Pith. sign in

REVIEW 3 major objections 6 minor 31 references

Can Differentially Private Fine-tuning LLMs Protect Against Privacy Attacks?

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Differentially private fine-tuning substantially reduces both data-extraction and membership-inference risk in language models, even at high privacy budgets, and full fine-tuning gives the best privacy-utility trade-off under DP.

desk verdict Useful empirical grid of DP fine-tuning methods, but the extraction-risk claim rests on a self-generated candidate space and needs a fixed-adversary check before it lands. read the letter →

arxiv 2504.21036 v2 pith:R54R5QGS submitted 2025-04-28 cs.CR cs.AIcs.LG

Hao Du , Shang Liu , Yang Cao This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords differentialprivacyLLMfine-tuningmembershipinferenceattackdataextractionparameter-efficientprivacy-utilitytrade-offexposuremetric
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether differentially private (DP) fine-tuning protects large language models against concrete privacy attacks, not just in theory. It fine-tunes GPT-2 and GPT-2 XL with four methods—full fine-tuning, LoRA, prefix-tuning, and P-tuning—under several privacy budgets, and measures risk with a canary-based data extraction attack and a membership inference attack. The central empirical claim is that DP reduces both risks substantially even at a relatively high budget, while the size of the utility loss depends strongly on the fine-tuning method. Under DP, full fine-tuning achieves the best privacy-utility trade-off, LoRA is the recommended efficient choice, P-tuning favors privacy, and prefix-tuning suffers severe utility degradation and should be avoided. The results matter because they give deployment guidance for privacy-sensitive applications: DP can be practically useful, but only with the right fine-tuning method.

What carries the argument

The argument rests on three measurement instruments. The first is DP-Adam, implemented with book-keeping per-sample gradient clipping, which injects calibrated noise so that no single training sample can strongly influence the model. The second is canary-based extraction: a secret-code sentence is inserted into 0.25% of the training set, the model generates 1,000 candidate continuations from a shared prefix, and the rank of the true canary among those candidates is converted into an exposure score, with higher exposure meaning stronger memorization. The third is SPV-MIA, a membership inference attack that fine-tunes a reference model on self-prompted text from the target model and uses a second-order directional-derivative signal to decide membership. Together these instruments define both sides of the reported privacy-utility trade-off: perplexity measures utility, while exposure and attack AUC measure empirical privacy risk.

What would settle it

Fine-tune a GPT-2 model with full fine-tuning under DP at ε=50 using the paper's canary setup, then compute exposure not against 1,000 model-generated candidates but against a candidate set built from the true secret-code alphabet or an independent external guess list. If the true canary ranks near the top under that alternative candidate space, or if a stronger membership inference attack lifts AUC well above 58%, the claim that even high privacy budgets substantially reduce empirical privacy risk would fail in that setting.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes an empirical, rather than purely theoretical, privacy benefit of DP in fine-tuned LLMs. Without DP, full fine-tuning and LoRA memorize training data strongly: the inserted canary is output at maximum exposure, and SPV-MIA reaches AUC above 80% for both, up to 97.8% for full fine-tuning. Prefix-tuning and P-tuning show markedly lower memorization and MIA risk even without DP. Adding DP with a privacy budget as high as ε=50 cuts exposure strongly for full fine-tuning and LoRA and drives all methods' MIA AUC down to roughly 58%; lowering the budget further gives only marginal additional MIA reduction. In the privacy-utility plane, full fine-tuning sits closest to the lower-left corner and is therefore the best overall option under DP, while prefix-tuning becomes unusable because its perplexity explodes.

Load-bearing premise

The extraction-risk conclusion assumes that the 1,000 model-generated candidates are a meaningful stand-in for the guesses a real adversary would try; if a real adversary's candidate distribution differs, the measured exposure levels may not reflect actual extraction risk.

Editorial extensions

If this is right

  • DP at a high budget like ε=50 still gives large empirical privacy gains, so practitioners do not necessarily need very low budgets to blunt extraction and membership attacks.
  • For privacy-sensitive deployment, full fine-tuning under DP is the best choice when compute allows; otherwise LoRA is preferable when utility matters and P-tuning when privacy matters.
  • Prefix-tuning should not be combined with DP in its current form, since noise destroys its utility.
  • Deploying full fine-tuning or LoRA without DP on sensitive data is risky, since both exhibit near-maximal canary exposure and high MIA success.
  • Beyond the initial DP application, further lowering the budget yields diminishing returns for MIA resistance, so the added utility cost of tiny budgets may not be justified by these attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the apparent 'natural privacy' of prefix-tuning and P-tuning may reflect limited capacity in the updated parameter set; if so, deliberately constraining where PEFT updates land could reduce both memorization and DP noise sensitivity.
  • Inference: because MIA AUC saturates near 58%, the residual signal at high ε may be an artifact of current attacks; a stronger future MIA could reveal membership leakage that this measurement misses.
  • Inference: the model-generated candidate space may underestimate real extraction risk, since a real adversary could guess from a better-informed candidate distribution; the DP exposure results should be re-checked against such distributions before deployment.
  • Inference: the observation that larger models tolerate DP better suggests a testable design rule—when fine-tuning under a fixed budget, prefer the largest model that the compute budget allows.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper empirically studies whether DP-SGD-style training protects GPT-2 and GPT-2 XL during fine-tuning, comparing full fine-tuning with LoRA, prefix-tuning, and P-tuning. Privacy risk is measured with a canary-based generation/exposure probe and with SPV-MIA membership inference, while utility is measured by perplexity. The central claims are that DP degrades utility unevenly across methods (prefix-tuning most), that without DP full fine-tuning and LoRA memorize much more than prefix-tuning and P-tuning, that DP substantially reduces exposure and MIA AUC even at relatively high privacy budgets, and that full fine-tuning offers the best privacy-utility trade-off under DP, with LoRA and P-tuning as practical alternatives and prefix-tuning unsuitable.

Significance. If the empirical claims hold, this is a useful comparative map for practitioners choosing fine-tuning strategies under DP, and it is one of the few studies to vary both fine-tuning method and privacy budget while using two attack families. The paper has clear strengths: it uses established attack implementations (SPV-MIA and Carlini et al.'s exposure), covers two model sizes and four fine-tuning methods, includes a GPT-J control for architecture effects, and reports both utility and attack metrics. The MIA component is credible and internally consistent. However, the extraction-risk component is not yet a valid measure of real attack resistance, and the lack of error bars weakens the quantitative rankings. The paper's practical guidance therefore needs additional support before the headline privacy-utility conclusions can be accepted.

major comments (3)
  1. [3.1 (Definition 1 and Candidates Generation)] The exposure score used for the extraction-risk claims is computed against a candidate set generated by sampling from the fine-tuned model itself (1,000 unique outputs). As the authors acknowledge in Section 3.1, this 'is not a true attack but rather an evaluation technique.' With this construction, the rank in Definition 1 measures how readily the model happens to emit the canary under its own stochastic decoding distribution, not whether an adversary who guesses from a plausible fixed candidate list would identify the canary. Under DP, the model can produce fewer fluent or diverse candidates, so the canary may drop out of the 1,000-sample set even though the canary has the lowest loss among the strings an actual attacker would try. This conflation directly supports Finding 3 and the Section 4.5 privacy-utility trade-off, so the extraction component of those claims is not yet established as real attack resistance. Please add a control with an adversary-independent candidate space (e.g., a fixed list of plausible secret codes or samples from a held-out reference model), or explicitly rescope the claims to 'generation-based memorization' rather than 'data extraction attack resistance.'
  2. [4.4 (Figs. 2-5)] All figures and the narrative report a single run per configuration; there is no mention of random seeds, repeated trials, or error bars. Several of the paper's practical conclusions are comparative rankings that could easily be reversed by run-to-run variance, for example the ordering of LoRA versus P-tuning in Fig. 5 and the relative drops at epsilon=30 versus epsilon=50 in Fig. 2. Please report multiple seeds with standard deviations or confidence intervals for at least the headline comparisons, or soften the ordering claims accordingly.
  3. [4.4 (MIA discussion)] The sentence claiming that with epsilon=1 differential privacy 'guarantees that the success rate of MIA remains below 73%' is not supported by any derivation in the paper and appears to overstate what a DP guarantee provides. DP bounds the advantage of any adversary, but it does not by itself imply a 73% AUC ceiling for SPV-MIA, and the observed values in Fig. 3 are not a theoretical guarantee. This statement should be removed or replaced with a proper derivation, since it is currently used to argue that current MIAs are insufficient against DP-trained models.
minor comments (6)
  1. [4.4 / Fig. 2 caption] The figure caption labels the weak attack as 'Short Prefix' and the strong attack as 'Long Prefix,' but Section 3.1 defines the strong attack as asking for only the final character of the secret code; the caption terminology should be aligned with the threat-model description.
  2. [5 (Future Work)] The Future Work section states that the experiments focused solely on the GPT-2 family, but Section 4.4 reports a GPT-J experiment to rule out architecture effects; this contradiction should be fixed.
  3. [4.2 (Experimental Setup)] The text says the PEFT methods are implemented using 'the peft module available in the Transformers library,' but peft is a separate Hugging Face library; please correct the attribution.
  4. [References] References [5] and [6] appear to be the same paper and should be merged or clearly distinguished.
  5. [3.1 (Definition 1)] The notation in Definition 1 says 'candidate space C represents the number of candidates generated' while the formula uses |C|; clarify that C is the set of candidates and |C| is its cardinality.
  6. [4.3 / Fig. 1] The caption of Fig. 1 does not identify the subplots or the two experimental settings; please add panel labels or a description of which panels correspond to Wikitext-2 and AG News.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: claims are empirical measurements using pre-existing attacks, with an explicit caveat that the exposure probe is an evaluation technique.

full rationale

This paper is an empirical measurement study, not a derivation. It does not fit any parameter to its conclusions, and it does not rename a known result as a prediction. The MIA component uses SPV-MIA from prior work (Fu et al., cited as [11]), and the extraction component uses Carlini et al.'s exposure metric [7], with a model-generated candidate space explicitly described as 'not a true attack but rather an evaluation technique' (Section 3.1). The core claims—that DP reduces measured exposure and MIA AUC, that full fine-tuning and LoRA memorize more without DP, and that full fine-tuning offers the best privacy-utility trade-off under DP—are comparative observations of attack metrics across fine-tuning methods and privacy budgets. No equation in the paper reduces to its own inputs: exposure is defined from rank and candidate-set size, both measured from model outputs, and the rank is not forced by the definition to produce the observed trend. The candidate-generation method is a validity concern for the extraction-risk measurement, because a DP-degraded model may fail to emit the canary among 1,000 samples for fluency reasons rather than privacy reasons; however, this is an external-validity threat, not circular reasoning. The authors openly acknowledge the limitation, and the paper is self-contained against external benchmarks. There are no load-bearing self-citations: the authors cite prior attacks and libraries, but no uniquely cited theorem or author-preferred ansatz carries the argument. Therefore no circularity is present, and the score is 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The paper makes no derivation; its conclusions rest on empirical measurements. The important ledger items are hand-chosen evaluation settings (canary density, privacy budget grid, PEFT sizes, candidate count) and external background assumptions about the validity of DP-SGD implementations and attack metrics. No new entities are introduced. The self-generated candidate space in the extraction attack is the main unvalidated assumption.

free parameters (5)
  • canary insertion proportion = 0.25% of training samples
    Chosen because it keeps the dataset distribution intact and is enough for full fine-tuning to memorize the canary; this affects the absolute exposure levels and the relative gap between methods.
  • privacy budget grid = 1, 10, 30, 50, inf
    Defines all DP comparisons; these are evaluation points, not fitted constants.
  • PEFT hyperparameters = LoRA rank 8, virtual tokens 30, hidden size 128
    Hand-selected standard configurations; not fitted to the reported trade-off.
  • candidate count for exposure = 1000 unique outputs
    Size of the candidate space C in the exposure formula; changes the exposure score directly.
  • training epochs = 10 epochs with early stopping
    Fixed target-model training budget in both experiments.
assumptions (5)
  • domain assumption DP-SGD and DP-Adam as implemented in fastDP provide the claimed sample-level differential privacy guarantee.
    The paper relies on the Book Keeping implementation without independently auditing the privacy accountant.
  • domain assumption Carlini et al. exposure is a valid proxy for memorization and extraction risk.
    Definition 1 is adopted from prior work, but the candidate space is replaced by model-generated text, which is not independently validated.
  • domain assumption SPV-MIA is a valid membership inference attack on DP-trained PEFT models.
    The attack and its AUC/ASR metrics are taken from prior work and extended to PEFT without new validation.
  • domain assumption Black-box queries with partial dataset knowledge describe the relevant adversary.
    Both threat models in Sections 3.1 and 3.2 assume this capability; no evidence is given that real adversaries match it.
  • domain assumption Wikitext-2 and AG News are representative enough to generalize the recommendations.
    The authors acknowledge in Section 5 that the dataset set is narrow, yet the conclusions are stated generally.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Can Differentially Private Fine-tuning LLMs Protect Against Privacy Attacks?." pith.science (2026). https://pith.science/paper/R54R5QGS

@misc{pith2026250421036,
  author       = {Pith},
  title        = {Pith review of: Can Differentially Private Fine-tuning LLMs Protect Against Privacy Attacks?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R54R5QGS}},
  note         = {Machine review of arXiv:2504.21036}
}
read the original abstract

Fine-tuning large language models (LLMs) has become an essential strategy for adapting them to specialized tasks; however, this process introduces significant privacy challenges, as sensitive training data may be inadvertently memorized and exposed. Although differential privacy (DP) offers strong theoretical guarantees against such leakage, its empirical privacy effectiveness on LLMs remains unclear, especially under different fine-tuning methods. In this paper, we systematically investigate the impact of DP across fine-tuning methods and privacy budgets, using both data extraction and membership inference attacks to assess empirical privacy risks. Our main findings are as follows: (1) Differential privacy reduces model utility, but its impact varies significantly across different fine-tuning methods. (2) Without DP, the privacy risks of models fine-tuned with different approaches differ considerably. (3) When DP is applied, even a relatively high privacy budget can substantially lower privacy risk. (4) The privacy-utility trade-off under DP training differs greatly among fine-tuning methods, with some methods being unsuitable for DP due to severe utility degradation. Our results provide practical guidance for privacy-conscious deployment of LLMs and pave the way for future research on optimizing the privacy-utility trade-off in fine-tuning methodologies.

Figures

Figures reproduced from arXiv: 2504.21036 by the authors.

Figure 1
Figure 1. Perplexity as a function of the privacy budget [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 2
Figure 2. Exposure as a function of the privacy budget [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. MIA attack performance as a function of privacy budget [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: ROC Curves for Membership Inference Attacks (MIA) on Models [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Trade-off between model privacy risk and utility. [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 19 canonical work pages

  1. [1]

    In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. pp. 308–318 (2016)

    2016

  2. [2]

    In: Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics

    Ben Zaken, E., Goldberg, Y., Ravfogel, S.: BitFit: Simple parameter-efficient fine- tuning for transformer-based masked language-models. In: Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics. pp. 1–9 (2022)

    work page 2022

  3. [3]

    Zero redundancy distributed learning with differential privacy

    Bu, Z., Chiu, J., Liu, R., Zha, S., Karypis, G.: Zero redundancy distributed learning with differential privacy. arXiv preprint arXiv:2311.11822 (2023)

    work page Pith review arXiv 2023

  4. [4]

    In: Workshop on Trustworthy and Socially Respon- sible Machine Learning, NeurIPS 2022 (2022)

    Bu, Z., Wang, Y.X., Zha, S., Karypis, G.: Differentially private bias-term fine- tuning of foundation models. In: Workshop on Trustworthy and Socially Respon- sible Machine Learning, NeurIPS 2022 (2022)

    work page 2022

  5. [5]

    In: Proceedings of the 40th International Conference on Machine Learning (2023)

    Bu, Z., Wang, Y.X., Zha, S., Karypis, G.: Differentially private optimization on large model at small cost. In: Proceedings of the 40th International Conference on Machine Learning (2023)

    work page 2023

  6. [6]

    In: International Conference on Machine Learning

    Bu, Z., Wang, Y.X., Zha, S., Karypis, G.: Differentially private optimization on large model at small cost. In: International Conference on Machine Learning. pp. 3192–3218. PMLR (2023)

    work page 2023

  7. [7]

    Carlini, N., Liu, C., Kos, J., Úlfar Erlingsson, Song, D.: The secret sharer: Evalu- ating and testing unintended memorization in neural networks (2019)

    work page 2019

  8. [8]

    arXiv preprint arXiv:1810.04805 (2018)

    Devlin, J.: Bert: Pre-training of deep bidirectional transformers for language un- derstanding. arXiv preprint arXiv:1810.04805 (2018)

    arXiv 2018

Show all 31 references
  1. [9]

    In: International colloquium on automata, lan- guages, and programming

    Dwork, C.: Differential privacy. In: International colloquium on automata, lan- guages, and programming. pp. 1–12 (2006)

    2006

  2. [10]

    In: 2019 IEEE International Conference on Data Mining

    Feyisetan, O., Diethe, T., Drake, T.: Leveraging Hierarchical Representations for Preserving Privacy and Utility in Text . In: 2019 IEEE International Conference on Data Mining. pp. 210–219 (2019)

    2019

  3. [11]

    arXiv preprint arXiv:2311.06062 (2023)

    Fu, W., Wang, H., Gao, C., Liu, G., Li, Y., Jiang, T.: Practical membership infer- ence attacks against fine-tuned large language models via self-prompt calibration. arXiv preprint arXiv:2311.06062 (2023)

    2023 arXiv

  4. [12]

    Transactions on Machine Learning Research (2024)

    Han, Z., Gao, C., Liu, J., Zhang, J., Zhang, S.Q.: Parameter-efficient fine-tuning for large models: A comprehensive survey. Transactions on Machine Learning Research (2024)

    2024

  5. [13]

    In: International Con- ference on Learning Representations (2022)

    Hu, E.J., yelong shen, Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W.: LoRA: Low-rank adaptation of large language models. In: International Con- ference on Learning Representations (2022)

    2022

  6. [14]

    arXiv preprint arXiv:2104.08305 (2021)

    Jagannatha, A., Rawat, B.P.S., Yu, H.: Membership inference attack susceptibility of clinical language models. arXiv preprint arXiv:2104.08305 (2021)

    2021 arXiv

  7. [15]

    In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    Lester, B., Al-Rfou, R., Constant, N.: The power of scale for parameter-efficient prompt tuning. In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. pp. 3045–3059 (2021)

    2021

  8. [16]

    In: Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Pro- cessing

    Li, X.L., Liang, P.: Prefix-tuning: Optimizing continuous prompts for generation. In: Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Pro- cessing. pp. 4582–4597 (2021)

    2021

  9. [17]

    arXiv preprint arXiv:2305.06212 (2023) 18 Hao Du et al

    Li, Y., Tan, Z., Liu, Y.: Privacy-preserving prompt tuning for large language model services. arXiv preprint arXiv:2305.06212 (2023) 18 Hao Du et al

    2023

  10. [18]

    In: Oh, A.H., Agarwal, A., Belgrave, D., Cho, K

    Liu, H., Tam, D., Mohammed, M., Mohta, J., Huang, T., Bansal, M., Raffel, C.: Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning. In: Oh, A.H., Agarwal, A., Belgrave, D., Cho, K. (eds.) Advances in Neural Information Processing Systems (2022)

    2022

  11. [19]

    AI Open5, 208–215 (2024)

    Liu, X., Zheng, Y., Du, Z., Ding, M., Qian, Y., Yang, Z., Tang, J.: Gpt understands, too. AI Open5, 208–215 (2024)

    2024

  12. [20]

    In: 2023 IEEE Symposium on Security and Privacy

    Lukas, N., Salem, A., Sim, R., Tople, S., Wutschitz, L., Zanella-Béguelin, S.: An- alyzing leakage of personally identifiable information in language models. In: 2023 IEEE Symposium on Security and Privacy. pp. 346–363 (2023)

    2023

  13. [21]

    https://github.com/ huggingface/peft (2022)

    Mangrulkar, S., Gugger, S., Debut, L., Belkada, Y., Paul, S., Bossan, B.: Peft: State-of-the-art parameter-efficient fine-tuning methods. https://github.com/ huggingface/peft (2022)

    2022

  14. [22]

    Marchyok, L., Carlini, N., Kurakin, A., Hong, S.: Evaluating privacy risks of parameter-efficient fine-tuning (2025)

    2025

  15. [23]

    Merity, S., Xiong, C., Bradbury, J., Socher, R.: Pointer sentinel mixture models (2016)

    2016

  16. [24]

    In: Goldberg, Y., Kozareva, Z., Zhang, Y

    Mireshghallah, F., Uniyal, A., Wang, T., Evans, D., Berg-Kirkpatrick, T.: An em- pirical analysis of memorization in fine-tuned autoregressive language models. In: Goldberg, Y., Kozareva, Z., Zhang, Y. (eds.) Proceedings of the 2022 Conference on Empirical Methods in Natural L...

    2022

  17. [25]

    In: EMNLP

    Mireshghallah, F., Uniyal, A., Wang, T., Evans, D.K., Berg-Kirkpatrick, T.: An empirical analysis of memorization in fine-tuned autoregressive language models. In: EMNLP. pp. 1816–1826 (2022)

    2022

  18. [26]

    In: The Thirteenth International Conference on Learning Representations (2025)

    Panda, A., Tang, X., Choquette-Choo, C.A., Nasr, M., Mittal, P.: Privacy auditing of large language models. In: The Thirteenth International Conference on Learning Representations (2025)

    2025

  19. [27]

    Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I.: Language models are unsupervised multitask learners (2019)

    2019

  20. [28]

    https://github.com/kingoflolz/mesh-transformer-jax (May 2021)

    Wang, B., Komatsuzaki, A.: GPT-J-6B: A 6 Billion Parameter Autoregres- sive Language Model. https://github.com/kingoflolz/mesh-transformer-jax (May 2021)

    2021

  21. [29]

    In: Proceedings ofthe2020ConferenceonEmpiricalMethodsinNaturalLanguageProcessing:Sys- tem Demonstrations

    Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., Funtowicz, M., Davison, J., Shleifer, S., von Platen, P., Ma, C., Jernite, Y., Plu, J., Xu, C., Scao, T.L., Gugger, S., Drame, M., Lhoest, Q., Rush, A.M.: Transformers: State-o...

    2020

  22. [30]

    arXiv preprint arXiv:2312.12148 (2023)

    Xu, L., Xie, H., Qin, S.Z.J., Tao, X., Wang, F.L.: Parameter-efficient fine-tuning methods for pretrained language models: A critical review and assessment. arXiv preprint arXiv:2312.12148 (2023)

    2023 arXiv

  23. [31]

    In: NIPS (2015)

    Zhang, X., Zhao, J.J., LeCun, Y.: Character-level convolutional networks for text classification. In: NIPS (2015)

    2015

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.