LoRA Provides Differential Privacy by Design via Random Sketching
This work reveals the inherent privacy properties of LoRA, offering insights into its robustness against privacy attacks for language model fine-tuning.
The paper shows that LoRA's low-rank adaptation mechanism is equivalent to fine-tuning with noisy gradients, providing inherent differential privacy when adaptation matrices are frozen, with privacy levels influenced by factors like adaptation rank and batch size.
Low-rank adaptation of language models has been proposed to reduce the computational and memory overhead of fine-tuning pre-trained language models. LoRA incorporates trainable low-rank matrices into some parameters of the pre-trained model, called adapters. In this work, we show theoretically that the low-rank adaptation mechanism of LoRA is equivalent to fine-tuning adapters with noisy batch gradients, with the noise variance being a decreasing function of adaptation rank ($r$). Motivated by this understanding, we prove inherent differential privacy for LoRA when adaptation matrices $A_\ell$ are frozen. We show that various factors, e.g., the adaptation rank and batch size, affect the guaranteed privacy level. Our findings provide useful insights into LoRA and uncovers the reason behind the robustness of models fine-tuned with LoRA to privacy attacks.