Protecting large language models from privacy leakage is becoming
increasingly crucial with their wide adoption in real-world products. Yet
applying differential privacy (DP), a canonical notion with provable privacy
guarantees for machine learning models, to those models remains challenging due
to the trade-off between model utility and privacy loss. Utilizing the fact
that sensitive information in language data tends to be sparse, Shi et al.
(2021) formalized a DP notion extension called Selective Differential Privacy
(SDP) to protect only the sensitive tokens defined by a policy function.
However, their algorithm only works for RNN-based models. In this paper, we
develop a novel framework, Just Fine-tune Twice (JFT), that achieves SDP for
state-of-the-art large transformer-based models. Our method is easy to
implement: it first fine-tunes the model with redacted in-domain data, and then
fine-tunes it again with the original in-domain data using a private training
mechanism. Furthermore, we study the scenario of imperfect implementation of
policy functions that misses sensitive tokens and develop systematic methods to
handle it. Experiments show that our method achieves strong utility compared to
previous baselines. We also analyze the SDP privacy guarantee empirically with
the canary insertion attack.

本研究提出了一种称为 Just Fine-tune Twice（JFT）的新框架，用于保护最先进的大型 Transformer 模型的选择性差分隐私，并研究了系统性的方法来处理敏感标记的缺失，实现了良好的实用性和隐私保证。

双重微调：面向大语言模型的选择性差分隐私

Just Fine-tune Twice: Selective Differential Privacy for Large Language Models

The counterfactual token generation has been limited to perturbing only a
single token in texts that are generally short and single sentences. These
tokens are often associated with one of many sensitive attributes. With limited
counterfactuals generated, the goal to achieve invariant nature for machine
learning classification models towards any sensitive attribute gets bounded,
and the formulation of Counterfactual Fairness gets narrowed. In this paper, we
overcome these limitations by solving root problems and opening bigger domains
for understanding. We have curated a resource of sensitive tokens and their
corresponding perturbation tokens, even extending the support beyond
traditionally used sensitive attributes like Age, Gender, Race to Nationality,
Disability, and Religion. The concept of Counterfactual Generation has been
extended to multi-token support valid over all forms of texts and documents. We
define the method of generating counterfactuals by perturbing multiple
sensitive tokens as Counterfactual Multi-token Generation. The method has been
conceptualized to showcase significant performance improvement over
single-token methods and validated over multiple benchmark datasets. The
emendation in counterfactual generation propagates in achieving improved
Counterfactual Multi-token Fairness.

本文提出了一种名为 Counterfactual Multi-token Generation 的生成方案，通过扰动多个敏感 Token，可对各种形式的文本和文档实现更好的 Counterfactual 公平性，获得在多个基准数据集上显著的性能提升。