Abstract
Large language models (LLMs) frequently memorize sensitive or personal information, raising significant privacy concerns. Existing variants of differential privacy stochastic gradient descent (DPSGD) inject uniform noise into every gradient step, significantly extending training time and reducing model accuracy. We propose that concentrating noise primarily on gradients associated with sensitive tokens can substantially decrease DP training time, strengthen the protection of sensitive information, and simultaneously preserve the model's performance on non-sensitive data. We operationalize this insight through Adaptive Token-Weighted Differential Privacy (ATDP), a modification of vanilla DP-SGD that adaptively assigns different gradient weights to sensitive and non-sensitive tokens. By employing a larger noise scale at the early stage of training, ATDP rapidly disrupts memorization of sensitive content. As a result, ATDP only requires a few additional epochs of lightweight post-processing following standard fine-tuning, injecting targeted noise primarily on parameters corresponding to sensitive tokens, thus minimally affecting the model's general capabilities. ATDP can be seamlessly integrated into any existing DP-based fine-tuning pipeline or directly applied to non-private models as a fast privacy-enhancing measure. Additionally, combined with an initial redacted fine-tuning phase, ATDP forms a streamlined DP pipeline that achieves comparable canary protection to state-of-the-art DP-SGD methods, significantly reduces the computational overhead of DP fine-tuning, shortening training time by approximately 90 percent, while achieving comparable or superior privacy protection and minimal accuracy degradation.
Abstract (translated)
大型语言模型（LLM）经常记忆敏感或个人信息，引发了严重的隐私问题。现有的差分隐私随机梯度下降（DPSGD）变体在每个梯度步骤中注入均匀噪声，这显著延长了训练时间并降低了模型的准确性。我们提出将噪声主要集中在与敏感标记相关的梯度上可以大幅减少DP训练时间、增强对敏感信息的保护，并同时保持模型在非敏感数据上的性能。 为此，我们提出了自适应令牌加权差分隐私（ATDP），这是对原始DP-SGD的一种改进，在其中根据敏感和非敏感标记自适应地分配不同的梯度权重。通过在训练初期使用更大的噪声尺度，ATDP可以快速中断对敏感内容的记忆过程。因此，ATDP仅需要在标准微调之后进行少量的轻量级后处理，主要针对与敏感标记相关的参数注入定向噪声，从而最小限度地影响模型的一般能力。 ATDP可以无缝整合到任何现有的基于差分隐私（DP）的微调管道中，也可以直接应用于非私有模型以快速增强其隐私。此外，结合初始删减微调阶段，ATDP形成了一条简化的DP流水线，该流程实现了与现有最先进的DP-SGD方法相当的预警保护，并显著减少了DP微调的计算开销，将训练时间缩短约90%，同时达到或优于现有的隐私保护水平和最小化准确性下降。
URL
https://arxiv.org/abs/2509.23246
