, the development of large language models (LLMs) requires substantial data and computational resources, rendering them valuable intellectual properties for their developers and owners. To establish a mechanism that protects both data and model privacy in a federated learning context, we introduce a method that just needs to distribute a quantized version of the model’s parameters during training. This method enables accurate gradient estimations for parameter updates while preventing clients from accessing a model whose performance is comparable to the centrally hosted one. Moreover, we combine this quantization strategy with LoRA, a popular and parameter-efficient fine-tuning method, to significantly reduce communication costs in federated learning. The proposed framework, named FedLPP, successfully ensures both data and model privacy in the federated learning context. Additionally, the learned central model exhibits good generalization and can be trained in a resource-efficient manner.

## introduction as large language models (llms) @xcite @xcite @xcite @xcite continue to advance, their applications are proliferating across various fields, including healthcare @xcite , finance @xcite , and the mobile keyboard @xcite . these applications often involve training llms on data that is distributed across multiple clients or edge devices, with stringent privacy constraints on * corresponding author. in traditional fl, the main focus has been ensuring data privacy. the central server sends the global model to clients, who update the model parameters locally and then send the updates back to the server. however, as llms become more sophisticated and valuable, the models themselves become critical intellectual property (ip) that also requires protection. this necessity is especially clear when llms are commercialized as paid services, where unauthorized access to the models could significantly undermine the interests of the developers and owners. there are two ways to maintain intellectual property. one traditional method is to apply for a patent to protect the unique design from being copied. another method is through secrecy (such as a unique recipe). in our scenario, where almost all generative language models currently use transformer architecture @xcite , the network weights are akin to a unique recipe. we protect the intellectual property of the owner by safeguarding the model privacy. this new scenario in fl indicates that clients, as custodians of private data, are restricted from accessing the model on the server. similarly, the server, as the owner of the fl product, is not authorized to collect data dispersed among different clients. this raises the question: is there a framework that can simultaneously protect both data and model privacy ? unfortunately, existing fl frameworks mainly focus on data privacy, neglecting model privacy, leaving the model's intellectual property vulnerable to potential breaches. take fedavg, the most widely used fl algorithm, as an example, clients to the best of our knowledge, only one existing study, fedsp @xcite , has attempted to address llm privacy protection in fl. the fedsp approach involves constructing a proxy model at the onset of the fl process, which clients download from the server rather than the actual global llm, avoiding the need to share the global llm. however, fedsp necessitates the server to have access to a labeled dataset that is identically and independently distributed (iid) to the clients' data, which is often impractical in real-world fl. therefore, we need an algorithm that does not rely on such a dataset. recognizing these limitations, we introduce a novel approach, fedlpp (fl with llm privacy protection) , to address the dual challenges of protecting both data and model privacy, without requiring any auxiliary dataset for the server. as shown in fig 1 , our proposed framework leverages quantization techniques and parameter-efficient fine-tuning (peft) @xcite @xcite @xcite strategies to ensure that clients can access only a quantized version of the model's parameters. this prevents clients from obtaining a model that performs comparably to the central one while still allowing accurate gradient estimations for parameter updates. additionally, by combining this quantization strategy with lora @xcite , we significantly reduce communication costs in fl. in summary, our framework, fedlpp, effectively ensures data and model privacy in fl contexts. the learned central model exhibits strong generalization capabilities and can be trained in a resource-efficient manner, addressing the dual privacy challenges in fl. our contributions are as follows: ## experiments to test if our algorithm maintains good fl performance while preserving both model and data privacy, we conducted extensive experiments in this section, including performance comparisons (see sec 4.4) . additionally, we conducted an ablation analysis of fedlpp , including different fl scenarios (see sec 4.6) , different quantization levels (see sec 4.5) and scaling (see sec 4.6) . ## conclusion in this study, we presented fedlpp, a novel federated learning framework designed to tackle the dual challenges of data privacy and model confidentiality. by integrating a quantization strategy with lora, fedlpp facilitates effective updates to model parameters while significantly reducing communication overhead. our framework ensures that each client participates in the learning process without accessing a full-performance model, thereby protecting the intellectual property rights of model developers. the results demonstrate that fedlpp not only maintains robust privacy protections but also enables the creation of a generalized model with lower resource consumption. moreover, fedlpp is especially well-suited for scenarios where data privacy and intellectual property rights are crucial, offering a practical solution in the rapidly evolving landscape of federated learning.