DP-SelFT: Differentially Private Selective Fine-Tuning for Large Language Models

TL;DR

DP-SelFT introduces a novel differentially private selective fine-tuning framework for large language models, improving privacy-utility trade-offs by layer-level parameter selection using synthetic data and robustness to noise.

Contribution

It proposes a new method for DP fine-tuning that selects parameters based on synthetic data and robustness, reducing utility loss and privacy costs.

Findings

Consistently outperforms existing DP fine-tuning baselines.

Uses synthetic data for parameter selection to avoid privacy costs.

Enhances robustness of selected parameters to DP noise.

Abstract

Large language models (LLMs) are commonly adapted to downstream tasks through fine-tuning, but fine-tuning data often contains sensitive information that may be leaked by the resulting model. Differential privacy (DP) offers formal protection against such leakage, yet DP fine-tuning of LLMs still suffers from substantial utility degradation due to gradient clipping and noise injection. Existing work improves this trade-off by combining DP with parameter-efficient fine-tuning methods such as LoRA, which constrain the form of updates. In this work, we study a complementary direction: selective fine-tuning, which constrains where updates are applied. We propose DP-SelFT, a framework for differentially private selective fine-tuning of LLMs. DP-SelFT addresses three DP-specific challenges in parameter selection: avoiding repeated privacy cost, improving stability under noisy estimates, and selecting parameters that remain useful under clipped and noisy updates. It first constructs a lightweight DP synthetic dataset and performs selection only on this synthetic data, so the selection stage incurs no additional privacy cost. It then conducts layer-level selection by temporarily training candidate layer subsets on a synthetic training split and evaluating them on a synthetic validation split. Crucially, this temporary training is performed under a perturbation regime matched to downstream DP fine-tuning, with worst-case perturbations of the same scale as DP noise. This favors layer subsets that are not only learnable but also robust to noisy private updates. Experiments on benchmark tasks show that DP-SelFT consistently improves the privacy--utility trade-off over existing DP fine-tuning baselines under the same privacy guarantees.