Domain Private Transformers for Multi-Domain Dialog Systems (2023)

Abstract: Large, general purpose language models have demonstrated impressive performance across many different conversational domains. While multi-domain language models achieve low overall perplexity, their outputs are not guaranteed to stay within the domain of a given input prompt. This paper proposes domain privacy as a novel way to quantify how likely a conditional language model will leak across domains. We also develop policy functions based on token-level domain classification, and propose an efficient fine-tuning method to improve the trained model’s domain privacy. Experiments on membership inference attacks show that our proposed method has comparable resiliency to methods adapted from recent literature on differentially private language models.

## introduction large language models have enabled significant progress in machine learning and nlp across a wide range of tasks and domains @xcite . they perform especially well in settings where little training data is available for new domains of interest. a popular approach in such settings is transfer learning: fine-tune a pretrained model on data from specialized domains @xcite @xcite @xcite . here, performance is typically measured in perplexity (or a task-specific metric) for each new domain while controlling for model complexity or data @xcite . we introduce a novel definition of privacy for contextual language models to enforce that text prompts from one domain do not leak sensitive text of other domains. practitioners train generative models on datasets often curated from diverse domains, e.g. news article categories or dialog tasks. model users are often then interested in safe * work done at asapp inc generation: models when prompted with text from one domain must not generate sensitive text from other domains. safe generation is a key requirement for model providers who pool datasets from many contracted companies-each company might require the model to not generate their sensitive text when prompted with text from other companies. we call such safe generation domain privacy. let {d 1 , . . . , d n } be domains from which datasets are created. let m d be a model trained on text dataset d. to verify if m d is domain private for domain d i , we can prompt the model with contexts {c i } from domain d i , and check if the generations contain sensitive text of domains d j for j ̸ = i. our contributions are: we 1) define domain privacy as a new property for contextual language models, 2) propose fine-tuning algorithms that trade off domain privacy for model performance, and 3) conduct extensive experiments for text generation with multi-domain datasets. domain privacy scales well with the number of domains, and allows for flexible definitions of domain-sensitive text. our proposed fine-tuning algorithms utilize differentially-private training to attain domain privacy, while achieving good performance. ## preliminaries we recall a few definitions first. see appendix a for further details. ## domain privacy consider two domains d i and d j where i ̸ = j. the goal of domain privacy is to check how likely a model is to generate sensitive text from domain d j when prompted with text from domain d i . to check if text contains private tokens of domain d j , we can use a policy function f j . since domains d i and d j could have inherent overlap, e.g. politics and sports news overlapping due to geopolitics, we will use m d j as a reference model where d @xmath0. the likelihood of m d j leaking sensitive text of d j serves as an upper bound for the target model leakage. here d and d j are neighbors at domain level w.r.t. f j as they differ in one domain. ## methodology next we study domain privacy applied to the problem of generating dialog text. ## experiments 6.1 datasets we use the multidogo dataset @xcite , which consists of task-oriented dialogs of useragent customer service simulation from 6 domains. we use the 3 largest domains: airline (air travel bookings), media (telecommunication and cable), and insurance (policy modifications). we preprocess the dataset by adding control tokens to each dialog, such as speaker tokens, start-of-@xmath1, an end-of-@xmath2, and domain-name (e.g. <@xmath3. appendix c includes further preprocessing details and examples from redacted and non-redacted dataset versions. foot_0 ## conclusions this paper compares multi-domain language models for dialog data on a new concept of domain privacy. we propose two policies for redacting domain-sensitive tokens, enabling recent differentially-private training algorithms to be used for preserving domain privacy. future research directions include studying the domain privacy properties of additional training strategies, and understanding the interplay between domain privacy and performance on downstream tasks.