LoRA Provides Differential Privacy by Design via Random Sketching

TL;DR

This paper demonstrates that LoRA's low-rank adaptation mechanism inherently provides differential privacy by modeling it as noisy gradient fine-tuning, with privacy levels influenced by adaptation rank and batch size.

Contribution

The work offers a theoretical analysis linking LoRA's low-rank adaptation to differential privacy guarantees, explaining its robustness against privacy attacks.

Findings

LoRA's adaptation acts as noisy gradient fine-tuning.

Differential privacy is inherent when adaptation matrices are frozen.

Privacy guarantees depend on adaptation rank and batch size.

Abstract

Low-rank adaptation of language models has been proposed to reduce the computational and memory overhead of fine-tuning pre-trained language models. LoRA incorporates trainable low-rank matrices into some parameters of the pre-trained model, called adapters. In this work, we show theoretically that the low-rank adaptation mechanism of LoRA is equivalent to fine-tuning adapters with noisy batch gradients, with the noise variance being a decreasing function of adaptation rank ($r$). Motivated by this understanding, we prove inherent differential privacy for LoRA when adaptation matrices $A_\ell$ are frozen. We show that various factors, e.g., the adaptation rank and batch size, affect the guaranteed privacy level. Our findings provide useful insights into LoRA and uncovers the reason behind the robustness of models fine-tuned with LoRA to privacy attacks.