# PrIeD-KIE: Towards Privacy Preserved Document Key Information Extraction

Saifullah Saifullah12, Stefan Agne23, Andreas Dengel12, Sheraz Ahmed23
1Department of Computer Science, University of Kaiserslautern-Landau
Erwin-Schrödinger-Straße 52, 67663, Kaiserslautern, Rhineland-Palatinate,
Germany
2German Research Center for Artificial Intelligence GmbH
Trippstadter Straße 122, 67663, Kaiserslautern, Rhineland-Palatinate, Germany
3DeepReader GmbH, 67663 Kaiserlautern, Germany
<EMAIL_ADDRESS>
###### Abstract

In this paper, we introduce strategies for developing private Key Information
Extraction (KIE) systems by leveraging large pretrained document foundation
models in conjunction with differential privacy (DP), federated learning (FL),
and Differentially Private Federated Learning (DP-FL). Through extensive
experimentation on six benchmark datasets (FUNSD, CORD, SROIE, WildReceipts,
XFUND, and DOCILE), we demonstrate that large document foundation models can
be effectively fine-tuned for the KIE task under private settings to achieve
adequate performance while maintaining strong privacy guarantees. Moreover, by
thoroughly analyzing the impact of various training and model parameters on
model performance, we propose simple yet effective guidelines for achieving an
optimal privacy-utility trade-off for the KIE task under global DP. Finally,
we introduce FeAm-DP, a novel DP-FL algorithm that enables efficiently
upscaling global DP from a standalone context to a multi-client federated
environment. We conduct a comprehensive evaluation of the algorithm across
various client and privacy settings, and demonstrate its capability to achieve
comparable performance and privacy guarantees to standalone DP, even when
accommodating an increasing number of participating clients. Overall, our
study offers valuable insights into the development of private KIE systems,
and highlights the potential of document foundation models for privacy-
preserved Document AI applications. To the best of authors’ knowledge, this is
the first work that explores privacy preserved document KIE using document
foundation models.

##  1 Introduction

In today’s digital landscape, the advent of AI-powered document processing
systems has revolutionized the way businesses handle personal data [7, 18, 37,
24, 12, 42], yet it has also raised concerns about privacy and data security
[26, 16, 13]. Business-critical documents, such as invoices, contracts,
financial reports, and customer databases, house a wealth of sensitive and
confidential information, including names, addresses, contact details, social
security numbers, and financial details. As AI systems become increasingly
integrated into document processing workflows, ensuring the privacy and
security of this valuable data has become an imperative task. Increasing
numbers of studies have demonstrated that machine learning (ML) models can be
vulnerable to privacy threats [2, 43]. Inadvertent memorization [4] of
training data and the ability to reconstruct training samples [5, 14] within
these models are just a few examples which pose substantial risks to user data
privacy. As a result, their adoption in industry and compliance with
regulatory and ethical guidelines such as GDPR [11] and AI Act 2022 are
significantly hindered.

To address the aforementioned issues, a diverse range of privacy-preserving
approaches have recently emerged in the AI community such as Differential
Privacy (DP) [9, 10, 1], Federated Learning (FL) [29, 30], and data
anonymization [41]. In the context of Document AI, each of these approaches
may have a different set of applications. As an example, DP may be applied to
provide global privacy [1, 26, 51], where an organization provides machine
learning-based services to external clients and intends to secure sensitive
documents used during training, or local privacy [13, 28], where individual
clients are concerned about their personal information being leaked from
documents uploaded to the service. DP may also be combined with FL [29, 30],
where the model is trained across several participants, each optimizing the
model locally on its own data, thus ensuring its privacy. On the other hand,
data anonymization through text redaction [41] or sanitization [52, 49] may
also be used to directly introduce privacy into the document data.

In this paper, we address the privacy challenges in Key Information Extraction
(KIE) [19, 35, 20], a vital task in modern document processing workflows that
involves extracting targeted entities like names, addresses, and bank details
from documents such as invoices, receipts, financial reports, and medical
records. However, the sensitive nature of the data handled by KIE systems make
them vulnerable to privacy attacks. Despite significant advances in multimodal
KIE [6, 27, 48, 18, 37] and privacy preservation of textual documents [26, 16,
8, 13, 31], research specifically tailored to privacy-enhancing approaches for
unified KIE is lacking. To address this gap, this paper proposes a privacy-
enabled KIE system by integrating unified document transformer models with
privacy techniques. The contributions of this paper are three-fold:

  * –

We propose strategies for building private KIE systems by utilizing large
pretrained document foundation models in combination with differential privacy
(DP), federated learning (FL), and Differentially Private Federated Learning
(DP-FL) and demonstrate that given adequate hyperparameter tuning, multimodal
transformer models can be fine-tuned on the KIE task with sufficient utility
under strong privacy guarantees ($\epsilon\in\\{8,20\\}$ in case of DP and DP-
FL).

  * –

We perform extensive experiments for fine-tuning the models under global DP,
and suggest simple but effective guidelines for achieving an optimal privacy-
utility tradeoff.

  * –

We propose FeAm-DP, an algorithm for DP-FL training, which utilizes local
client-level noise addition in combination with global Adam optimization to
ensure privacy, and enables efficient upscaling of global DP from a standalone
perspective to multiple clients.

##  2 Related Work

###  2.1 Privacy in NLP and Document AI

The fields of Natural language processing (NLP) and document AI are closely
intertwined, and a variety of privacy approaches have emerged recently in both
domains. Li _et al_. [26] investigated global DP for fine-tuning large
pretrained language models and proposed practical guidelines tuning
hyperparameters for text classification and generation tasks. Hoory _et al_.
[16] also studied global DP for the task of named-entity-recognition (NER) on
medical documents and proposed a DP-based vocabulary for BERT [7] model.
McMahan _et al_. [30] demonstrated large-scale federated learning under
client-level DP for textual data. Basu _et al_. [3] investigated DP in
combination with federated learning for textual classification of financial
documents. Several other studies have applied global DP [8, 51, 46] as well as
local DP [28, 31, 49, 52, 36] to textual data. For a comprehensive review of
these studies, we refer the reader to a related survey [17].

Privacy for documents has been explored relatively little in the visual domain
compared to the textual domain. In a comprehensive study, Saifullah _et al_.
[39] investigated various privacy-preserving techniques such as DP, FL, and
Secure Multi-Party Computation for the task of document image classification
based on convolutional neural networks (CNNs). This work was also later
extended in [40] to examine the effect of various privacy-preserving methods
on the explainability of document image classifiers.

###  2.2 Document Key Information Extraction

Key Information Extraction (KIE) is a critical component of document analysis
and has been extensively studied in the past [6, 24, 18, 37]. A variety of
approaches have been explored in recent years for the KIE task, including
grid-based methods [21, 6, 27] that fuse textual information into the visual
space, as well as transformer-based approaches [48, 18, 37] that fuse textual,
layout and visual information through self-attention [45] and use large-scale
self-supervised pretraining for a unified document understanding. These
techniques generally involve pretraining transformer models on large datasets
and then fine-tuning them for downstream KIE tasks. The use of graphs to fuse
multiple modalities has also been investigated recently for Document KIE [24].

##  3 Preliminaries

###  3.1 Differential Privacy (DP)

Differential Privacy (DP) [9, 10] provides a formal definition of information
release from private data. Applied to machine learning, DP provides strong
privacy guarantees: severely limiting the possibility of using membership
inference [43], model inversion [14], or linkage attacks [2] to learn about
private training data through the publicly released model parameters. In this
work, we mainly target the example-level privacy for the KIE task under global
approximate-DP (also known as $(\epsilon,\delta)$-DP) setting. Recall the
formal definition of $(\epsilon,\delta)$-DP [9, 10]:

######  Definition 1.

A randomized algorithm $\mathcal{M}:\mathcal{D}\rightarrow\mathcal{R}$ with
domain $\mathcal{D}$ and range $\mathcal{R}$ is $(\epsilon,\delta)$\-
differentially private if for all adjacent datasets
$D,D^{\prime}\in\mathcal{D}$ and $R\subseteq\mathcal{R}$,
$\mathbb{P}(\mathcal{M}(D)\in R)\leq
e^{\epsilon}\mathbb{P}(\mathcal{M}(D^{\prime})\in R)+\delta$

Where the definition of adjacency of datasets depends on the task at hand.
Similar to most prior works on example-level privacy in machine learning [1,
26, 34], we use the following definition of adjacency: the two datasets
$D,D^{\prime}$ are considered adjacent if and only if $D^{\prime}$ can be
obtained from $D$ by adding or removing one record from $D$. Intuitively
speaking, applying DP to an algorithm $\mathcal{M}$ ensures that the outputs
generated on similar inputs should be difficult to distinguish. Whereas, the
degree of this indistinguishability is determined by the privacy parameters
$\epsilon$ and $\delta$, with smaller values of $\epsilon$ and $\delta$
implying stronger privacy.

####  3.1.1 Privatized Gradients via DP-SGD/Adam

DP-SGD [1] is the key algorithm for training a machine learning model for
example-level privacy under $(\epsilon,\delta)$-DP. The algorithm relies on
adding noise to the per-example gradients of the model to ensure that the
training process leaks limited information about the data it was trained on.
In particular, for each training example, the per-example gradients are
clipped to a constant bound $S$, and then gaussian noise
$n\sim\mathcal{N}(0,\sigma^{2}S^{2})$ is added to the sum of the gradients
before the optimizer update. Where $\sigma$ is the noise multiplier that
determines the privacy strength (more noise means more privacy and a lower
$\epsilon$) and is determined based on the privacy budget ($\epsilon,\delta$),
type of privacy accountant [1, 23, 33, 15] utilized to track the privacy loss
$\epsilon$, number of gradient update steps $T$, and the sampling rate $q$
defined as $q=\frac{B}{|\mathcal{D}|}$ where $B$ is the expected batch size
and $|\mathcal{D}|$ is the training dataset size. The term expected batch size
is used here since DP-SGD does not use a fixed batch size in each training
iteration but rather utilizes poisson sampling to generate a variable-size
batch in each iteration. Since DP-SGD adds noise before optimization, it can
also be easily extended to work with other machine learning optimizers, such
as Adam [22]. Refer to Algorithm 2 for a complete pseudocode of the DP-
SGD/Adam algorithm.

####  3.1.2 Federated Learning

In federated learning, a machine learning (ML) model is trained across
multiple remote clients in a distributed manner, where the local data of each
client remains onsite, thus preserving its privacy. To train a ML model in a
federated setting, McMahan _et al_. [29] introduced the well-known federated
average (FedAvg) algorithm. Given $K$ number of total clients in a distributed
setting, each round of FedAvg training involves sending model parameters from
the server to a $C$ fraction of clients. Each client trains its own model
replica on its local dataset for $E$ number of epochs, and then returns the
updated model parameters to the server. Upon receiving model parameters from
multiple clients, the server averages them and sends them back to the clients
for the next training round. The complete pseudocode for the FedAvg algorithm
is given in Algorithm 3.

##  4 Private Document KIE

Our starting point for building private KIE systems was to leverage the power
of large pretrained document foundation models. Large self-supervised
pretrained models [7, 37, 48, 18] generally contain critical knowledge about
the specific domain they are trained on, and have previously shown to greatly
facilitate private training on downstream tasks [8, 26]. For these reasons, we
built our private KIE model upon the state-of-the-art pretrained document
transformer model LayoutLMv3 [18].

###  4.1 Model Configuration

LayoutLMv3 [18] is a unified text-image-layout transformer that learns cross-
modal representations using self-attention [45, 7] and is pretrained on 11M
document images from the large-scale IIT-CDIP public dataset [25]. While a
number of multimodal document foundation models have recently emerged [37, 48,
24], we found LayoutLMv3 to be the best choice for two primary reasons: (1)
the code and pretrained checkpoints of the model are publicly accessible, and
(2) the model exhibits the best performance among all currently available
multimodal transformers for the KIE task in a non-private setting. LayoutLMv3
takes as an input a sequence of text embeddings
$\mathbf{X_{t}}=\mathbf{x_{t}}_{1:L}$ and a sequence of image patch embeddings
$\mathbf{X_{I}}=\mathbf{x_{I}}_{1:M}$, where $L$ and $M$ denote the lengths of
the respective sequences, and $L+M$ represents the overall sequence length if
both modalities are used. In addition to text and image modalities, LayoutLMv3
introduces document layout information through 2D positional embeddings, which
are generated from the normalized bounding box coordinates
$[x_{1},y_{1},x_{2},y_{2}]$ of each word in the document image and are added
to the text embeddings $\mathbf{X_{t}}=\mathbf{x_{t}}_{1:L}$. For a complete
overview of the model architecture, refer to Fig. 7.

###  4.2 Non-private Fine-tuning

To fine-tune the model for the KIE task in a non-private setting, we use a
classification head to predict the entity labels of the final embeddings of
each token, and train the model for a total of $E$ epochs using cross-entropy
loss and Adam optimizer [22]. Whereas, the target entity labels for the tokens
are assigned using the standard BIO (Beginning-Inside-Outside) tagging. The
input text sequence is pre-processed using Byte-Pair Encoding (BPE) and [CLS]
and [SEP] tokens are added at the beginning and end of each text sequence.
After tokenization, the entity labels are only assigned to the first sub-token
of each word and the maximum text sequence length is set to $L=512$. The image
inputs are resized to the dimensions $H\times W=224\times 224$ and split into
patches of sizes $16\times 16$, resulting in a total image sequence length of
$M=196$. Unless stated otherwise, the model weights are initialized using the
publicly available pretrained checkpoint layoutlmv3-base. For the complete
model configuration used in our work, refer to Table 4.

###  4.3 Private Fine-tuning via DP-Adam

To train the model with example-level privacy, we directly fine-tune it for
the KIE task with DP-Adam, a variant of DP-SGD that utilizes Adam [22] for
model optimization. To track privacy loss, we use Rényi DP (RDP) [33]
accountant and compute the noise multiplier $\sigma$ for target privacy levels
of $\epsilon\in\\{8,20\\}$ and $\delta=\frac{1}{|\mathcal{D}_{train}|}$ for a
training set of size $|\mathcal{D}_{train}|$ for all experiments.
Additionally, we report the converted $\epsilon$ using the Gaussian Accountant
[23], and the Private Random Variable (PRV) Accountant [15] (see Appendix E
for details on different accountants). For private training, we follow the
same pre-processing procedure as non-private training, with the exception of
sequence length $L$, which we experiment with in this scenario with values of
$L=128$ and $L=512$.

###  4.4 Private Fine-tuning via Federated Learning

To investigate private training with federated learning (FL), we consider a
scenario in which each client holds a small dataset of their own that
contributes to the distributed training of a centralized model, as described
in Sec. 3.1.2. This scenario is common in industrial document analysis
pipelines in which a single service provider manages the data of several
clients at the same time. We consider four different settings with total
number of clients $K\in\\{2,4,8,16\\}$ and set the fraction of randomly
sampled clients per round $C=0.5$ for settings with $K>2$. To train the
models, we utilize the FedAVG algorithm with total number of FL rounds $T$ set
to a value of $\frac{E}{C}$, where $E$ is the number of epochs that were used
to fine-tune the model in the non-private setting.

###  4.5 Private Federated Fine-tuning via FeAm-DP

The starting point for developing our proposed FeAm-DP algorithm with example-
level privacy was to directly scale the standalone DP-SGD/Adam[1] algorithm to
a global federated optimization setting similar to the work by Reddi _et al_.
[38]. While a few previous works have explored DP in a FL setting, they either
deal with client-level privacy [30] or apply the FedAVG algorithm in
combination with DP-SGD [32] to each client independently, providing no notion
of global privacy. Our proposed algorithm mainly differs from these approaches
in two ways:

  * –

FeAm-DP provides example-level privacy as opposed to client-level privacy
introduced in [30].

  * –

Instead of defining privacy per client as done in FedAVG-DP [32], our proposed
algorithm aims to simply upscale DP from a single client to multiple clients
while keeping the same privacy constraints on a global level.

Algorithm 1 provides the pseudocode for the proposed algorithm FeAm-DP. The
algorithm is initialized with pretrained weights $\theta_{o}$, and $m$ number
of clients to be sampled each round. In each training round, the server
samples a subset of clients $\mathcal{S}_{t}$ and then performs a single
update step on each client using the weights $\theta_{t-1}$ of the previous
round. In the update step, each client samples a local batch
$\mathcal{B}_{kt}$, computes the loss, clips the gradients according to the
gradient norm $S$ and adds noise to the gradients. The noisy gradients are
then returned to the server, averaged, and used for global optimization using
the Adam optimizer [22]. Recall that in the standalone DP-SGD [1] on a single
client, the gradient update step is given as follows:

$\mathbf{\tilde{g}}=\frac{1}{q|\mathcal{D}|}(\sum_{i=1}^{q|\mathcal{D}|}\mathbf{\bar{g}}(x_{i})+\mathcal{N}(0,\sigma^{2}S^{2}\mathbf{I})$
(1)

Where $q$ is the per-example sampling rate, $\mathcal{D}$ is the training
dataset, $\mathbf{\bar{g}}(x_{i})$ is the per-example clipped gradient. Note
that the term $q|\mathcal{D}|$ simply represents the expected batch size $B$.
In a FL environment, each client $k$ has its own small dataset
$\mathcal{D}_{k}$ of size $|\mathcal{D}_{k}|$. We assume that each client has
a dataset of size $\frac{|\mathcal{D}_{train}|}{K}$ with $K$ equal partitions
of the original dataset $|\mathcal{D}_{train}|$. Given that only a fraction
$C$ of these clients are sampled every round for training, the gradient
averaging step after applying a single DP gradient update (as done in Eq. 1)
step per client can be written as follows:

$\displaystyle\mathbf{\tilde{g}}_{fed}$
$\displaystyle=\frac{1}{CK}\sum_{k=1}^{CK}\frac{1}{q_{k}|\mathcal{D}_{k}|}(\sum_{i=1}^{q_{k}|\mathcal{D}_{k}|}\mathbf{\bar{g}}_{k}(x_{i})+\mathcal{N}(0,\sigma_{k}^{2}S^{2}\mathbf{I}))$
(2) $\displaystyle\mathbf{\tilde{g}}_{fed}$
$\displaystyle=\frac{1}{CKq_{k}\frac{|\mathcal{D}|}{K}}(\sum_{k=1}^{CK}\sum_{i=1}^{q_{k}\frac{|\mathcal{D}|}{K}}\mathbf{\bar{g}}_{k}(x_{i})+\sum_{k=1}^{CK}\mathcal{N}(0,\sigma_{k}^{2}S^{2}\mathbf{I}))$
(3) $\displaystyle\mathbf{\tilde{g}}_{fed}$
$\displaystyle=\frac{1}{\hbox{\pagecolor{cyan}$\displaystyle
Cq_{k}|\mathcal{D}|$}}(\sum_{j=1}^{\hbox{\pagecolor{cyan}$\displaystyle
Cq_{k}|\mathcal{D}|$}}\mathbf{\bar{g}}(x_{j})+\mathcal{N}(0,\hbox{\pagecolor{pink}$\displaystyle
CK\sigma_{k}^{2}$}S^{2}\mathbf{I}))$ (4)

Figure 1: The performance of FedAVG-DP [32] degrades substantially with
increasing number of clients whereas our proposed FeAm-DP algorithm remains
largely unaffected.

By comparing Eq. 4 with Eq. 1, it becomes apparent that the only difference
that arises when scaling DP from standalone scenario to multiple clients with
gradient averaging is in the sampling rate (highlighted in blue) and the per-
client noise multiplier (highlighted in red). From this it follows that to
achieve the same sampling rate of $q$ in a federated setting, we must set the
per-client sampling rate $q_{k}=\frac{q}{C}$. Similarly, to achieve the noise
multiplier of $\sigma$ in a federated setting, we must set the per-client
noise multiplier as
$\sigma_{k}=\frac{\sigma}{\sqrt{CK}}=\frac{\sigma}{\sqrt{m}}$. In addition to
the sampling rate $q$, in standalone DP setting [1], the total privacy cost
$(\epsilon,\delta)$ spent during the training process also depends on the the
total number of gradient update steps $U$. For standalone DP, the number of
gradient update steps can be simply computed as $U=\frac{1}{q}E$, and $E$ is
the number of training epochs. Since in our proposed algorithm, each client
only performs a single update step on the model, the total number of FL
communication rounds can be simply set as $T=U=\frac{1}{q}E$.

It is worth mentioning that in addition to providing a global privacy
perspective, our proposed algorithm provides some major advantages over the
FedAVG-DP algorithm [32] under federated setting with small datasets. In
FedAVG-DP [32], each client updates its own model replica with noisy gradients
on a local batch of samples for $E$ number of epochs. Since the choice of
batch size is limited by privacy constraints $(\epsilon,\delta)$, as the
number of clients increases and the local datasets $|D_{k}|$ become smaller,
the expected batch size (since $B=q|D_{k}|$) for model optimization per client
for a fixed privacy budget $\epsilon$ also reduces.

Input: Learning rate $\eta$, gradient clipping norm $S$, sampling rate $q$,
target $(\epsilon,\delta)$, total clients K, clients sampling rate $C$,
privacy accountant $\mathcal{M}$, total FL rounds $T$

Server Executes:

Init: $\theta_{0}$, $m\leftarrow CK$,
$\sigma\leftarrow\mathcal{M}.\text{get\\_noise\\_multiplier}(q,\epsilon,T)$

for  _each round $t=1,\dots,T$_ do

$\mathcal{S}_{t}\leftarrow(\text{sample a set of $m$ clients from $K$})$

for  _each client $k\in\mathcal{S}$_ in parallel do

$\sigma_{k}\leftarrow\frac{\sigma}{\sqrt{m}}$

$\mathbf{\tilde{g}}_{k,t}\leftarrow\text{ClientUpdate}(k,\theta_{t-1},\sigma_{k},S,C)$

end

$\mathbf{\tilde{g}}_{t}\leftarrow\sum_{k\in\mathcal{S}_{t}}\frac{n_{k}}{n}\mathbf{\tilde{g}}_{k,t}$

$\theta_{t+1}\leftarrow$
GlobalAdamUpdate$(\eta,\theta_{t},\mathbf{\tilde{g}}_{t})$

print $\mathcal{M}.\text{get\\_privacy\\_spent}(q,\sigma,t,\delta)$

end for

end

ClientUpdate  _( $k,\theta_{t},\sigma_{k},S,C$)_:

Input: $\mathcal{L}(\theta)=\frac{1}{B}\sum_{i}\mathcal{L}(\theta,x_{i})$,
$\mathcal{D}_{k}$ of size $|\mathcal{D}_{k}|$

$\mathcal{B}_{kt}\leftarrow($sample a batch of size $B_{k}$ with sampling
probability $q_{k}=\frac{q}{C}$)

for each  _$x_{i}\in\mathcal{B}_{kt}$_ compute

$\mathbf{g}_{k,t}(x_{i})\leftarrow\nabla_{\theta_{k,t}}\mathcal{L}(\theta_{k,t},x_{i})$

$\mathbf{\bar{g}}_{k,t}(x_{i})\leftarrow\mathbf{g}_{k,t}(x_{i})/max(1,\frac{||\mathbf{\bar{g}}_{k,t}(x_{i})||_{2}}{S})$

end

$\mathbf{\tilde{g}}_{k,t}\leftarrow\frac{1}{B_{k}}(\sum_{i}\mathbf{\bar{g}}_{k,t}(x_{i})+\mathcal{N}(0,\sigma{k}^{2}S^{2}\mathbf{I})$

return _$\mathbf{\tilde{g}}_{k,t}$_

Algorithm 1 FeAm-DP

Dataset | Train | Train $(L=512)$ | Train $(L=128)$ | Validation | Test | Entity Labels
---|---|---|---|---|---|---
FUNSD [20] | $149$ | $149$ | $389$ | - | $50$ | $4$
CORD [35] | $800$ | $800$ | $840$ | $100$ | $100$ | $31$
SROIE [19] | $626$ | $630$ | $1601$ | $-$ | $347$ | $5$
WildReciepts [44] | $1267$ | $1267$ | $2204$ | $-$ | $472$ | $25$
DOCILE [53] | $5180$ | $9768$ | $29406$ | $500$ | $1000$ | $37$
XFUND [47] | $149$ | $188$ | $562$ | $-$ | $50$ | $4$

Table 1: An overview of the datasets is provided.

This in turn degrades the performance of FedAVG-DP [32] as the underlying
application of DP-SGD/Adam per client is strongly influenced by batch size.
Fig. 1 illustrates this problem by comparing the performance of FedAVG-DP [32]
and our proposed FeAm-DP under different numbers of clients. As can be seen,
the performance of the FedAVG-DP [32] algorithm is significantly diminished as
the number of clients increases whereas our proposed algorithm remains largely
unaffected.

Overall, our proposed algorithm offers privacy on a global level while keeping
the local client data onsite. Furthermore, because noise is added on the
client end, the client gradients also remain protected under DP during each FL
communication round. For our experiments with FeAm-DP, similar to FL settings,
we consider four different settings of clients with $K\in\\{2,4,8,16\\}$ and
$C=0.5$ for settings with $K>2$.

##  5 Experiments

###  5.1 Datasets

Figure 2: Larger batch sizes $B$ result in better performances over a range of
noise values $\sigma$. Results reported here were obtained with $L=512$, and
$\eta=1.0e{-}3$.

For a thorough analysis of our private training approaches, we conduct
experiments on a variety of datasets as shown in Table 1. FUNSD [20] is a
form-understanding dataset which contains $199$ documents with $4$ different
semantic entity types. SROIE [19] is receipts understanding dataset with $626$
training samples and $347$ test samples with $5$ target entity types. CORD
[35] is another receipt understanding dataset containing $1000$ and $31$
different target entities. WildReciepts [44] is a relatively large receipts
dataset which includes $1267$ and $472$ training and test samples and consists
of $25$ target entities. DOCILE [53] is a recently released large-scale
document KIE dataset containing $6206$ training samples, $500$ validation
images, and $1000$ test images, and about ${\sim}100$k synthetically generated
samples with a total of $37$ target entities. Since DOCILE [53] test set
annotations are not made public by the authors, we only report model
performance on the validation set. XFUND [47] is a multilingual form
understanding benchmark dataset that includes human-labeled forms with key-
value pairs in $7$ languages. From this dataset, we perform experiments on the
Chinese language subset which contains $149$ training images and $50$ test
images. Note that for training LayoutLMv3 on XFUND dataset, we use the Chinese
language pretraining checkpoint namely layoutlmv3-base-chinese. For additional
dataset details, see Fig. 12.

Figure 3: Higher learning rates $\eta$ and larger batch sizes $B$ result in
better performances. Results reported here were obtained with $\epsilon=20$,
and $L=128$.

###  5.2 Guidelines for Effective DP Fine-Tuning

DP-Adam [1] algorithm is known to be particularly sensitive to the choice of
hyperparameters [26, 34, 8]. In this section, we thoroughly investigate the
impact of various training parameters on the performance of DP fine-tuning.
Subsequently, we present guidelines based on our observations to attain an
optimal trade-off between privacy and utility.

Figure 4: Lower values of clipping norm $S$ result in better performances for
a range of learning rates $\eta$. Results reported here were obtained with
$\epsilon=20$, and $L=128$.

####  5.2.1 Batch size, Learning Rate, and Clipping Norm

Our experiments indicate that the training parameters batch size, learning
rate, and clipping norm were all equally important and considerably affected
the model performance under DP-Adam. Fig. 2 illustrates the effects of
increasing batch size $B$ on the model performance under different values of
the noise multiplier $\sigma$. It can be observed that across low to high
noise regimes, larger batch sizes always resulted in better performances.
Generally we observed that batch sizes corresponding to sampling rate $q$ in
the range $(\frac{1}{10},\frac{1}{3})$ performed the best and batch sizes
corresponding to sampling rates above $\frac{1}{3}$ did not show a significant
positive improvement in the model performance. Similarly, it can be seen from
Fig. 3 that across varying batch sizes, higher learning rates resulted in
improved performances. However, we observed that too high learning rates were
also unsatisfactory, resulting in training instability. For our experiments,
we found a learning rates between the range of
$\eta\in\\{1.0e{-}3,5.0e{-}4\\}$ to work out the best across all datasets. The
effect of clipping norm $S$ on model performance was also very prominent. As
can be observed from Fig. 4, for a fixed batch size, smaller values of $S$
resulted in considerably better performances. For our experiments, we adjusted
the clipping norm to a small value of $S=0.1$.

######  Guideline 1.

To achieve an optimal privacy-utility tradeoff for fine-tuning DP-Adam for KIE
with a fixed number of epochs $E$, we recommend choosing large batch sizes,
relatively large learning rates compared to non-private fine-tuning, and small
values of gradient clipping norm $S$.

Dataset | Method | $\epsilon=8$ | $\epsilon=20$
---|---|---|---
FUNSD | LayoutLMv3base | 68.81 | 75.27
LayoutLMv3base-TSP-SROIE | 66.32 ${\color[rgb]{1,0,0}\downarrow}$ | 73.31 ${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-WildReceipts | 63.81 ${\color[rgb]{1,0,0}\downarrow}$ | 74.96 ${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-DOCILE-Synthetic | 65.09${\color[rgb]{1,0,0}\downarrow}$ | 72.27${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-CORD | 72.49 ${\color[rgb]{0,1,0}\uparrow}$ | 79.19 ${\color[rgb]{0,1,0}\uparrow}$
CORD | LayoutLMv3base | 72.08 | 78.28
LayoutLMv3base-TSP-SROIE | 70.11 ${\color[rgb]{1,0,0}\downarrow}$ | 77.41 ${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-DOCILE-Synthetic | 70.19${\color[rgb]{1,0,0}\downarrow}$ | 76.39${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-WildReceipts | 75.52 ${\color[rgb]{0,1,0}\uparrow}$ | 79.53 ${\color[rgb]{0,1,0}\uparrow}$
SROIE | LayoutLMv3base | 69.79 | 77.05
LayoutLMv3base-TSP-CORD | 71.13 ${\color[rgb]{0,1,0}\uparrow}$ | 75.36 ${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-WildReceipts | 73.20 ${\color[rgb]{0,1,0}\uparrow}$ | 77.69 ${\color[rgb]{0,1,0}\uparrow}$
LayoutLMv3base-TSP-DOCILE-Synthetic | 76.17${\color[rgb]{0,1,0}\uparrow}$ | 79.84${\color[rgb]{0,1,0}\uparrow}$
WildReceipts | LayoutLMv3base | 71.26 | 78.44
LayoutLMv3base-TSP-SROIE | 69.15 ${\color[rgb]{1,0,0}\downarrow}$ | 76.33 ${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-DOCILE-Synthetic | 71.23${\color[rgb]{1,0,0}\downarrow}$ | 78.20${\color[rgb]{1,0,0}\downarrow}$
LayoutLMv3base-TSP-CORD | 73.38 ${\color[rgb]{0,1,0}\uparrow}$ | 79.71 ${\color[rgb]{0,1,0}\uparrow}$

Table 2: Performance comparison of task-specific pretraining (TSP) for four
datasets under different privacy budgets. Results reported here were obtained
with $L=512$.

####  5.2.2 Task-specific Pretraining (TSP)

To provide task-specific information to the model, we explored task-specific
pretraining (TSP) which involved first training the model on other datasets
considering them as public datasets, and then fine-tuning it on the target
dataset under private settings. To analyze the effects of TSP on model
performance, we performed experiments on four datasets FUNSD, CORD, SROIE, and
WildReceipts for which the results are given in Table 2. The term
LayoutLMv3base-TSP-A indicates that the model was first fine-tuned with a non-
private setting on dataset A and then further fine-tuned under a private
setting on the target dataset. Overall, the results indicate that with
appropriate choice of datasets, TSP can lead to significant performance
improvements ranging from ${\sim}2\%$ to ${\sim}6.5\%$. Another interesting
observation from these results that may seem counterintuitive at first glance
is that the overall impact of TSP on model performance was disparate, i.e. for
a particular private dataset, only a select few datasets resulted in
performance improvements. However, on closer examination we discovered that
the performance improvements based on TSP were closely linked to the overlap
or similarity between semantic entity labels of the fine-tuning dataset and
the target dataset. For example, the CORD and WildReceipts datasets performed
significantly better when used for TSP for each other since their entity
labels shared a considerable amount of similarity. Similarly, as SROIE had
complete entity overlap with both WildReceipts and DOCILE-Synthetic, it
benefited from both of these datasets, in contrast to CORD, with which it only
had limited entity overlap.

######  Guideline 2.

To maximize performance when using TSP in conjunction with DP for the KIE
task, we recommend using public datasets whose target entity types are similar
to those in the private dataset.

Figure 5: Sequence lengths of $L=128$ result in significantly better
performances (especially under task-specific pretraining), whereas dropout
shows a disparate effect.

####  5.2.3 Sequence Length and Dropout

For training on sequential data, sequence length is a crucial parameter, and
an appropriate sequence length is necessary to provide the model with relevant
context. A longer sequence length indicates a larger context but a smaller
overall dataset size, while a shorter sequence length indicates the opposite.
Since DP-SGD/Adam depends strongly on dataset size, we experimented with
sequence lengths of $L\in\\{128,512\\}$ to see how it affects overall
performance. Dropout is another significant hyperparameter that directly
affects model performance. In our experiments, we experimented with dropout
rates of $\\{0.0,0.1\\}$. The performance of the model under varying settings
of sequence length $L$, dropout and privacy budget $\epsilon$ on two datasets
FUNSD and CORD is shown in Fig. 5. Overall, we observed that for most
datasets, a sequence length of $L=128$ resulted in substantial performance
boosts compared to $L=512$. However, on DOCILE a sequence length of $L=512$
performed better, likely due to the fact that the DOCILE dataset contains much
larger text sequences (with $L\gg 512$) per document than other datasets.
Unlike sequence length, dropout showed a disparate effect on model
performance. For smaller datasets FUNSD, XFUND, dropout${=}0.1$ generally
resulted in better performances (especially in case of task-specific
pretraining) whereas for the remaining datasets which were much larger in
size, adding dropout considerably degraded the model performance.

######  Guideline 3.

Based on above observations, we recommend choosing a smaller sequence length
$L=128$ for datasets where average sequence sizes per document are also small
($\ll 512$), and choosing a large sequence length $L=512$ when average
sequence sizes per document are also large ($\gg 512$). In addition, we
recommend using no dropout for medium to large sized datasets and only to
explore dropout values of $0.1$ for very small datasets.

Figure 6: Full fine-tuning performs the best whereas top8 with only 50%
parameters results in performances similar to the full fine-tuning.

Dataset | Method | F1-Scorenon-private | $\epsilon_{\text{G}}$ | $\epsilon_{\text{PRV}}$ | F1-ScoreDP | F1-ScoreFedAVG | F1-ScoreFeAm-DP$(\epsilon=8)$ | F1-ScoreFeAm-DP$(\epsilon=20)$
---|---|---|---|---|---|---|---|---
$\epsilon=8$ | $\epsilon=20$ | $\epsilon=8$ | $\epsilon=20$ | $\epsilon=8$ | $\epsilon=20$ | K=2 | K=4 | K=8 | K=16 | K=2 | K=4 | K=8 | K=16 | K=2 | K=4 | K=8 | K=16
FUNSD [20] | RoBERTabase | 65.62 | $\approx 6.96$ | $\approx 19.52$ | $\approx 7.01$ | $\approx 20$ | 33.93 | 39.42 | 64.14 | 64.08 | 57.09 | 46.59 | 29.07 | 33.58 | 34.24 | 33.79 | 38.88 | 38.32 | 35.26 | 39.59
LayoutLMv3base (w/o Image) | 87.20 | 65.66 | 71.68 | 86.12 | 86.55 | 83.84 | 82.18 | 67.90 | 63.82 | 67.31 | 70.29 | 73.59 | 70.72 | 74.61 | 74.88
LayoutLMv3base | 90.22 | 78.22 | 80.12 | 88.48 | 87.73 | 88.94 | 84.40 | 77.01 | 76.30 | 72.89 | 76.06 | 78.56 | 76.17 | 75.80 | 78.21
CORD [35] | RoBERTabase | 93.50 | $\approx 7.07$ | $\approx 19.35$ | $\approx 7.11$ | $\approx 17.94$ | 72.38 | 75.61 | 93.20 | 93.88 | 91.58 | 88.23 | 68.89 | 73.31 | 71.44 | 69.12 | 76.39 | 76.34 | 75.28 | 74.92
LayoutLMv3base (w/o Image) | 95.63 | 77.39 | 80.43 | 96.07 | 95.32 | 94.53 | 87.27 | 80.71 | 74.19 | 75.32 | 74.52 | 80.77 | 80.83 | 80.10 | 79.76
LayoutLMv3base | 95.58 | 78.30 | 82.56 | 96.34 | 95.63 | 94.32 | 87.86 | 81.04 | 78.30 | 76.88 | 77.58 | 82.84 | 80.95 | 81.69 | 81.08
SROIE [19] | RoBERTabase | 91.01 | $\approx 7.03$ | $\approx 19.04$ | $\approx 7.15$ | $\approx 17.95$ | 70.41 | 75.36 | 89.50 | 88.92 | 88.95 | 86.11 | 74.35 | 71.30 | 70.96 | 66.37 | 77.50 | 76.72 | 75.59 | 75.18
LayoutLMv3base (w/o Image) | 90.60 | 74.19 | 76.56 | 90.06 | 90.65 | 89.82 | 87.42 | 75.39 | 73.73 | 72.98 | 72.10 | 79.40 | 77.71 | 78.40 | 77.69
LayoutLMv3base | 92.53 | 77.15 | 79.67 | 91.73 | 91.64 | 91.22 | 88.90 | 79.07 | 78.12 | 75.82 | 74.82 | 82.93 | 82.02 | 78.98 | 80.81
WildReceipts [44] | RoBERTabase | 89.19 | $\approx 7.03$ | $\approx 18.93$ | $\approx 7.17$ | $\approx 17.97$ | 79.01 | 81.37 | 88.32 | 87.98 | 87.48 | 86.18 | 78.76 | 78.62 | 78.67 | 78.93 | 81.38 | 81.21 | 80.58 | 81.12
LayoutLMv3base (w/o Image) | 92.34 | 79.28 | 84.46 | 91.85 | 91.74 | 91.31 | 89.53 | 82.24 | 81.82 | 82.07 | 85.46 | 85.14 | 85.81 | 85.72 | 85.46
LayoutLMv3base | 92.99 | 80.97 | 85.85 | 92.23 | 91.89 | 91.71 | 90.69 | 83.79 | 83.71 | 82.70 | 83.31 | 86.65 | 87.00 | 86.62 | 86.42
XFUND [47] | LayoutLMv3base-chinese (w/o Image) | 89.74 | $\approx 6.95$ | $\approx 19.40$ | $\approx 7.05$ | $\approx 18.07$ | 69.51 | 75.01 | 86.59 | 87.35 | 84.32 | 80.01 | 69.74 | 70.26 | 71.11 | 69.46 | 76.65 | 75.35 | 74.60 | 74.52
LayoutLMv3base-chinese | 89.43 | 69.23 | 74.93 | 87.08 | 86.08 | 82.65 | 77.07 | 68.64 | 68.50 | 63.40 | 67.59 | 75.18 | 75.00 | 71.93 | 75.22
DOCILE [53]* | RoBERTabase | 75.13 | $\approx 7.15$ | $\approx 18.89$ | $\approx 7.28$ | $\approx 18.28$ | 53.19 | 59.39 | - | - | 71.30 | 67.76 | - | - | 50.80 | 53.83 | - | - | 58.92 | 59.39
LayoutLMv3base-chinese(w/o Image) | 81.59 | 69.29 | 70.58 | - | - | 79.39 | 78.55 | - | - | 68.63 | 68.39 | - | - | 71.30 | 71.04
LayoutLMv3base-chinese | 80.29 | 69.89 | 73.19 | - | - | 79.75 | 78.22 | - | - | 70.45 | 69.97 | - | - | 72.76 | 72.95

*Reported results were computed on the validation set due to unavailability of test set.

Table 3: Performance comparison of different privacy methods on target
datasets. We only report the results obtained at the end of the full training
rather than reporting the best performance obtained over all training
rounds/epochs. For DP experiments presented here, max sequence length was set
to $L=128$, TSP was applied wherever possible, and the hyperparameters were
chosen as described in Sec. 5.2. Since DOCILE [53] is a much larger dataset,
we did not feel it necessary to experiment with a small number of clients for
this dataset and therefore we computed results only with $K{\in}\\{8,16\\}$.
See Appendix H for full configuration of hyperparameters used in these
experiments.

####  5.2.4 Assessing Parameter Reduction Techniques

Training the models with DP-SGD/Adam is considerably compute and memory
intensive, and therefore, we also investigated different parameter reduction
methods for fine-tuning under DP. In particular, we explored training the
models with LoRA [51], fine-tuning only the top 4 (top4) layers of the model
and fine-tuning only the top 8 (top8) layers of the model each of which
trained only 1%, 20% and 50% of the model parameters, respectively. We compare
these methods against full fine-tuning (full) for two datasets FUNSD and CORD
in Fig. 6. In general, it was observed that full fine-tuning performed best
when compared with other fine-tuning approaches, while top8 produced
performances similar to full fine-tuning with only 50% of the parameters
trained. LoRA, on the other hand, generally did not perform well on our small-
scale datasets even though it has previously been shown to perform well for
NLP tasks on large datasets [50, 26].

######  Guideline 4.

Based on above observations, our general recommendation is that when
sufficient compute resources are available, full finetuning should be
preferred in order to achieve the best model performance.

###  5.3 Performance Evaluation - DP/FL/DP-FL

In this section, we present the results of non-private fine-tuning, private
fine-tuning via DP-Adam, private fine-tuning via FL, and the proposed private
fine-tuning via FeAm-DP applied to the LayoutLMv3 model. To train the models
with DP-Adam, the appropriate parameters were selected according to the
guidelines provided in Sec. 5.2, and the exact same parameters were used for
DP-FL. For FL, no additional hyperparameter tuning was performed. The results
are summarized in Table 3 in which we present the performance (F1-score) of
the LayoutLMv3base model under two settings, LayoutLMv3base with image, and
LayoutLMv3base with without image (which uses only text and layout
information) and compare it with the text-only baseline model RoBERTabase on
the six datasets described in Fig. 2. We train both LayoutLMv3base (w/o image)
and RoBERTa under the same hyperparameter settings as LayoutLMv3base for all
scenarios. In addition to performance, for each dataset, we also report the
converted $\epsilon$ values under Gaussian Accountant $\epsilon_{\text{G}}$
and PRV accountant $\epsilon_{\text{PRV}}$ both of which result in slightly
better privacy (lower $\epsilon$) than the RDP accountant $\epsilon$.

A number of important observations can be made from the results reported in
Table 3. For most datasets, even after considerable hyperparameter tuning, DP
resulted in a significant loss of model utility in exchange for increased
privacy. Even so, we were still able to achieve reasonable performance for the
KIE task, ranging from $69\%$ to $80\%$ for privacy budget $\epsilon=8$, and
from $73\%$ to $86\%$ for privacy budget $\epsilon=20$. In addition, the
performance gap between non-private baseline models and private models
decreased with increasing dataset size (as evident by results on WildReceipts
and DOCILE datasets). Another noticeable aspect is that on some datasets such
as FUNSD and SROIE, the additional image modality information did not present
huge performance improvements in non-private training. However, in the case of
private training ($\epsilon\in\\{8,20\\}$), it resulted in some significant
improvements. Contrary to this, adding additional image information to XFUND
adversely affected performance. Furthermore, LayoutLMv3 significantly
outperformed the text-only baseline RoBERTa on all datasets under private
training, despite the performance gap between the two being much smaller under
non-private training.

In contrast to DP, FL under different sets of clients $K\in\\{2,4,8,16\\}$,
resulted in only minor loss of performance $(2\%{\sim}8\%)$ which was
increased as the number of clients were increased. This was expected as
greater number of clients provide more privacy due to sampling only a fraction
$C$ of clients in each FL round. Finally, in a FL-DP setting, using the
proposed FeAm-DP algorithm, we observed that overall the performance of the
models were similar to standalone DP as expected and even increasing the
number of clients had only a minor effect on the performance loss.
Interestingly, in some cases such as on WildReceipts and CORD datasets, FeAm-
DP resulted in an even higher performance than the standalone DP.

###  5.4 Conclusion

In this paper, we proposed strategies for developing private document KIE
systems by leveraging large pretrained document foundation models in
combination with 3 key privacy methods: differential privacy (DP) and
federated learning (FL), and differentially private federated learning (DP-
FL). Through an extensive evaluation over six benchmark datasets, we
demonstrated that large document foundation models can be effectively fine-
tuned for the KIE task with sufficient utility under strong privacy guarantees
($\epsilon\in\\{8,20\\}$ for DP and DP-FL). In addition, based on a
comprehensive analysis of the effects of various training parameters on
private fine-tuning, we presented practical guidelines for achieving an
optimal privacy-utility tradeoff under global DP. Lastly, we proposed FeAm-DP,
an algorithm for efficient upscaling of standalone DP to multiclient federated
setting and demonstrated its effectiveness through a range of experiments.
Overall, our work mainly focused on the application of global DP for the KIE
task. In future, it will also be worthwhile to explore local DP-based
approaches for private KIE.

## References

  * [1] Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang.  Deep learning with differential privacy.  In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. ACM, oct 2016.
  * [2] Mohammad Al-Rubaie and J. Morris Chang.  Privacy-Preserving Machine Learning: Threats and Solutions.  IEEE Secur. Priv., 17(2):49–58, mar 2019.
  * [3] Priyam Basu, Tiasa Singha Roy, Rakshit Naidu, and Zumrut Muftuoglu.  Privacy enabled Financial Text Classification using Differential Privacy and Federated Learning.  In Proceedings of the 3rd Workshop on Economics and Natural Language Processing, ECONLP 2021, pages 50–55, Stroudsburg, PA, USA, oct 2021\. Association for Computational Linguistics.
  * [4] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song.  The secret Sharer: Evaluating and testing unintended memorization in neural networks.  In Proc. 28th USENIX Secur. Symp., pages 267–284, 2019.
  * [5] Maximin Coavoux, Shashi Narayan, and Shay B Cohen.  Privacy-preserving neural representations of text.  In Proc. 2018 Conf. Empir. Methods Nat. Lang. Process. EMNLP 2018, pages 1–10, 2020.
  * [6] Timo I. Denk and Christian Reisswig.  BERTgrid: Contextualized Embedding for 2D Document Representation and Understanding.  sep 2019.
  * [7] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova.  BERT: Pre-training of deep bidirectional transformers for language understanding.  In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 4171–4186, Minneapolis, Minnesota, June 2019. Association for Computational Linguistics.
  * [8] Christophe Dupuy, Radhika Arava, Rahul Gupta, and Anna Rumshisky.  AN EFFICIENT DP-SGD MECHANISM FOR LARGE SCALE NLU MODELS.  In ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing - Proceedings, volume 2022-May, pages 4118–4122, 2022\.
  * [9] Cynthia Dwork.  Differential Privacy.  In Michele Bugliesi, Bart Preneel, Vladimiro Sassone, and Ingo Wegener, editors, Automata, Languages and Programming, pages 1–12, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg.
  * [10] C Dwork, A Roth, Cynthia Dwork, and Aaron Roth.  The Algorithmic Foundations of Differential Privacy.  Foundations and Trends R in Theoretical Computer Science, 9:211–407, 2014.
  * [11] European Parliament and Council of the European Union.  Regulation (EU) 2016/679 of the European Parliament and of the Council.
  * [12] Javier Ferrando, Juan Luis Domí nguez, Jordi Torres, Raúl García, David García, Daniel Garrido, Jordi Cortada, and Mateo Valero.  Improving accuracy and speeding up document image classification through parallel systems.  In Lecture Notes in Computer Science, pages 387–400. Springer International Publishing, 2020.
  * [13] Oluwaseyi Feyisetan, Tom Diethe, and Thomas Drake.  Leveraging hierarchical representations for preserving privacy and utility in text.  In Proceedings - IEEE International Conference on Data Mining, ICDM, volume 2019-Novem, pages 210–219, oct 2019.
  * [14] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart.  Model inversion attacks that exploit confidence information and basic countermeasures.  In Proc. ACM Conf. Comput. Commun. Secur., volume 2015-Octob, pages 1322–1333, New York, NY, USA, 2015. ACM.
  * [15] Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz.  Numerical composition of differential privacy.  In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 11631–11642. Curran Associates, Inc., 2021.
  * [16] Shlomo Hoory, Amir Feder, Avichai Tendler, Alon Cohen, Sofia Erell, Itay Laish, Hootan Nakhost, Uri Stemmer, Ayelet Benjamini, Avinatan Hassidim, and Yossi Matias.  Learning and Evaluating a Differentially Private Pre-trained Language Model.  In Findings of the Association for Computational Linguistics, Findings of ACL: EMNLP 2021, pages 1178–1189, 2021.
  * [17] Lijie Hu, Ivan Habernal, Lei Shen, and Di Wang.  Differentially Private Natural Language Models: Recent Advances and Future Directions.  jan 2023.
  * [18] Yupan Huang, Tengchao Lv, Lei Cui, Yutong Lu, and Furu Wei.  LayoutLMv3: Pre-training for Document AI with Unified Text and Image Masking.  In Proceedings of the 30th ACM International Conference on Multimedia, pages 4083–4091, New York, NY, USA, oct 2022. ACM.
  * [19] Zheng Huang, Kai Chen, Jianhua He, Xiang Bai, Dimosthenis Karatzas, Shijian Lu, and C. V. Jawahar.  ICDAR2019 competition on scanned receipt OCR and information extraction.  In 2019 International Conference on Document Analysis and Recognition (ICDAR). IEEE, sep 2019.
  * [20] Guillaume Jaume, Hazim Kemal Ekenel, and Jean-Philippe Thiran.  Funsd: A dataset for form understanding in noisy scanned documents, 2019\.
  * [21] Anoop R Katti, Christian Reisswig, Cordula Guder, Sebastian Brarda, Steffen Bickel, Johannes Höhne, and Jean Baptiste Faddoul.  Chargrid: Towards understanding 2D documents.  In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, EMNLP 2018, pages 4459–4469, Stroudsburg, PA, USA, sep 2018. Association for Computational Linguistics.
  * [22] Diederik P. Kingma and Jimmy Ba.  Adam: A method for stochastic optimization, 2017.
  * [23] Antti Koskela, Marlon Tobaben, and Antti Honkela.  Individual privacy accounting with gaussian differential privacy, 2022\.
  * [24] Chen Yu Lee, Chun Liang Li, Timothy Dozat, Vincent Perot, Guolong Su, Nan Hua, Joshua Ainslie, Renshen Wang, Yasuhisa Fujii, and Tomas Pfister.  FormNet: Structural Encoding beyond Sequential Modeling in Form Document Information Extraction.  In Proceedings of the Annual Meeting of the Association for Computational Linguistics, volume 1, pages 3735–3754. Long Papers, 2022.
  * [25] D. Lewis, G. Agam, S. Argamon, O. Frieder, D. Grossman, and J. Heard.  Building a test collection for complex document information processing.  In Proceedings of the 29th Annual International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR ’06, page 665–666, New York, NY, USA, 2006. Association for Computing Machinery.
  * [26] Xuechen Li, Florian Tramèr, Percy Liang, and Tatsunori Hashimoto.  Large Language Models Can Be Strong Differentially Private Learners.  oct 2021.
  * [27] Weihong Lin, Qifang Gao, Lei Sun, Zhuoyao Zhong, Kai Hu, Qin Ren, and Qiang Huo.  Vibertgrid: A jointly trained multi-modal 2d document representation for key information extraction from documents.  In Josep Lladós, Daniel Lopresti, and Seiichi Uchida, editors, Document Analysis and Recognition – ICDAR 2021, pages 548–563, Cham, 2021\. Springer International Publishing.
  * [28] Lingjuan Lyu, Yitong Li, Xuanli He, and Tong Xiao.  Towards Differentially Private Text Representations.  In SIGIR 2020 - Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1813–1816, New York, NY, USA, jul 2020. ACM.
  * [29] H. B. McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In International Conference on Artificial Intelligence and Statistics, 2016.
  * [30] H. B. McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang.  Learning differentially private recurrent language models.  In International Conference on Learning Representations, 2017.
  * [31] Casey Meehan, Khalil Mrini, and Kamalika Chaudhuri.  Sentence-level Privacy for Document Embeddings.  In Proceedings of the Annual Meeting of the Association for Computational Linguistics, volume 1, pages 3367–3380, Stroudsburg, PA, USA, may 2022. Association for Computational Linguistics.
  * [32] Dominique Mercier, Adriano Lucieri, Mohsin Munir, Andreas Dengel, and Sheraz Ahmed.  Evaluating privacy-preserving machine learning in critical infrastructures: A case study on time-series classification.  IEEE Transactions on Industrial Informatics, 2021.
  * [33] Ilya Mironov.  Rényi differential privacy.  In 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, aug 2017.
  * [34] Nicolas Papernot, Steve Chien, Shuang Song, Abhradeep Thakurta, and Ulfar Erlingsson.  Making the shoe fit: Architectures, initializations, and tuning for learning with privacy, 2020.
  * [35] Seunghyun Park, Seung Shin, Bado Lee, Junyeop Lee, Jaeheung Surh, Minjoon Seo, and Hwalsuk Lee.  Cord: A consolidated receipt dataset for post-ocr parsing.
  * [36] Richard Plant, Dimitra Gkatzia, and Valerio Giuffrida.  CAPE: Context-aware private embeddings for private language learning.  In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 7970–7978, Online and Punta Cana, Dominican Republic, Nov. 2021. Association for Computational Linguistics.
  * [37] Łukasz Powalski Rafałand Borchmann, Dawid Jurkiewicz, Tomasz Dwojak, and Gabriela Pietruszka Michałand Pałka.  Going Full-TILT Boogie on Document Understanding with Text-Image-Layout Transformer.  In Josep Lladós, Daniel Lopresti, and Seiichi Uchida, editors, Document Analysis and Recognition – ICDAR 2021, pages 732–747, Cham, 2021\. Springer International Publishing.
  * [38] Sashank Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Konečný, Sanjiv Kumar, and H. Brendan McMahan.  Adaptive federated optimization, 2021.
  * [39] Saifullah Saifullah, Dominique Mercier, Stefan Agne, Andreas Dengel, and Sheraz Ahmed.  Towards privacy preserved document image classification - a comprehensive benchmark.  TechRxiv preprint https://doi.org/10.36227/techrxiv.19518925.v1, 2021.
  * [40] Saifullah Saifullah, Dominique Mercier, Adriano Lucieri, Andreas Dengel, and Sheraz Ahmed.  Privacy meets explainability: A comprehensive impact benchmark.  arXiv preprint arXiv:2211.04110, 2022.
  * [41] David Sánchez and Montserrat Batet.  C-sanitized: A privacy model for document redaction and sanitization.  Journal of the Association for Information Science and Technology, 67(1):148–163, 2016.
  * [42] Zejiang Shen, Ruochen Zhang, Melissa Dell, Benjamin Charles Germain Lee, Jacob Carlson, and Weining Li.  Layoutparser: A unified toolkit for deep learning based document image analysis.  arXiv preprint arXiv:2103.15348, 2021.
  * [43] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership Inference Attacks Against Machine Learning Models.  In Proc. - IEEE Symp. Secur. Priv., pages 3–18, 2017.
  * [44] Hongbin Sun, Zhanghui Kuang, Xiaoyu Yue, Chenhao Lin, and Wayne Zhang.  Spatial dual-modality graph reasoning for key information extraction, 2021\.
  * [45] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin.  Attention is all you need, 2017.
  * [46] Dominik Wunderlich, Daniel Bernau, Francesco Aldà, Javier Parra-Arnau, and Thorsten Strufe.  On the Privacy–Utility Trade-Off in Differentially Private Hierarchical Text Classification.  Applied Sciences (Switzerland), 12(21), mar 2022.
  * [47] Yiheng Xu, Tengchao Lv, Lei Cui, Guoxin Wang, Yijuan Lu, Dinei Florencio, Cha Zhang, and Furu Wei.  XFUND: A benchmark dataset for multilingual visually rich form understanding.  In Findings of the Association for Computational Linguistics: ACL 2022, pages 3214–3224, Dublin, Ireland, May 2022. Association for Computational Linguistics.
  * [48] Yang Xu, Yiheng Xu, Tengchao Lv, Lei Cui, Furu Wei, Guoxin Wang, Yijuan Lu, Dinei Florencio, Cha Zhang, Wanxiang Che, Min Zhang, and Lidong Zhou.  LayoutLMv2: Multi-modal pre-training for visually-rich document understanding.  In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 2579–2591, Online, Aug. 2021. Association for Computational Linguistics.
  * [49] Zekun Xu, Abhinav Aggarwal, Oluwaseyi Feyisetan, and Nathanael Teissier.  A Differentially Private Text Perturbation Method Using Regularized Mahalanobis Metric.  pages 7–17, 2020.
  * [50] Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang.  Differentially Private Fine-tuning of Language Models.  oct 2021.
  * [51] Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu.  Large Scale Private Learning via Low-rank Reparametrization.  Proceedings of the 38th International Conference on Machine Learning, 139:12208–12218, jun 2021.
  * [52] Xiang Yue, Minxin Du, Tianhao Wang, Yaliang Li, Huan Sun, and Sherman S. M. Chow.  Differential privacy for text analytics via natural text sanitization.  In Findings, ACL-IJCNLP 2021, 2021.
  * [53] Štěpán Šimsa, Milan Šulc, Michal Uřičář, Yash Patel, Ahmed Hamdi, Matěj Kocián, Matyáš Skalický, Jiří Matas, Antoine Doucet, Mickaël Coustaty, and Dimosthenis Karatzas.  Docile benchmark for document information localization and extraction, 2023.

##  Appendix A DP-SGD/Adam

In our experiments, we use DP-Adam to fine-tune our models under global DP.
DP-Adam functions exactly like DP-SGD, except that it uses Adam optimizer
instead of SGD optimizer. For completeness, We have included the pseudocode
for both algorithms in Algorithm 2.

Input: $\mathcal{L}(\theta)=\frac{1}{B}\sum_{i}\mathcal{L}(\theta,x_{i})$,
Dataset $\mathcal{D}={(x_{1},y_{1}),\dots,(x_{N},y_{N})}$, learning rate
$\eta$, gradient clipping norm $S$, noise scale $\sigma$, sampling rate $q$,
target $(\epsilon,\delta)$, privacy accountant $\mathcal{M}$, total training
steps $T$

Init: Initialize $\theta_{0}$ randomly

for  _each step $t=1,\dots,T$_ do

$\mathcal{B}\leftarrow($sample a batch of size $B$ with sampling probability
$q$)

for each  _$x_{i}\in\mathcal{B}$_ compute

// Compute gradient

$\mathbf{g}(x_{i})\leftarrow\nabla_{\theta_{t}}\mathcal{L}(\theta_{t},x_{i})$

// Clip gradient

$\mathbf{\bar{g}}(x_{i})\leftarrow\mathbf{g}(x_{i})/max(1,\frac{||\mathbf{\bar{g}}(x_{i})||_{2}}{S})$

end

// Add noise

$\mathbf{\tilde{g}}\leftarrow\frac{1}{B}(\sum_{i}\mathbf{\bar{g}}(x_{i})+\mathcal{N}(0,\sigma^{2}S^{2}\mathbf{I})$

if  _Algorithm is DP-SGD_ then

// Call SGD Update

$\theta_{t+1}\leftarrow\theta_{t}-\eta\mathbf{\tilde{g}}$

else if  _Algorithm is DP-Adam_ then

// Call Adam Update

$m_{t}\leftarrow\beta_{1}m_{t-1}+(1-\beta_{1})\mathbf{\tilde{g}}$

$v_{t}\leftarrow\beta_{2}v_{t-1}+(1-\beta_{2})\mathbf{\tilde{g}}^{2}$

$m_{t}\leftarrow\frac{m_{t}}{1-\beta_{1}^{t}}$

$v_{t}\leftarrow\frac{v_{t}}{1-\beta_{2}^{t}}$

$\theta_{t+1}\leftarrow\theta_{t}+\eta\frac{m_{t}}{\sqrt{v_{t}}+\tau}$

end if

print $\mathcal{M}.\text{get\\_privacy\\_spent}(q,\sigma,t,\delta)$

end for

Algorithm 2 DP-SGD/Adam

##  Appendix B FedAvg Algorithm

For training the models in federated learning settings, we utilize the FedAvg
algorithm as described in Sec. 4.4. The pseudocode for this algorithm is
available in Algorithm 3. For all FL experiments, the number of local epochs
per client is set to one ($E=1$) for each communication round and the models
are trained using the Adam optimizer.

Input: Learning rate $\eta$, total clients K, clients sampling rate $C$, total
FL rounds $T$

Server Executes:

Init: $\theta_{0}$, $m\leftarrow CK$

for  _each round $t=1,\dots,T$_ do

$\mathcal{S}_{t}\leftarrow(\text{sample a set of $m$ clients from $K$})$

for  _each client $k\in\mathcal{S}$_ in parallel do

$\mathbf{\theta}_{k,t}\leftarrow\text{ClientUpdate}(k,\theta_{t-1})$

end

$\theta_{t}\leftarrow\sum_{k\in\mathcal{S}_{t}}\frac{n_{k}}{n}\theta_{k,t}$

end for

end

ClientUpdate  _( $k,\theta$)_:

Input: $\mathcal{L}(\theta)=\frac{1}{B}\sum_{i}\mathcal{L}(\theta,x_{i})$,
$\mathcal{D}_{k}$ of size $|\mathcal{D}_{k}|$

$\mathcal{B}\leftarrow($sample a batch of size $B$)

for  _each epoch $e=1,\dots,E$_ do

for each  _$b\in\mathcal{B}$_ compute

if  _Optimizer is SGD_ then

// Call SGD Update

$\theta\leftarrow\theta-\eta\nabla_{\theta}\mathcal{L}(\theta,b)$

else if  _Optimizer is Adam_ then

// Call Adam Update

$\mathbf{\tilde{g}}\leftarrow\nabla_{\theta}\mathcal{L}(\theta,b)$

$m_{t}\leftarrow\beta_{1}m_{t-1}+(1-\beta_{1})\mathbf{\tilde{g}}$

$v_{t}\leftarrow\beta_{2}v_{t-1}+(1-\beta_{2})\mathbf{\tilde{g}}^{2}$

$m_{t}\leftarrow\frac{m_{t}}{1-\beta_{1}^{t}}$

$v_{t}\leftarrow\frac{v_{t}}{1-\beta_{2}^{t}}$

$\theta\leftarrow\theta-\eta\frac{m_{t}}{\sqrt{v_{t}}+\tau}$

end if

end

end for

return _$\theta$_

Algorithm 3 FedAvg

##  Appendix C LayoutLMv3 for KIE

Fig. 7 illustrates the layoutlmv3 model architecture with a token-level
classification head that we have used in this work. As shown, the model takes
as input a tokenized text sequence and calculates the embedding of each token
by adding together the text embedding with the 2D bounding box position
embeddings, and the 1D position embeddings. In the next step, the input text
sequence is concatenated with an image embedding sequence, which is generated
by converting the input image into fixed-sized patches. The input is then fed
into a multimodal transformer network in order to generate the final
embeddings at the token level. In the final step, a classification head is
used to predict the label associated with each token embedding. It is
important to note that LayoutLMv3 generates 2D position embeddings using
segment-level layout (which we have also used in this study). As a result, the
bounding box for each text token corresponds to the union of all the bounding
boxes within a single segmented region such as a paragraph, table, etc. The
result is that multiple words in the same segment have the same 2D layout
embedding.

Figure 7: LayoutLMv3 model architecture with token-level classification for
key information extraction (KIE).

##  Appendix D Full Model Configuration

A complete list of the model configuration parameters used in our study can be
found in Table 4.

Model Parameter | Configuration
---|---
Number of encoder layers | $12$
Number of self-attention heads | $12$
Embedding dimension | $768$
Image input resolution $C\times H\times W$ | $3\times 224\times 224$
Image normalization mean | $[0.5,0.5,0.5]$
Image normalization std | $[0.5,0.5,0.5]$
Image patch size $P\times P$ | $16\times 16$
Dropout | $\\{0,0.1\\}$
Text sequence Length | $\\{128,512\\}$
Image sequence Length | $198$
Text lower-cased | True
Tokenization stride | $0$
Segment-level layout | True

Table 4: The full model configuration parameters used in our study.

##  Appendix E Privacy Accounting

To account for privacy loss $(\epsilon)$, we use the following accountants in
our work: (1) Rényi DP [33], (2) Gaussian DP [23], and (3) Private Random
Variable (PRV) Accountant [15], all of which represent an improvement over the
moments accountant proposed by Abadi _et al_. [1]. Accounting for privacy loss
with Rényi DP provides a strict upper bound however it may overestimate the
privacy loss. On the other hand, the Gaussian Accountant only provides an
approximation to the actual loss, which may also lead to an underestimation of
the loss. To counter these problems, Gopi _et al_. [15] proposed the PRV
Accountant which gives a better numerical approximation of the privacy leakage
compared to Rényi DP and Gaussian DP accountants.

Given a sampling rate $q$, and the target privacy budget $(\epsilon,\delta)$,
privacy accountants can be used to estimate the privacy leakage over a fixed
number of epochs $E$ for a given noise scale $\sigma$ and this process can be
numerically optimized to obtain a suitable $\sigma$ for a target privacy
budget $(\epsilon,\delta)$. We perform this optimization in combination with
the Rényi DP [33] throughout our experiments to compute the noise scale
$\sigma$. Once the noise scale $\sigma$ is determined, we also use it to
determine the privacy leakage estimate according to the Gaussian Accountant
and the PRV Accountant for each dataset as reported in Table 3.

Dataset | Field Type | Description
---|---|---
FUNSD/ XFUND | header | Document Header
question | Text sequence representing a question
answer | Text sequence representing a answer
| other | Others
CORD | menu.nm | Name of menu
menu.num | Identification number of menu
menu.unitprice | Unit price of menu
menu.cnt | Quantity of menu
menu.discountprice | Discounted price of menu
menu.price | Total price of menu
menu.itemsubtotal | Price of each menu after discount applied
menu.vatyn | Whether the price includes tax or not
menu.etc | Others
menu.sub_nm | Name of submenu
menu.sub_unitprice | Unit price of submenu
menu.sub_cnt | Quantity of submenu
menu.sub_price | Total price of submenu
menu.sub_etc | Others
void_menu.nm | Name of menu
void_menu.price | Total price of menu
subtotal.subtotal_price | Subtotal price
subtotal.discount_price | Discounted price in total
subtotal.service_price | Service charge
subtotal.othersvc_price | Added charge other than service charge
subtotal.tax_price | Tax amount
subtotal.etc | Others
total.total_price | Total price
total.total_etc | Others
total.cashprice | Amount of price paid in cash
total.changeprice | Amount of change in cash
total.creditcardprice | Amount of price paid in credit-debit card
total.emoneyprice | Amount of price paid in emoney, point
total.menutype_cnt | Total count of type of menu
total.menuqty_cnt | Total count of quantity
| other | Others
SROIE | company | Name of the company
date | Date
address | Company address
total | Total receipt amount
| other | Others
WildReceipts | store_name_value | Store name
store_name_key | Store name key
store_addr_value | Store address
store_addr_key | Store address key
tel_value | Phone number
tel_key | Phone number key
date_value | Date
date_key | Date Key
time_value | Time
time_key | Time key
prod_item_value | Product item value
prod_item_key | Product item value key
prod_quantity_value | Product item quantity
prod_quantity_key | Product item quantity key
prod_price_value | Product price
prod_price_key | Product price key
subtotal_value | Subtotal value
subtotal_key | Subtotal key
tax_value | Tax value
tax_key | Tax key
tips_value | Tips value
tips_key | Tips key
total_value | Total value
total_key | Total key
other | Others
DOCILE | account num | Bank account number
amount due | Total amount to be payed
amount paid | Total amount already paid
amount total gross | Total amount with tax
amount total net | Total amount without tax
amount total tax | Total sum of tax amounts
bank num | Bank number
bic | Bank Identifier Code (SWIFT)
currency code amount due | Currency code or symbol found near the amount due
customer billing address | Address of the company that is being invoiced
customer billing name | Name of the company that is being invoiced
customer delivery address | Address of the company for delivery of goods/services
customer delivery name | Name of the company for delivery of goods/services
customer id | Customer account number
customer order id | Any customer order reference
customer other address | Any other name and address of the purchasing company
customer other name | Any other name of the purchasing company
customer registration id | Purchaser registration identifier number
customer tax id | Purchaser tax identification number
date due | Due date for payment
date issue | Date the document was issued
document id | Main document number
iban | International Bank Account Number
order id | Any order number
payment reference | Payment reference number
payment terms | Conditions for the payment time window
tax detail gross | Tak breakdown line amount with tax
tax detail net | Tax breakdown line amount without tax
tax detail rate | Tax breakdown line tax rate
tax detail tax | Tax breakdown line tax amount
vendor address | Address of the supplier company
vendor email | Any supplier e-mail address
vendor name | Name of the supplier company
vendor order id | Any vendor order reference
vendor registration id | Supplier registration identification number
| vendor tax id | Supplier tax identification number
| other | Others

Table 5: Full list of target entity types for the datasets investigated in our
study.

(a) FUNSD

(b) SROIE

(c) XFUND

(d) DOCILE

Figure 8: A few samples from the different datasets are shown.

Parameter | Value
---|---
DP guarantee $(\epsilon,\delta)$ | $(20,1/|\mathcal{D}_{train}|)$
Clipping norm (S) | $0.1$
Learning rate $(\eta)$ | $1.0e-3$
Learning rate decay | False
Epochs $(E)$ |  $40$ for non-private;$50$ for private
Weight decay $(\lambda)$ | 0
Noise scale $(\sigma)$ |  computed such that privacy budget $(\epsilon,\delta)$ is spent after $E$ epochs
Client sampling rate (C) | 1.0 for $K=2$, 0.5 for $K>2$
Total federated rounds $(T)$ |  $40$ for FL;$\frac{1}{q}50$ for DP-FL
Fine-tuning strategy | Full

Table 6: Full list of default hyperparameters that were used in our study.

Dataset | Parameters | Values
---|---|---
FUNSD | Sequence length $(L)$ | $128$
Batch size $(B)$ | $64$
Sampling rate $(q)$ | $\frac{1}{7}$
Clipping norm (S) | $0.1$
Learning rate $(\eta)$ | $5.0e-4$
Dropout | $0.1$
TSP Dataset | CORD
| Fine-tuning strategy | Full
CORD | Sequence length $(L)$ | $128$
Batch size (B) | $384$
Sampling rate (q) | $\frac{1}{3}$
Clipping norm (S) | $0.1$
Learning rate $(\eta)$ | $5.0e-4$
Dropout | $0.0$
TSP Dataset | WildReceipts
| Fine-tuning strategy | Full
SROIE | Sequence length $(L)$ | $128$
Batch size (B) | $384$
Sampling rate (q) | $\frac{1}{5}$
Clipping norm (S) | $0.1$
Learning rate $(\eta)$ | $5.0e-4$
Dropout | $0.0$
TSP Dataset | DOCILE-Synthetic
| Fine-tuning strategy | Full
WildReceipts | Sequence length $(L)$ | $128$
Batch size $(B)$ | $384$
Sampling rate $(q)$ | $\frac{1}{6}$
Clipping norm $(S)$ | $0.1$
Learning rate $(\eta)$ | $5.0e-4$
Dropout | $0.0$
TSP Dataset | CORD
| Fine-tuning strategy | Full
XFUND | Sequence length $(L)$ | $128$
Batch size $(B)$ | $384$
Sampling rate $(q)$ | $\frac{1}{9}$
Clipping norm $(S)$ | $0.1$
Learning rate $(\eta)$ | $5.0e-4$
Dropout | $0.1$
TSP Dataset | None
| Fine-tuning strategy | Full
DOCILE | Sequence length $(L)$ | $512$
Batch size $(B)$ | $3256$
Sampling rate $(q)$ | $\frac{1}{3}$
Clipping norm $(S)$ | $0.1$
Learning rate $(\eta)$ | $5.0e-4$
Dropout | $0.0$
TSP Dataset | DOCILE-Synthetic
| Fine-tuning strategy | Full

Table 7: Final training hyperparameters that were used to fine-tune the models
under DP and DP-FL to get the the results reported in Table 3.

##  Appendix F Dataset Details

In Fig. 8, we provide a few samples from the datasets that were used in our
study. As can be seen, the datasets show a lot of diversity in terms of sample
types. In Table 5, we summarize the types of target entities available in each
dataset. As can be seen from the comparison between CORD and WildReceipts, the
two datasets have a great deal in common in terms of entity types (in addition
to the fact that both datasets are receipts datasets). Among the similar
entities are product names, quantities, and values, as well as totals,
subtotals, and tax prices.

Figure 9: Full results showing the effect of varying batch size and noise
multiplier on multiple datasets. The results were obtained with $\epsilon=20$
and $L=512$.

Figure 10: DP fine-tuning performance on different datasets under different
settings of dropout and sequence length. Figure 11: Additional results showing
the effect of learning rate on FUNSD and CORD with sequence length $L=512$.

Figure 12: DP fine-tuning performance on different datasets under different
parameter reduction techniques is shown.

Similarly, WildReceipts had matching entity types to the four target entity
types in the SROIE dataset, namely store name, store address, date, and total
value. In addition, the DOCILE dataset contained similar entities with the
names vendor name, vendor address, date issue, and multiple entities for
amount total.

##  Appendix G Default Training Hyperparameters

A summary of the default hyperparameters used in our study is provided in
Table 6.

##  Appendix H Final training hyperparameter configuration

The final training hyperparameters for each dataset that were used to compute
the results for DP and DP-FL scenarios reported in Table 3 are listed in Table
6.

##  Appendix I Additional Results - Batch sizes and Learning Rates

Additional results on the effects of batch size and learning rates on model
performance are shown in LABEL:fig:add_res_bs and Fig. 11.

##  Appendix J Additional Results - Dropout and Sequence Lengths

Additional results regarding the impact of sequence length and dropout on
model performance are presented in Fig. 10.

##  Appendix K Additional Results - Parameter Reduction Techniques

Fig. 12 presents additional results regarding the effects of different
parameter reduction techniques on model performance. For different datasets,
similar results were obtained, with full fine-tuning performing the best and
top8 following closely behind. Surprisingly, LoRA performed exceptionally well
only on WildReceipts datasets, sometimes achieving performance close to full
fine-tuning even with only 1% of the parameters trained.

##  Appendix L DP-Adam vs DP-SGD

Our work focused primarily on DP-Adam for differential privacy instead of DP-
SGD, mainly because Adam is predominantly used for fine-tuning non-private
transformer models. However, it would be worthwhile to investigate the
potential of DP-SGD for private fine-tuning as well. In Fig. 13, we present
the results of our additional experiments to assess the performance of DP-SGD
for private fine-tuning on FUNSD and CORD datasets. As can be observed, for
both $\epsilon=8$ and $\epsilon=20$, the performance of DP-SGD was comparable
to that of DP-Adam. Furthermore, we observed that DP-SGD was less sensitive to
small batch sizes than DP-Adam, and with an appropriate combination of batch
size and learning rate, it was able to achieve better performances even with
very small batch sizes ($16{\sim}32$).

(a) $\epsilon=8$

(b) $\epsilon=20$

Figure 13: DP fine-tuning performance using DP-SGD under varying settings of
batch size and learning rates. Results reported here were obtained using the
same hyperparameters as used for DP-Adam given in Table 7 but with SGD
optimizer in place of Adam optimizer.

.