Pith. sign in

REVIEW 2 major objections 6 minor 51 references

Label Privacy in Split Learning for Large Models with Parameter-Efficient Training

T0 review · 2 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Split learning can hide training labels behind mixed adapters and masked gradients.

desk verdict A useful, honest empirical protocol for label privacy in split learning with PEFT, but the advertised 'label private' claim holds only under non-colluding servers or TEEs. read the letter →

arxiv 2412.16669 v1 pith:4BMIRKHB submitted 2024-12-21 cs.LG cs.CR

Philip Zmushko , Marat Mansurov , Ruslan Svirschevski , Denis Kuznedelev , Max Ryabinin , Aleksandr Beznosikov This is my paper · ORCID
classification cs.LGcs.CR
keywords labelprivacysplitlearningLoRAparameter-efficientfine-tuningverticalfederatedgradientobfuscationadversarialregularizationAPI
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that label privacy in API fine-tuning of large models does not require changing the base model, the loss, or the LoRA adapters; it can be obtained by an orchestration protocol that exploits properties of parameter-efficient training. It first shows that ordinary LoRA split learning leaks labels through both communicated gradients and learned activations, as demonstrated by clustering and classifier attacks. The proposed method, P3EFT, hides gradients by splitting each true gradient into random pieces sent to different servers, and hides activations by training several adapters whose outputs are mixed with secret weights while an adversarial regularizer stops individual adapters from encoding the label. On DeBERTa, Flan-T5, and LLaMA-2 across GLUE tasks, the paper reports near-baseline accuracy, such as 96.5% versus 96.9% on SST-2 with DeBERTa, with measured label leakage much lower than standard fine-tuning and competitive with the distance-correlation defense.

What carries the argument

The machinery is the conditional linearity of backpropagation, $\mathrm{backprop}(x,\theta,g_h)=g_\theta$, which holds for fixed $x,\theta$ even when the model is nonlinear because backprop multiplies $g_h$ by the Jacobian $\partial h(x,\theta)/\partial\theta$. This turns private gradient computation into a linear secret-sharing problem: the client writes $g_h=\sum_{i=1}^{m}\alpha_i\hat{g}^{(i)}_h$ with large random pieces, sends each piece to a separate server, and recovers $g_\theta=\sum_i\alpha_i\,\mathrm{backprop}(x,\theta,\hat{g}^{(i)}_h)$ exactly. For activation protection, the client keeps $n$ LoRA adapter sets $\theta_1,\dots,\theta_n$ and merges their outputs with randomly generated mixing weights $W$, initialized so the mixture equals the mean of the individual activations at step zero; an adversarial linear head per adapter serves as a regularizer so no single $h(x,\theta_i)$ predicts the label.

What would settle it

Collect the per-server gradient pieces and adapter states from a P3EFT run in which the same provider executes both calls and logs consecutive optimizer states, then train a classifier to recover batch labels from the pieces; if the classifier achieves test AUC far above chance on a balanced set, the non-collusion assumption is doing the work and label privacy fails in single-provider deployments.

Watch

Extended reading notes

Core claim

The central claim is that label privacy in the two-party split-learning setup can be maintained throughout training with a significantly smaller accuracy drop than previous defenses, and the mechanism is specific to parameter-efficient fine-tuning. Concretely, the paper shows that backpropagation is conditionally linear in the output gradient for fixed inputs and adapter weights, so a client can decompose its gradient into m random pieces, send one piece to each of m non-colluding servers, and recover the exact parameter gradient by a weighted sum without any server seeing the true gradient. For activations, the client keeps n independent LoRA adapter sets and combines their outputs with a secret coordinatewise mixing matrix, so the mixed model matches the standard fine-tuning objective while each individual adapter's activations carry no label information. A client-side adversarial linear head regularizer, applied to each adapter separately, prevents the adapters from learning to leak labels over time. The experiments support that this combination achieves accuracy close to unperturbed LoRA fine-tuning while reducing worst-case privacy leakage on the tested metrics.

Load-bearing premise

The protocol only protects labels if the servers that receive the scrambled gradient pieces never cooperate, never see consecutive optimizer states, and faithfully run the prescribed computations; a single provider that logs both calls can undo the hiding.

Editorial extensions

If this is right

  • If P3EFT is correct, any existing LoRA fine-tuning workload can be made label-private by wrapping the API calls in the private-backprop procedure and training several adapter copies, without retraining the base model or changing the loss.
  • Because the reconstructed parameter gradient is exactly the true gradient, the private-backprop part of P3EFT does not change the training dynamics at all; the entire accuracy cost comes from activation mixing and the adversarial regularizer.
  • The protocol transfers to other PEFT methods and to any vertical split-learning setting where gradients must propagate through an untrusted party, not only the NLP benchmarks tested.
  • For single-provider fine-tuning APIs, the paper's privacy guarantee requires trusted execution environments or some other way to make consecutive calls non-linkable; without that, the label-privacy claim does not apply in the most common deployment.
  • The paper's ablation suggests that even a single adapter set, trained with the private-backprop and regularizer machinery, can be competitive, indicating a simpler deployment path than the full multi-adapter scheme.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: if a server can observe many mixed activations across batches, it may attempt blind source separation to estimate the mixing weights $W$; the paper does not analyze this attack, and it would be the natural next test of the activation-hiding component.
  • Editorial extension: the white-box analysis in the appendix suggests that $m=B$ (one piece per batch element) protects all labels in a single-server batch, implying a concrete scale-up path where the client sends one basis vector per example rather than per gradient.
  • Editorial extension: the authors' own framing points toward combining P3EFT with input-privacy methods; a practical privacy mode in an API would likely need both, since the input text itself can carry label information.
  • Editorial extension: if P3EFT were deployed by an API provider using trusted execution environments, the method would give clients label privacy without requiring them to run any part of the model locally, which is a stronger practical guarantee than prior prompt-tuning-only defenses.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper studies label leakage in split learning / API fine-tuning with parameter-efficient fine-tuning (PEFT). It observes that backpropagation is linear in the output gradient for fixed inputs and parameters, and builds on this to design private_backprop (Algorithm 1), which decomposes the client's gradient into m obfuscated pieces sent to independent servers and exactly recovers the true gradient by linearity. To protect activations, the full P3EFT algorithm (Algorithm 2) trains n LoRA adapter sets with randomized mixing weights (Eq. 4-5) and an adversarial regularizer (Eq. 7). Experiments on DeBERTa-v2-XXLarge, Flan-T5-Large, and LLaMA-2 7B over SST-2, QNLI, and MNLI report that P3EFT retains accuracy close to non-private LoRA fine-tuning while reducing empirical leakage relative to regular fine-tuning and the distance-correlation baseline. Appendix C provides a white-box, per-step analysis of private_backprop, and Appendix B reports an additional PSLF baseline and an ablation on the number of adapters.

Significance. The conditional-linearity observation underlying private_backprop is elegant, and the exact gradient reconstruction is a useful protocol primitive for vertical split learning with PEFT. The experimental coverage is broad: three model families with up to 7B parameters, several GLUE tasks, and a released codebase. The paper is also transparent about several limitations. If the multi-server non-collusion assumption holds, P3EFT provides a practical way to reduce label leakage without replacing the base model, loss, or LoRA adapters. However, the headline claim that labels are kept private 'throughout training' is not supported in the standard single-provider API setting, and the full algorithm has no formal privacy guarantee; the reported leak metrics are attack-based empirical values rather than privacy bounds. The contribution is solid within its stated assumptions, but the claims need to be narrowed and the trajectory-attack gap needs to be addressed.

major comments (2)
  1. [Section 3.3, consecutive-steps attack] The paper's headline claim that P3EFT 'can maintain label privacy throughout training' (Abstract and Section 1) is not supported in the primary fine-tuning-API setting it targets. As the text itself concedes in Section 3.3, if the same server receives two consecutive parameter sets θ_t and θ_{t+1}, it can invert the optimizer update (e.g., g_θ = (θ_t − θ_{t+1})/η under SGD) and, when the Jacobian is invertible, recover g_h. A standard fine-tuning API is operated by one provider, so that provider observes every obfuscated backprop piece and every adapter state over the whole trajectory; this re-opens the Section 3.2 gradient-based label-recovery attacks regardless of the per-piece noise variance. The mitigations mentioned in Section 3.3 (non-colluding servers or trusted execution environments) are not analyzed, evaluated, or incorporated into the threat model used for the experiments. To make the central claim defensible, the paper should either restrict the privacy claims to the multi-server/TEE setting with an explicit threat model, or provide and evaluate a concrete mechanism that provably prevents trajectory inversion (for example, securely hidden optimizer statistics) and show that it does not degrade training.
  2. [Section 3.4 and Appendix C] Appendix C analyzes only Algorithm 1 (private_backprop), under a white-box attacker, for a single batch/step, and for binary classification; the full P3EFT algorithm with randomized mixing weights (Eq. 4-5) and the adversarial regularizer (Eq. 7) has no formal privacy analysis. The privacy scores in Tables 1-3 are empirical attack-based metrics (ROC AUC, K-means accuracy), not privacy guarantees, so the abstract's phrase 'keeping the labels private' is stronger than what is demonstrated. I recommend either reframing the claims as resistance to the tested attacks or providing a formal guarantee for the full protocol. Additionally, the single-server case in Appendix C requires m ≥ B pieces per batch, so the communication cost of privacy-preserving backprop grows linearly in batch size; this cost should be stated explicitly in the main text alongside the claim that P3EFT has low overhead.
minor comments (6)
  1. [Algorithm 2, line 19] The return statement in Algorithm 2 refers to an index M that is not defined; it should be n, the number of adapter sets.
  2. [Section 2.2] The text contains a broken cross-reference to 'Appendix ??' for the detailed LoRA description; the reference should be resolved.
  3. [Equation (5)] The definition of the mixing weights W in Eq. (5) is hard to parse: W is written as a column of row vectors, while the text uses W_i ⊙ h(x, θ_i). Please define W_i as the i-th row explicitly and make the dimensions of all quantities clear.
  4. [Abstract and body] The abstract uses P$^3$EFT while the body consistently uses P3EFT; please unify the notation.
  5. [Section 4.1] In the private-backprop experiment, the text says 'n = 2 with noise variance set to 1000,' but Algorithm 1 uses the parameter m for the number of shards and z for the noise; please clarify whether n here is m and what distribution z is drawn from.
  6. [Tables 4 and 7] The rows with ε = 0 in the PSLF baseline are described as 'random labels'; since label differential privacy is usually defined with ε > 0, consider presenting these runs as an ablation of the privacy budget rather than as part of the DP grid.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: private_backprop is an exact linear decomposition and the privacy claim is explicitly conditional on stated assumptions, not derived from its own conclusion.

full rationale

The paper's derivation chain is self-contained and does not reduce to its inputs. The core private_backprop construction (Section 3.3, Eqs. 1-3) is an exact algebraic identity: backprop is linear in output gradients for fixed x and theta, so the client decomposes g_h into m pieces and recovers g_theta = sum_j alpha_j * backprop(x, theta, g^j_h) by linearity. This recovery is exact by construction and does not fit or presuppose any target result; the reported accuracy of P3EFT comes from running this protocol plus the activation-mixing regularizer, not from an equation that assumes the conclusion. The adversarial regularizer and mixing weights are design choices evaluated against external baselines (Regular FT, DC, PSLF) and standard benchmarks (GLUE), and the alpha hyperparameter is selected by ordinary grid search, not a fitted quantity renamed as a prediction. The paper explicitly states the load-bearing assumptions: independent non-colluding servers or TEEs are needed to prevent trajectory inversion (Section 3.3), the theoretical analysis covers only a single batch under a white-box model (Appendix C), and long-term client-provider interaction attacks are left to future work (Section 5). Thus the privacy claim is conditional, but the conditionality is disclosed rather than hidden. The only self-citation with author overlap (Petals, Borzunov et al. 2022) is used merely to illustrate a flexible fine-tuning API archetype and is not load-bearing for any technical claim. Overall, no step reduces by definition, by fitted input, or by a self-citation chain to its own inputs.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The protocol rests on exact linearity of backpropagation, an assumption of non-colluding independent servers, a stateless deterministic API, and attack-based leakage metrics. No new physical or external entities are introduced. The free parameters are hyperparameters or under-reported configuration choices that affect the empirical results more than the mathematical core.

free parameters (4)
  • Regularization weight alpha = Powers of sqrt(10), per model and dataset; for example 10^(1/2) for DeBERTa on all tasks and 10^(-1/2) for Flan-T5…
    Tuned by grid search to control the utility-privacy trade-off; the central reported results depend on this choice.
  • Gradient obfuscation noise variance Var(z) = 1000 (Section 4.1 gradient experiment)
    Chosen so the noise dominates ||g_h||^2; it affects attack resistance, but no formal criterion is given for selecting it.
  • Number of adapter sets n = 2 in main results; ablation at 1, 3, 4 (Table 8)
    Hyperparameter selected for the main experiments; the paper reports that n has minimal influence on privacy and accuracy.
  • Number of obfuscated gradient pieces m = Not reported in the main experimental tables; Appendix C discusses m=2 and m=B
    Central to gradient privacy, but missing from the experiment setup, so a key implementation detail is under-specified.
assumptions (5)
  • standard math Backpropagation is linear in output gradients for fixed inputs and fixed adapter weights (Equation 1).
    Used by Algorithm 1 to split one gradient into a weighted sum of obfuscated pieces; it is a chain-rule fact and is stated explicitly in Section 3.3.
  • domain assumption Servers are honest-but-curious, independent, and non-colluding; no single server sees all m obfuscated backprop calls or consecutive adapter states.
    Sections 3.1 and 3.3. If servers collude, they can add the random pieces or invert optimizer updates and recover label-relevant gradients.
  • domain assumption The fine-tuning API is stateless, deterministic, and lets the client run individual forward and backward calls over a remote model.
    Section 3.1 defines this API archetype. Real proprietary APIs may not expose this level of flexibility, which limits the practical scope.
  • domain assumption Inputs X are public or protected separately; only labels Y are in scope for privacy.
    Section 1 explicitly frames label privacy as the goal and leaves input privacy to future work.
  • domain assumption The three evaluated attacks (spectral AUC, norm AUC, k-means accuracy) are sufficient to measure label privacy.
    The paper reports the worst of these metrics as the leakage value, but does not prove that they cover all realistic label-inference attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Label Privacy in Split Learning for Large Models with Parameter-Efficient Training." pith.science (2026). https://pith.science/paper/4BMIRKHB

@misc{pith2026241216669,
  author       = {Pith},
  title        = {Pith review of: Label Privacy in Split Learning for Large Models with Parameter-Efficient Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4BMIRKHB}},
  note         = {Machine review of arXiv:2412.16669}
}
abstract

As deep learning models become larger and more expensive, many practitioners turn to fine-tuning APIs. These web services allow fine-tuning a model between two parties: the client that provides the data, and the server that hosts the model. While convenient, these APIs raise a new concern: the data of the client is at risk of privacy breach during the training procedure. This challenge presents an important practical case of vertical federated learning, where the two parties perform parameter-efficient fine-tuning (PEFT) of a large model. In this study, we systematically search for a way to fine-tune models over an API while keeping the labels private. We analyze the privacy of LoRA, a popular approach for parameter-efficient fine-tuning when training over an API. Using this analysis, we propose P$^3$EFT, a multi-party split learning algorithm that takes advantage of existing PEFT properties to maintain privacy at a lower performance overhead. To validate our algorithm, we fine-tune DeBERTa-v2-XXLarge, Flan-T5 Large and LLaMA-2 7B using LoRA adapters on a range of NLP tasks. We find that P$^3$EFT is competitive with existing privacy-preserving methods in multi-party and two-party setups while having higher accuracy.

Figures

Figures reproduced from arXiv: 2412.16669 by the authors.

Figure 1
Figure 1. An intuitive illustration of the proposed fine-tuning protocol. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. A visualization of top-2 principal components of gradients (top) and activations (bottom) [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Gradients of cross-entropy w.r.t. LoRA parameters for DeBERTa-v2-XXLarge. The top [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 19 canonical work pages

  1. [1]

    Practical secure aggregation for privacy-preserving machine learning

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 1175--1191, 2017

    work page 2017

  2. [2]

    Petals: Collaborative inference and fine-tuning of large models

    Alexander Borzunov, Dmitry Baranchuk, Tim Dettmers, Max Ryabinin, Younes Belkada, Artem Chumachenko, Pavel Samygin, and Colin Raffel. Petals: Collaborative inference and fine-tuning of large models. arXiv preprint arXiv:2209.01188, 2022. URL https://arxiv.org/abs/2209.01188

    arXiv 2022

  3. [3]

    XGBoost : A scalable tree boosting system

    Tianqi Chen and Carlos Guestrin. XGBoost : A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD '16, pp.\ 785--794, New York, NY, USA, 2016. ACM. ISBN 978-1-4503-4232-2. doi:10.1145/2939672.2939785. URL http://doi.acm.org/10.1145/2939672.2939785

    arXiv 2016

  4. [4]

    Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoc V

    Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, Albert Webson, Shixiang Shane Gu, Zhuyun Dai, Mirac Suzgun, Xinyun Chen, Aakanksha Chowdhery, Sharan Narang, Gaurav Mishra, Adams Yu, Vincent Zhao, Yanping Huang, Andrew Dai, Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dean,...

    arXiv 2022

  5. [5]

    Qlora: Efficient finetuning of quantized llms

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: Efficient finetuning of quantized llms. arXiv preprint arXiv:2305.14314, 2023

    arXiv 2023

  6. [6]

    D reambooth A P I – E asily finetune S table D iffusion and generate customised A I images --- dreamboothapi.ai

    Dreambooth API . D reambooth A P I – E asily finetune S table D iffusion and generate customised A I images --- dreamboothapi.ai. https://dreamboothapi.ai/, 2024. [Accessed 28-09-2024]

    work page 2024

  7. [7]

    Flocks of stochastic parrots: Differentially private prompt learning for large language models

    Haonan Duan, Adam Dziedzic, Nicolas Papernot, and Franziska Boenisch. Flocks of stochastic parrots: Differentially private prompt learning for large language models. arXiv preprint arXiv:2305.15594, 2023

    arXiv 2023

  8. [8]

    Differential privacy

    Cynthia Dwork. Differential privacy. In International colloquium on automata, languages, and programming, pp.\ 1--12. Springer, 2006

    2006

Show all 51 references
  1. [9]

    Unsupervised domain adaptation by backpropagation

    Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In Francis Bach and David Blei (eds.), Proceedings of the 32nd International Conference on Machine Learning, volume 37 of Proceedings of Machine Learning Research, pp.\ 1180--1189, Lille, F...

    2015

  2. [10]

    Distributed learning of deep neural network over multiple agents

    Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116: 0 1--8, 2018. ISSN 1084-8045. doi:https://doi.org/10.1016/j.jnca.2018.05.003. URL https://www.sciencedirect.com/science/article...

    2018 doi

  3. [11]

    WARP : W ord-level A dversarial R e P rogramming

    Karen Hambardzumyan, Hrant Khachatrian, and Jonathan May. WARP : W ord-level A dversarial R e P rogramming. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Vo...

    2021 doi

  4. [12]

    Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption, 2017

    Stephen Hardy, Wilko Henecka, Hamish Ivey-Law, Richard Nock, Giorgio Patrini, Guillaume Smith, and Brian Thorne. Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption, 2017

    2017

  5. [13]

    Deberta: Decoding-enhanced bert with disentangled attention

    Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: Decoding-enhanced bert with disentangled attention. In International Conference on Learning Representations, 2021. URL https://openreview.net/forum?id=XPZIaotutsD

    2021

  6. [14]

    Parameter-efficient transfer learning for NLP

    Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter-efficient transfer learning for NLP . In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th Intern...

    2019

  7. [15]

    Lo RA : Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lo RA : Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=nZeVKeeFYf9

    2022

  8. [16]

    A uto T rain --- huggingface.co

    Hugging Face . A uto T rain --- huggingface.co. https://huggingface.co/autotrain, 2024. [Accessed 28-09-2024]

    2024

  9. [17]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  10. [18]

    Label leakage and protection in two-party split learning

    Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. Label leakage and protection in two-party split learning. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=cOtBRgsf2fO

    2022

  11. [19]

    A survey on federated learning systems: Vision, hype and reality for data privacy and protection

    Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Transactions on Knowledge and Data Engineering, 2021

    2021

  12. [20]

    PyTorch RPC: Distributed Deep Learning Built on Tensor-Optimized Remote Procedure Calls

    Shen Li, Pritam Damania, Luca Wehrstedt, and Rohan Varma. PyTorch RPC: Distributed Deep Learning Built on Tensor-Optimized Remote Procedure Calls . In Proceedings of Machine Learning and Systems 5 (MLSys), 2023 a

    2023

  13. [21]

    Prefix-tuning: Optimizing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Pap...

    2021 doi

  14. [22]

    Privacy-preserving prompt tuning for large language model services

    Yansong Li, Zhixing Tan, and Yang Liu. Privacy-preserving prompt tuning for large language model services. ArXiv, abs/2305.06212, 2023 b . URL https://api.semanticscholar.org/CorpusID:258588141

    2023

  15. [23]

    Differentially private low-rank adaptation of large language model using federated learning

    Xiao-Yang Liu, Rongyi Zhu, Daochen Zha, Jiechao Gao, Shan Zhong, and Meikang Qiu. Differentially private low-rank adaptation of large language model using federated learning. arXiv preprint arXiv:2312.17493, 2023

    2023 arXiv

  16. [24]

    Communication-Efficient Learning of Deep Networks from Decentralized Data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-Efficient Learning of Deep Networks from Decentralized Data . In Aarti Singh and Jerry Zhu (eds.), Proceedings of the 20th International Conference on Artificial Intelligence an...

    2017

  17. [25]

    N vidia confidential computing

    Nvidia . N vidia confidential computing. https://www.nvidia.com/en-us/data-center/solutions/confidential-computing, 2024. [Accessed 28-09-2024]

    2024

  18. [26]

    F ine-tuning S table D iffusion --- docs.octoai.cloud

    OctoAI . F ine-tuning S table D iffusion --- docs.octoai.cloud. https://octo.ai/docs/media-gen-solution/fine-tuning-stable-diffusion/fine-tuning-stable-diffusion, 2024. [Accessed 28-09-2024]

    2024

  19. [27]

    O pen A I P latform --- platform.openai.com

    OpenAI . O pen A I P latform --- platform.openai.com. https://platform.openai.com/docs/guides/fine-tuning, 2024. [Accessed 28-09-2024]

    2024

  20. [28]

    Unleashing the tiger: Inference attacks on split learning

    Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. Unleashing the tiger: Inference attacks on split learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS '21, pp.\ 2113–2129, New York, NY, USA, 2021. Association for Comp...

    2021

  21. [29]

    Adapterfusion: Non-destructive task composition for transfer learning, 2021

    Jonas Pfeiffer, Aishwarya Kamath, Andreas Rücklé, Kyunghyun Cho, and Iryna Gurevych. Adapterfusion: Non-destructive task composition for transfer learning, 2021

    2021

  22. [30]

    Bittensor: A peer-to-peer intelligence market, 2021

    Yuma Rao, Jacob Steeves, Ala Shaabana, Daniel Attevelt, and Matthew McAteer. Bittensor: A peer-to-peer intelligence market, 2021

    2021

  23. [31]

    Just fine-tune twice: Selective differential privacy for large language models

    Weiyan Shi, Ryan Shea, Si Chen, Chiyuan Zhang, Ruoxi Jia, and Zhou Yu. Just fine-tune twice: Selective differential privacy for large language models. arXiv preprint arXiv:2204.07667, 2022

    2022 arXiv

  24. [32]

    Manning, Andrew Ng, and Christopher Potts

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Proces...

    2013

  25. [33]

    Label leakage and protection from forward embedding in vertical federated learning

    Jiankai Sun, Xin Yang, Yuanshun Yao, and Chong Wang. Label leakage and protection from forward embedding in vertical federated learning. arXiv preprint arXiv:2203.01451, 2022

    2022 arXiv

  26. [34]

    A survey on deep transfer learning

    Chuanqi Tan, Fuchun Sun, Tao Kong, Wenchang Zhang, Chao Yang, and Chunfang Liu. A survey on deep transfer learning. In V e ra K u rkov \'a , Yannis Manolopoulos, Barbara Hammer, Lazaros Iliadis, and Ilias Maglogiannis (eds.), Artificial Neural Networks and Machine Learning -- ...

    2018

  27. [35]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  28. [36]

    Split learning for health: Distributed deep learning without sharing raw patient data, 2018

    Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. Split learning for health: Distributed deep learning without sharing raw patient data, 2018

    2018

  29. [37]

    Reducing leakage in distributed deep learning for sensitive health data

    Praneeth Vepakomma, Otkrist Gupta, Abhimanyu Dubey, and Ramesh Raskar. Reducing leakage in distributed deep learning for sensitive health data. 05 2019

    2019

  30. [38]

    Pslf: Defending against label leakage in split learning

    Xinwei Wan, Jiankai Sun, Shengjie Wang, Lei Chen, Zhenzhe Zheng, Fan Wu, and Guihai Chen. Pslf: Defending against label leakage in split learning. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pp.\ 2492--2501, 2023

    2023

  31. [39]

    Glue: A multi-task benchmark and analysis platform for natural language understanding

    Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bowman. Glue: A multi-task benchmark and analysis platform for natural language understanding. arXiv preprint arXiv:1804.07461, 2018

    2018 arXiv

  32. [40]

    Privatelora for efficient privacy preserving llm

    Yiming Wang, Yu Lin, Xiaodong Zeng, and Guannan Zhang. Privatelora for efficient privacy preserving llm. arXiv preprint arXiv:2311.14030, 2023

    2023 arXiv

  33. [41]

    Randomized response: A survey technique for eliminating evasive answer bias

    Stanley L Warner. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American statistical association, 60 0 (309): 0 63--69, 1965

    1965

  34. [42]

    A broad-coverage challenge corpus for sentence understanding through inference

    Adina Williams, Nikita Nangia, and Samuel R Bowman. A broad-coverage challenge corpus for sentence understanding through inference. arXiv preprint arXiv:1704.05426, 2017

    2017 arXiv

  35. [43]

    Offsite-tuning: Transfer learning without full model

    Guangxuan Xiao, Ji Lin, and Song Han. Offsite-tuning: Transfer learning without full model. arXiv preprint arXiv:2302.04870, 2023

    2023 arXiv

  36. [44]

    Federated machine learning: Concept and applications

    Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. ACM Trans. Intell. Syst. Technol., 10 0 (2), jan 2019. ISSN 2157-6904. doi:10.1145/3298981. URL https://doi.org/10.1145/3298981

    2019 doi

  37. [45]

    Differentially private fine-tuning of language models

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. In International Conference on Learni...

    2022

  38. [46]

    F ed PET uning: When federated learning meets the parameter-efficient tuning methods of pre-trained language models

    Zhuo Zhang, Yuanhang Yang, Yong Dai, Qifan Wang, Yue Yu, Lizhen Qu, and Zenglin Xu. F ed PET uning: When federated learning meets the parameter-efficient tuning methods of pre-trained language models. In Findings of the Association for Computational Linguistics: ACL 2023, pp.\...

    2023 doi

  39. [47]

    Fedprompt: Communication-efficient and privacy preserving prompt tuning in federated learning, 2023

    Haodong Zhao, Wei Du, Fangqi Li, Peixuan Li, and Gongshen Liu. Fedprompt: Communication-efficient and privacy preserving prompt tuning in federated learning, 2023

    2023

  40. [48]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  41. [49]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  42. [50]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  43. [51]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.