LoRA-Leak: Membership Inference Attacks Against LoRA Fine-tuned Language Models

TL;DR

This paper introduces LoRA-Leak, a comprehensive framework for evaluating membership inference attacks on LoRA-fine-tuned language models, revealing significant privacy vulnerabilities due to pre-trained model information leakage.

Contribution

It presents LoRA-Leak, the first holistic evaluation framework for MIAs against LoRA fine-tuning, including new attack methods leveraging pre-trained models and analysis of defense strategies.

Findings

LoRA-based LMs are vulnerable to MIAs with high AUC scores.

Pre-trained models contribute to increased information leakage.

Dropout and layer exclusion effectively reduce MIA risks.

Abstract

Language Models (LMs) typically adhere to a "pre-training and fine-tuning" paradigm, where a universal pre-trained model can be fine-tuned to cater to various specialized domains. Low-Rank Adaptation (LoRA) has gained the most widespread use in LM fine-tuning due to its lightweight computational cost and remarkable performance. Because the proportion of parameters tuned by LoRA is relatively small, there might be a misleading impression that the LoRA fine-tuning data is invulnerable to Membership Inference Attacks (MIAs). However, we identify that utilizing the pre-trained model can induce more information leakage, which is neglected by existing MIAs. Therefore, we introduce LoRA-Leak, a holistic evaluation framework for MIAs against the fine-tuning datasets of LMs. LoRA-Leak incorporates fifteen membership inference attacks, including ten existing MIAs, and five improved MIAs that leverage the pre-trained model as a reference. In experiments, we apply LoRA-Leak to three advanced LMs across three popular natural language processing tasks, demonstrating that LoRA-based fine-tuned LMs are still vulnerable to MIAs (e.g., 0.775 AUC under conservative fine-tuning settings). We also applied LoRA-Leak to different fine-tuning settings to understand the resulting privacy risks. We further explore four defenses and find that only dropout and excluding specific LM layers during fine-tuning effectively mitigate MIA risks while maintaining utility. We highlight that under the "pre-training and fine-tuning" paradigm, the existence of the pre-trained model makes MIA a more severe risk for LoRA-based LMs. We hope that our findings can provide guidance on data privacy protection for specialized LM providers.