Split learning secures privacy in federated fine-tuning of large language models
Privacy-Preserving Split Learning for Federated LLM Fine-Tuning
Machine Learning
Summary
Fine-tuning large language models on special data is important but hard when the full model can't be kept locally, or privacy rules prevent sharing raw data. The paper addresses a privacy problem that happens when parts of the model run on different machines and data is distributed across several places. The authors create a way to hide private information in signals sent between participant and server, so the model can still learn without exposing sensitive data. Their method keeps privacy strong while keeping the model useful and efficient to run.
What this means in practice
- •For cloud service providers: Offer domain-specific LLM fine-tuning services where clients keep their data private despite partial local model execution.$Commercial implications: Enables cloud providers to sell privacy-preserving joint model training that protects client data during split learning.
- •For enterprise ai teams: Collaborate across departments to fine-tune LLMs on sensitive distributed data without exposing raw inputs.
Authors
Heng Jin, Chaoyu Zhang, Hexuan Yu, Wenjing Lou, Y. Thomas Hou
Abstract
Fine-tuning large language models (LLMs) on domain-specific data is essential for downstream adaptation. In many deployments, a participant cannot hold the complete model locally. This happens because the model owner keeps the full model proprietary, or because the participant lacks sufficient compute resources. Split Learning (SL) addresses this by partitioning the model between the participant and a server so that only a small portion runs locally. When the underlying data is additionally distributed across multiple institutions with privacy requirements, Federated Learning (FL) further enables collaborative training across participants by sharing only model updates instead of raw data. In this combined setting, each client transmits intermediate activations to the server, and for LLM fine-tuning, this exchange poses an inherent privacy paradox. The autoregressive nature of LLMs causes the transmitted activations to leak the input, and existing perturbation-based defenses are fundamentally ineffective in this setting. We address this leakage through a learned obfuscate-and-recover scheme that protects participants' private datasets while still allowing an independently deployable model to be trained on the server side. Experiments demonstrate that our approach achieves strong privacy protection with modest utility loss and system overhead, making split-based federated LLM fine-tuning practically viable.