# Privacy-Preserving Prompt Tuning for Large Language Model Services

Yansong Li1, Zhixing Tan2∗ Yang Liu3,4,5
1University of Ottawa, Ottawa, Canada
2Zhongguancun Laboratory, Beijing, China
3Department of Computer Science and Technology, Tsinghua University, Beijing,
China
4Institute for AI Industry Research, Tsinghua University, Beijing, China
5Institute for Artificial Intelligence, Tsinghua University, Beijing, China
Corresponding authors: Z. Tan<EMAIL_ADDRESS>and Y. Liu
(liuyang2011@tsinghua.edu.cn).

###### Abstract

Prompt tuning provides an efficient way for users to customize Large Language
Models (LLMs) with their private data in the emerging LLM service scenario.
However, the sensitive nature of private data brings the need for privacy
preservation in LLM service customization. Based on prompt tuning, we propose
Privacy-Preserving Prompt Tuning (rapt), a framework that provides privacy
guarantees for LLM services. rapt adopts a local privacy setting, allowing
users to privatize their data locally with local differential privacy. As
prompt tuning performs poorly when directly trained on privatized data, we
introduce a novel privatized token reconstruction task that is trained jointly
with the downstream task, allowing LLMs to learn better task-dependent
representations. Despite the simplicity of our framework, experiments show
that rapt achieves competitive performance across tasks while providing
privacy guarantees against adversaries.

##  1 Introduction

Recent years have witnessed the tremendous success of Large Language Models
(LLMs) Devlin et al. (2018); Brown et al. (2020). With the growing size of
LLMs, prompt tuning methods Li and Liang (2021); Lester et al. (2021) have
emerged as a simple and parameter-efficient solution for steering LLMs to
downstream tasks, which not only achieve competitive performance but also
enable mixed-task inference Li and Liang (2021). The large size of LLMs also
makes them expensive to deploy and run for individual users. As a result,
recent LLMs are usually released as cloud services and often along with a
prompt tuning API for users to customize the LLM, which is exemplified by the
recent NVIDIA NeMo LLM service.111https://www.nvidia.com/en-us/gpu-cloud/nemo-
llm-service

Although prompt tuning APIs provide an efficient way for users to customize
and utilize LLM services, the sensitive nature of private data brings concerns
about private data leakage when using LLM services. To customize and utilize
the LLM service with prompt tuning, the users need to upload their data to the
service provider. However, it is well known that the input text or even the
embedding representations may leak private information to various adversaries
Coavoux et al. (2018). Therefore, it is important to provide privacy
preservation while using and customizing LLMs to make LLM services
trustworthy.

However, privacy preservation in the context of LLM services is challenging.
First, it is not trivial to provide privacy guarantees to private data in the
context of LLM service. Existing works on LLM privacy preservation Yu et al.
(2021a); Shi et al. (2021); Anil et al. (2021); Hoory et al. (2021); Li et al.
(2021); Shi et al. (2022) focus on _centralized privacy settings_ , which rely
on the service provider to protect users from privacy leakage. Such settings
may not be satisfactory in the case of an honest-but-curious service provider
or middle eavesdropper Lyu et al. (2020). Second, imposing privacy protection
inevitably degrades the performance of downstream tasks, known as the
_privacy-utility trade-off_. Yang and Liu (2022) find that prompt tuning lacks
robustness, therefore it is likely that customizing LLMs with prompt tuning
will suffer from unaffordable performance degradation when providing privacy
protection.

Figure 1: Overview of our privacy-preserving prompting tuning framework. The
users privatize their data locally with text-to-text privatization. The
service provider allows user to customize the LLM by providing a prompt
learning API. This framework provides strong privacy protection in case of
middle eavesdropper attackers.

To address the above challenges, we propose Privacy-Preserving Prompt Tuning
(rapt), a framework for customizing and utilizing LLM service with privacy
preservation. For privacy protection, rapt applies a _local privacy_ setting
Lyu et al. (2020); Qu et al. (2021), where users apply a privacy mechanism on
data locally before publishing data. Specifically, rapt uses text-to-text
privatization Feyisetan et al. (2020), which is based on local differential
privacy (LDP) Evfimievski et al. (2003). To mitigate the performance
degradation when imposing privacy protection, we propose a novel privatized
token reconstruction task based on the recent findings that the masked
language modeling objective can learn separable deep representations Voita et
al. (2019); Mamou et al. (2020). The objective of privatized token
reconstruction is to recover the original content of a privatized special
token sequence from LLM representations, which is inspired by the success of
masked language modeling Devlin et al. (2018). Different from standard prompt
tuning, rapt trains prompt jointly on the downstream and privatized token
reconstruction tasks. In this way, rapt combines the benefit of being
lightweight and modular of prompt tuning while providing improved utility
(i.e., performance) by privatized token reconstruction. Figure 1 gives an
overview of our rapt framework.

We carry out simulated privacy attacks and conduct experiments on three
natural language understanding tasks with different LLMs to study the
effectiveness of our proposed framework. Experiments show that our rapt
achieves competitive performance while providing privacy protection across
different tasks and LLMs.

##  2 Related Work

Recent studies on LLM privacy protection can be roughly divided into
centralized and local approaches.

##### Centralized Approaches.

Most existing works focus on centralized privacy setting, which relies on a
central data curator to protect data from privacy leakage. There are many
works to study how to train a privacy-preserving LLM Carlini et al. (2021);
Hoory et al. (2021); Li et al. (2021); Yu et al. (2021b), which is beyond the
scope of this work. Kerrigan et al. (2020) use deferentially-private fine-
tuning to protect private data used to fine-tune a public language model. Yu
et al. (2021a) study protecting privacy data during fine-tuning stage with
lightweight fine-tuning methods such as adapters and prefix-tuning. Our
setting is different from all these works. We study to protect the private
data of users when using LLM services and do not assume the existence of a
central data curator.

##### Local Approaches.

Local approaches impose a stronger degree of privacy protection but at the
cost of loss in utility (i.e., the performance on the downstream task). Lyu et
al. (2020) study maintaining the utility of the model under local privacy
protection with a differentially private neural representation method. They
only consider privacy protection during the inference stage but not the fine-
tuning stage. Qu et al. (2021) propose a privacy-constrained fine-tuning (PCF)
method for privacy protection during both fine-tuning and inference stages.
Their method needs to fine-tune the entire model on privatized data, which is
costly for large language models. Our approach also adopts a local privacy
setting and supports privacy protection for fine-tuning and inference stages
but is lightweight. We also introduce a novel privatized token reconstruction
task for improving the performance of prompt tuning methods when training and
inference with privatized data.

##  3 Approach

In this section, we describe rapt in detail. We first introduce text-to-text
privatization, which is used for users to privatize their data locally. We
then describe how to customize and utilize LLM services with privatized data
using our prompting method.

###  3.1 Text-to-Text Privatization

Using LLM services may face attacks such as eavesdropping attacks. Therefore,
it is favorable to adopt a local privacy setting where users perform data
privatization locally on their devices.

As most LLMs employ a text-to-text interface, we use text-to-text
privatization in our framework following Feyisetan et al. (2020). Text-to-text
privatization is based on the $d_{\mathcal{X}}$-privacy Chatzikokolakis et al.
(2013), a distance-based relaxation form of local differential privacy, which
is widely used for protecting the privacy of textual content Feyisetan et al.
(2020); Qu et al. (2021). Formally speaking, for a given input set
$\mathcal{X}$ and output set $\mathcal{Y}$, $d_{\mathcal{X}}$ is a distance
function defined on $\mathcal{X}$. A randomized mechanism
$M:\mathcal{X}\rightarrow\mathcal{Y}$ is said to satisfies
$d_{\mathcal{X}}$-privacy if and only if for any $\bm{x}\in\mathcal{X}$ and
$\bm{x}^{\prime}\in\mathcal{X}$, the distribution over outputs of $M(\bm{x})$
and $M(\bm{x}^{\prime})$ are bounded by:

$\displaystyle\frac{P(M(\bm{x})=\bm{y})}{P(M(\bm{x}^{\prime})=\bm{y})}\leq
e^{\eta
d_{\mathcal{X}}(\bm{x},\bm{x}^{\prime})},\quad\forall\bm{y}\in\mathcal{Y},$
(1)

where $\eta\geq 0$ is the _privacy parameter_ , which controls the degree of
privacy protection.222To avoid confusion, we follow Qu et al. (2021) and use
$\eta$ to distinguish $\epsilon$, which is a commonly used parameter in
differential privacy literature.

For applying text-to-text privatization, we first need an embedding model to
map words to vectors. Given a sequence $\mathbf{x}=[x_{1},\ldots,x_{n}]$ and
an embedding model $\bm{E}\in\mathbb{R}^{|V|\times d}$, where $|V|$ and $d$
are the vocabulary size and dimension of embeddings respectively, the
embedding model maps $\mathbf{x}$ into a sequence of vectors
$[\bm{x}_{1},\ldots,\bm{x}_{n}]$. Assume using $L_{2}$ distance as the
distance function, applying $d_{\mathcal{X}}$ with privacy parameter $\eta$ to
a word embedding $\bm{x}_{t}\in\mathbb{R}^{d}$ can be through adding random
noise $\bm{z}\sim\exp(-\eta\|\bm{z}\|)$ to $\bm{x}_{t}$ Wu et al. (2017). Let
$\bm{z}=l\bm{v}$, sampling $\bm{z}$ is equivalent to first sampling the scalar
$l\sim\Gamma(d,\frac{1}{\eta})$ and then sampling the vector $\bm{v}$
uniformly from the unit ball space $\mathbb{B}^{d}$. Therefore, the privatized
representation $M(\bm{x}_{t})$ of $x_{t}$ can be formally described as

$\displaystyle M(\bm{x}_{t})=\bm{x}_{t}+\bm{z}.$ (2)

Next, we replace $x_{t}$ with a word $x_{t}^{\prime}$ that is closest to
$x_{t}$ in the embedding space:

$\displaystyle
x_{t}^{\prime}=\mathrm{argmin}_{k}\|\bm{w}_{k}-M(\bm{w}_{t})\|.$ (3)

By repetitively replacing words in a sequence $\mathbf{x}$, we obtain a
privatized textual version $M(\mathbf{x})$ of $\mathbf{x}$.

###  3.2 LLM Customization

Being lightweight and modular, prompt tuning is a suitable choice for
customizing LLM services. We shall assume the users customize LLM services
through prompt tuning APIs by uploading their privatized training data to
service providers.

####  3.2.1 Prompt Tuning

Prompt tuning uses continuous vectors to adapt LLMs and is learned through
gradient descent Li and Liang (2021); Lester et al. (2021). Prompt tuning has
many variants, such as prefix-tuning Li and Liang (2021), prompt tuning Lester
et al. (2021), and P-tuning Liu et al. (2021). We follow the notation of
Lester et al. (2021) for ease of description, but other variants are also
applicable to our approach.

Let $f$ denote the backbone LLM model for the LLM service. A prompt
$\bm{P}\in\mathbb{R}^{N\times h}$ of length $N$ is a sequence of continuous
vectors $[\bm{p}_{1},\ldots,\bm{p}_{N}]$, where $\bm{p}_{i}\in\mathbb{R}^{h}$
is a tunable virtual token embedding and $h$ is the hidden size of the
backbone LLM. Given an input sequence $\mathbf{x}=[x_{i},\ldots,x_{n}]$, the
prompt is prepended to $\bm{X}\in\mathbb{R}^{n\times h}$, where
$\bm{X}=[\bm{x}_{1},\ldots,\bm{x}_{n}]$ is the sequence of word embeddings and
$\bm{x}\in\mathbb{R}^{h}$. Then we obtain a sequence of activation by using
the LLM:

$\displaystyle\bm{H}=f(\llbracket\bm{P};\bm{X}\rrbracket),$ (4)

where $\llbracket\bm{P};\bm{X}\rrbracket$ dentoes the concatenation of two
sequences $\bm{P}$ and $\bm{X}$, and $\bm{H}\in\mathbb{R}^{n\times h}$ is the
sequence of activations. $\bm{H}$ is used to predict task-dependent labels,
typically through a language modeling head Liu et al. (2021).

####  3.2.2 Privatized Token Reconstruction

Figure 2: Details of rapt during LLM customization.

Unfortunately, directly tuning prompts on privatized data significantly
degrades the performance of LLM on downstream tasks, even with weak privacy
protections, which implies that prompt tuning is sensitive to random
perturbations imposed by text-to-text privatization.

Recent studies on language model representations Voita et al. (2019); Mamou et
al. (2020) found that the masked language modeling objective Devlin et al.
(2018) is helpful in learning separable deep representations. Inspired by
their findings, we propose a novel privatized token reconstruction task, which
is trained jointly with the downstream task. We expect training with
privatized token reconstruction can help LLMs learn better task-dependent
representations, therefore improving the performance of LLMs on downstream
tasks with privacy preservation.

Privatized token reconstruction is similar to masked language modeling.
However, reconstructing a word in a privatized input is infeasible because the
word may contain sensitive information. To alleviates this issue, we prepend a
sequence of tokens, which we refer to as “ _plain tokens_ ”, to each input in
the training data. Plain tokens consist of arbitrarily chosen tokens,
therefore, can be safely sent to the service provider without worrying about
privacy leakage. Figure 2 gives an overview of RAPT during LLM customization.

Formally, let $\mathbf{k}=[k_{1},\ldots,k_{m}]$ denote the plain tokens. Given
a set of training examples
$\mathcal{D}=\\{\langle\mathbf{x}_{i},\mathbf{y}_{i}\rangle|i=1,\ldots,|\mathcal{D}|\\}$,
where $|\mathcal{D}|$ denotes the size of the training data. The users first
prepend $\mathbf{k}$ to each input $\mathbf{x}_{i}$ and then obtain a
privatized version
$M(\llbracket\mathbf{k};\mathbf{x}_{i}\rrbracket)=[k_{1}^{\prime},\ldots,k_{m}^{\prime},x_{1}^{\prime},\ldots,x_{n}^{\prime}]$
of $\llbracket\mathbf{k};\mathbf{x}_{i}\rrbracket$ through text-to-text
privatization. Let
$\mathbf{z}=M(\llbracket\mathbf{k};\mathbf{x}_{i}\rrbracket)$, the LLM
produces a sequence of activations $\bm{G}$ with the input $\mathbf{z}$ and
the prompt $\bm{P}$:

$\displaystyle\bm{G}=f(\llbracket\bm{P};\bm{Z}\rrbracket),$ (5)

where $\bm{Z}$ is the sequence of word embeddings of $\mathbf{z}$, and
$\bm{G}\in\mathbb{R}^{(m+n)\times h}$.

After obtaining $\bm{G}$, we use the first $m$ vectors
$\bm{G}_{1:m}=[\bm{g}_{1},\ldots,\bm{g}_{m}]$ in $\bm{G}$ to reconstruct plain
tokens. To achieve this, we introduce an additional reconstruction head
consisting of two linear layers. The probability distribution for predicting
the $i$-th token $k_{i}$ in plain tokens is

$\displaystyle\bm{p}_{i}$
$\displaystyle=\textrm{softmax}(\bm{W}_{1}\bm{W}_{2}\bm{g}_{i}),$ (6)

where $\bm{W}_{1}\in\mathbb{R}^{|T|\times c}$ and
$\bm{W}_{2}\in\mathbb{R}^{c\times h}$ are the parameters of reconstruction
head, $c$ is the hidden size of the reconstruction head, and $|T|$ denotes the
vocabulary size of the reconstruction head. The loss function for the
privatized token reconstruction task is

$\displaystyle\mathcal{L}_{\textrm{rec}}$
$\displaystyle=-\sum_{i=1}^{m}\log\bm{p}_{i}[j_{i}],$ (7)

where $j_{i}$ denotes the index of $k_{i}$ in the reconstruction head
vocabulary, $\bm{p}_{i}[j_{i}]$ denotes the $j_{i}$-th scalar in the vector
$\bm{p}_{i}$. Please note that the vocabulary of the reconstruction head does
not need to be the same as the vocabulary of the LLM.

The remaining $n$ activations $\bm{G}_{n:m+n}$ are used to predict task-
dependent labels. Assume the downstream task uses cross-entropy loss,
$\mathbf{y}_{i}\in\\{0,1\\}^{|C|}$ is the associated label with
$\mathbf{y}_{j}$ denotes the label for the $j$-th class, and $|C|$ is the
number of classes. The objective function of the downstream task is formally
described as

$\displaystyle\bm{p}$ $\displaystyle=g(\bm{G}_{m:m+n}),$ (8)
$\displaystyle\mathcal{L}_{\textrm{task}}$
$\displaystyle=-\sum_{i=1}^{|C|}y_{i}\log\bm{p}[i],$ (9)

where $g$ is the function of language modeling head. As a result, the loss
function for training rapt is

$\displaystyle\mathcal{L}=\mathcal{L}_{\mathrm{task}}+\mathcal{L}_{\mathrm{rec}}\
.$ (10)

During the inference stage, the user side also applies text-to-text
privatization to protect private information and obtain the prediction from
the LLM service. We note that the reconstruction head is not used in the
inference stage, and therefore $\\{\bm{W}_{1},\bm{W}_{2}\\}$ can be discarded
after training.

(a) Embedding Inversion Attack

(b) prompt tuning

(c) prefix-tuning

Figure 3: (a) Results on embedding inversion attack. (b) and (c) Results on
attribute inference attack (for prompt tuning and prefix-tuning,
respectively).

##  4 Experiments

###  4.1 Setup

##### Baselines.

We build rapt on top of two representative prompt tuning methods: prompt
tuning Lester et al. (2021) and prefix-tuning Li and Liang (2021). Both
methods introduce a learnable continuous prompt for steering LLMs to
downstream tasks. Compared with prompt tuning, prefix-tuning introduces more
parameters by using deep prompts, which prepends continuous vectors to
activations in all LLM layers.

##### Implementation Details.

To demonstrate the versatility of rapt across LLMs, we use
BERT${}_{\textrm{BASE}}$ Devlin et al. (2018), T5${}_{\textrm{BASE}}$ Raffel
et al. (2020) as the backbone LLMs. Experiments are performed on a machine
with 8 RTX 2080Ti GPUs. We adopt Adam Kingma and Ba (2014) as the optimizer.
For the training, we set the learning rate to 6e-5 for all methods. The batch
size is set to 128, and we train all methods for a total of 4 epochs. We set
the maximum sequence length to 128 tokens. For prompt tuning, the prompt
length is set to 150, and for prefix-tuning, we set the prompt length to 10.
We set the hidden size $c$ and the vocabulary size of the reconstruction head
$|T|$ to 96 and 7,630, respectively. For the inference, we report the average
score across 5 independent runs. Unless otherwise noted, the length of plain
tokens is set to 40 in all our experiments.

Method | SST | QQP | TP-UK
---|---|---|---
75 | 125 | 175 | Avg. | 75 | 125 | 175 | Avg. | 75 | 125 | 175 | Avg.
BERT${}_{\textrm{BASE}}$
prompt tuning |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 47.1 | 49.4 | 50.2 | 48.9 | 55.4 | 63.6 | 73.4 | 64.1 | 67.1 | 79.3 | 83.6 | 76.7
$+$Reconstruction | 48.8 | 63.8 | 64.7 | 59.1 | 68.6 | 71.4 | 74.9 | 71.6 | 77.9 | 85.7 | 86.9 | 83.5
prefix-tuning |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 48.3 | 49.1 | 52.6 | 50.1 | 61.5 | 74.7 | 80.2 | 72.1 | 73.8 | 81.6 | 84.3 | 79.9
$+$Reconstruction | 49.8 | 76.1 | 87.2 | 71.1 | 65.5 | 77.1 | 85.1 | 75.8 | 75.1 | 84.9 | 88.8 | 82.9
Method | SST | QQP | TP-UK
1 | 3 | 7 | Avg. | 1 | 3 | 7 | Avg. | 1 | 3 | 7 | Avg.
T5${}_{\textrm{BASE}}$
prompt tuning |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 49.3 | 67.4 | 85.6 | 67.4 | 56.3 | 82.2 | 88.7 | 75.7 | 70.2 | 82.7 | 84.3 | 79.1
$+$Reconstruction | 51.9 | 76.1 | 89.1 | 72.4 | 65.1 | 88.4 | 90.4 | 81.3 | 78.8 | 88.2 | 89.4 | 85.4
prefix-tuning |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 50.7 | 77.9 | 90.9 | 73.1 | 63.1 | 89.8 | 91.2 | 81.4 | 74.9 | 88.9 | 89.6 | 84.5
$+$Reconstruction | 64.7 | 86.8 | 91.9 | 81.1 | 86.1 | 91.6 | 92.3 | 90.1 | 84.9 | 90.3 | 90.8 | 88.7

Table 1: Results of prompt tuning and prefix-tuning on the SST, QQP, and TP-UK
tasks with text-to-text privatization and privatized token reconstruction. The
privacy parameters $\eta$ are ranging from 75 to 175 for
BERT${}_{\textrm{BASE}}$ and 1 to 7 for T5${}_{\textrm{BASE}}$.

Method | $\bm{\eta}$ | Avg.
---|---|---
$\bm{1}$ | $\bm{3}$ | $\bm{7}$
T5${}_{\textrm{3B}}$
prompt tuning |  |  |  |
$+$Privatization | 62.7 | 77.9 | 92.1 | 77.6
$+$Reconstruction | 70.4 | 84.5 | 94.6 | 83.2
prefix-tuning |  |  |  |
$+$Privatization | 74.3 | 85.5 | 96.5 | 85.4
$+$Reconstruction | 80.3 | 92.6 | 97.2 | 90.1

Table 2: Results of prompt tuning and prefix-tuning using the
T5${}_{\textrm{3B}}$ model on the SST task with text-to-text privatization and
privatized token reconstruction.

###  4.2 Privacy Experiments

We first study the effectiveness of rapt against adversaries on simulated
attacks following Song and Raghunathan (2020). We use BERT${}_{\textrm{BASE}}$
as the backbone LLM and conduct experiments on the TP-UK dataset.

##### Attacks.

We use the following simulated attacks to study the effectiveness of rapt for
privacy protection. A detailed description of the two attacks is given in
Appendix A.3.

  * •

Embedding Inversion Attack. A token-level attack Song and Raghunathan (2020)
where the user input text representations can be reverted to the original
input text through a distance-based or MLP-based search algorithm within the
existing embedding space.

  * •

Attribute Inference Attack. An attack that attempts to infer private
attributes of users from hidden representations Al Zamal et al. (2012). TP-UK
includes demographic attributes of users: gender and age. We follow the
setting of Plant et al. (2021) to divide age properties into six equal-sized
age range bins333The bins include [$\leq$1955, 1955-1963, 1964-1971,
1972-1978, 1979-1985, $\geq$1986]. with assigned unique labels and gender into
binary categorical variables represented by 0 and 1.

##### Metrics.

We use $1-X$ as the evaluation metric for all attacks where $X$ denotes the
success rate of the simulated attack. We refer to this metric as _empirical
privacy_.

##### Results.

Figure 3(a) demonstrates the results with text-to-text privatization against
embedding inversion attacks. With privacy protection, the attacker can easily
recover the original input. With text-to-text privatization and by decreasing
the privacy parameter $\eta$, we achieve better empirical privacy. These
empirical privacy results can be used as the basis for the choice of the
privacy parameter $\eta$.

Figure 3(b) and 3(c) demonstrate the results of different prompt tuning
methods with text-to-text privatization against attribute inference attacks.
Attribute inference attacks are much harder than embedding inversion attacks
because they need to infer information from deep representations. With text-
to-text privatization, we observe improved empirical privacy for all methods.
By introducing privatized token reconstruction, we can see that both prompt
tuning and prefix-tuning achieve better empirical privacy regardless of the
value of $\eta$. These results suggest that our rapt can provide privacy
protection against attribute inference attacks.

###  4.3 Utility Experiments

We study the effectiveness of rapt in improving utility. We shall use
embedding of the backbone LLM as the embedding model to perform text-to-text
privatization.

##### Datasets.

We evaluate our approach on the following datasets: Stanford Sentiment
Treebank (SST) Socher et al. (2013), Quora Question Pairs (QQP) Chen et al.
(2018), and the UK section of the Trustpilot Sentiment (TP-UK) Hovy et al.
(2015). We use accuracy scores as evaluation metrics for the three tasks.

##### Results.

Table 1 shows the results of prompt tuning and prefix-tuning with privacy
protection on three downstream tasks. With smaller $\eta$, text-to-text
privatization offers stronger privacy guarantees but inevitably hurts the
performance of downstream tasks.444Please note that the value of privacy
parameter $\eta$ is not directly comparable for different LLMs because the
average distance between two words in the embedding space is different for
different LLMs. Without using privatized token reconstruction, we can see that
both prompt tuning and prefix-tuning perform poorly across all tasks and LLMs
even with the weakest privacy protection (the largest $\eta$), which indicates
that prompt tuning methods are sensitive to random perturbations imposed by
text-to-text privatization. By introducing the privatized token reconstruction
task, the performance of two prompt tuning methods is significantly improved
across tasks and LLMs. The results suggest that privatized token
reconstruction is very effective in improving the performance of prompt tuning
methods when trained on privatized data. The results coincide with our
intuition that using reconstruction can help LLMs learn better
representations.

To investigate whether our approach is still effective on a larger language
model, we further conduct experiments on the SST dataset using the
T5${}_{\textrm{3B}}$ LLM. These experiments are conducted on a machine with
one NVIDIA A40 GPU. Table 2 shows the results. We also observe significant
improvements when introducing privatized token reconstruction. The results
confirm that our approach is effective regardless of the size of the LLM.

Method | Params. | ACC | EMP
---|---|---|---
CAPE Plant et al. (2021) | 110M | 77.8 | 60.5
DPNR Lyu et al. (2020) | 110M | 75.5 | 60.4
Fine-tuning Qu et al. (2021) | 86M | 79.1 | 60.1
rapt (prompt tuning) | 0.12M | 77.9 | 60.5
rapt (prefix-tuning) | 0.68M | 78.7 | 60.6

Table 3: Comparisons of CAPE, DPNR and rapt performance regarding attribute
inference attack simulations. “ACC” denotes the accuracy score. “EMP” denotes
the empirical privacy protection for attribute inference attack.

###  4.4 Comparison with Other Methods

We compare our rapt with existing privacy-preserving methods for LLMs,
including CAPE Plant et al. (2021), DPNR Lyu et al. (2020), and Fine-tuning Qu
et al. (2021) methods on the SST-2 dataset. We set $\eta=100$ for fine-tuning
and rapt. Due to the differences in privacy-preserving mechanism between rapt,
CAPE and DPNR, to make a fair comparison, we adopt the settings corresponding
to the best results in CAPE and DPNR. Details of these methods are given in
Appendix A.4.

Table 3 show the results. We found rapt achieves competitive performance
compared with other privacy-preserving methods in terms of empirical privacy
protection and downstream task performance. Importantly, rapt requires much
less parameters to customize LLMs, which is crucial for LLM services.

###  4.5 Intrinsic Evaluation

We compare different variants of rapt on the SST-2 task using the
BERT${}_{\textrm{BASE}}$ model. We assume rapt uses prefix-tuning for steering
BERT${}_{\textrm{BASE}}$ to the SST-2 task.

####  4.5.1 Embedding Models

Embedding | $\bm{P}$ | $\bm{\eta}$ | ACC
---|---|---|---
BERT | 0.14 | 150 | 86.4
BioBERT | 0.16 | 125 | 86.5
GPT-2 | 0.15 | 60 | 85.3
RoBERTa | 0.14 | 50 | 84.6
T5 | 0.12 | 0.45 | 86.3

Table 4: Comparison between text-to-text privatization using different
embeddings on the SST task. “$\bm{P}$” denotes the probability of replacing a
word through text-to-text privatization.

Tokens | Choice1 | Choice2 | Choice3 | Choice4 | Choice5
---|---|---|---|---|---
ACC | 76.1 | 76.2 | 75.8 | 76.3 | 76.1

Table 5: Effect of using different plain tokens with the same length. “ACC”
denotes the accuracy score.

(a) Number of Plain Tokens

(b) Length of Plain Tokens

(c) Hidden Size

(d) Vocabulary Size

Figure 4: Effect of plain tokens and parameters of the reconstruction head.
Figure 5: We calculate the average distance in different layers of
representations between different methods.

We investigate the effect of using different embedding models in text-to-text
privatization. Specifically, the user side uses embedding models from GPT-2,
RoBERTa, BioBERT Lee et al. (2020), or T5 to map the input text to the
privatized text. We adjust the privacy parameter $\eta$ for using different
embedding models to match the level of probability for replacing a token in
text. Table 4 shows the results of our experiments. We find that using
different embedding models does not significantly affect the performance on
the downstream task, even with embedding models trained on different domains
(e.g., BERT vs. BioBERT). This is possible because recent embedding models are
similar to each other by being trained on massive data.

####  4.5.2 Privatized Token Reconstruction

##### Content of Plain Tokens.

We first show that the content of plain tokens can be chosen arbitrarily. We
randomly generate 5 plain tokens with a length of 40 and compare the
performance on the SST-2 task. Table 5 show the results. We can see that the
performances with different plain tokens of the same length are comparable.
The results suggest we can arbitrarily choose the plain tokens used in the
privatized token reconstruction task.

##### Number of Plain Tokens.

We study the effect of using diverse plain tokens in the privatized token
reconstruction task. We first construct a set of plain tokens with the same
length. Then during training, for each training input, we randomly choose
plain tokens and prepend the plain tokens to the input. From Figure 4(a), we
found that using more plain tokens during training slightly improves the
performance on SST-2. However, using one plain token during privatized token
reconstruction suffices to improve the performance of the LLM on downstream
tasks.

##### Length of Plain Tokens.

We study the effect of using plain tokens with different lengths. Intuitively,
the LLM needs to learn better representations to reconstruct longer plain
tokens. Therefore using longer plain tokens may benefit the corresponding
performance on downstream tasks. As shown in Figure 4(b), we found that the
results coincide with our intuition. Using longer plain tokens performs
significantly better than using shorter plain tokens.

##### Reconstruction Head.

We study the hidden size and vocabulary size of the reconstruction head.
Figure 4(c) and 4(d) show the results. Using a larger hidden size generally
performs better but introduces more parameters during training. As for the
vocabulary size, we found it is necessary to use a moderately large
vocabulary. A small vocabulary makes the prediction of plain tokens much
easier, therefore degrading the benefits of privatized token reconstruction
task.

##  5 Analysis

In this section, we analyze the geometry of LLM representations to study why
rapt improves the performance of downstream tasks when trained on locally
privatized data. We use prefix tuning as the prompt tuning method for rapt and
set $\eta=100$. We use BERT${}_{\textrm{BASE}}$ as the backbone LLM.

We first compute representations in each BERT layer for prefix-tuning without
privatization, prefix-tuning with text-to-text privatization, and rapt using
data from SST-2. For each layer, we project the representations of different
methods into 2D space using principal component analysis (PCA). Then we
compute the average distance of representations between different methods.
Figure 5 shows the results. We found learned deep representations that are
similar to the representations learned without using privacy protection. It is
clear that the learned representations for rapt become closer to the
representations without privacy protection as the layer number increases.
Therefore, we confirm that rapt can learn better representations.

##  6 Conclusion

In this work, we present rapt for privacy preservation for LLM services. rapt
offers stronger privacy protection with local differential privacy while
providing competitive performance with privatized token reconstruction.
Experiments verify the effectiveness of rapt across tasks and LLMs.

## Limitations

Due to limited computational resources, we have yet to verify the
effectiveness of our method on very large language models like GPT-3. We
mainly conduct experiments on natural language understanding tasks. Besides
that, we only evaluate empirical privacy level under embedding inversion and
attribute inference attack scenarios, while it remains to be explored whether
rapt can achieve comparable performance with other privacy-preserving methods
in membership inference attack scenario, which is to identify whether a sample
is used to train the LLM.

## References

  * Al Zamal et al. (2012) Faiyaz Al Zamal, Wendy Liu, and Derek Ruths. 2012.  Homophily and latent attribute inference: Inferring latent attributes of twitter users from neighbors.  In _Proc. of AAAI_ , volume 6, pages 387–390.
  * Anil et al. (2021) Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. 2021.  Large-scale differentially private bert.  _arXiv preprint arXiv:2108.01624_.
  * Brown et al. (2020) Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020.  Language models are few-shot learners.  _Advances in neural information processing systems_ , 33:1877–1901.
  * Carlini et al. (2021) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021.  Extracting training data from large language models.  In _USENIX Security_ , pages 2633–2650.
  * Chatzikokolakis et al. (2013) Konstantinos Chatzikokolakis, Miguel E Andrés, Nicolás Emilio Bordenabe, and Catuscia Palamidessi. 2013.  Broadening the scope of differential privacy using metrics.  In _Proc. of PETS_ , pages 82–102. Springer.
  * Chen et al. (2018) Zihan Chen, Hongbo Zhang, Xiaoji Zhang, and Leqi Zhao. 2018.  Quora question pairs.  _University of Waterloo_ , pages 1–7.
  * Coavoux et al. (2018) Maximin Coavoux, Shashi Narayan, and Shay B Cohen. 2018.  Privacy-preserving neural representations of text.  _arXiv preprint arXiv:1808.09408_.
  * Devlin et al. (2018) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018.  Bert: Pre-training of deep bidirectional transformers for language understanding.  _arXiv preprint arXiv:1810.04805_.
  * Evfimievski et al. (2003) Alexandre Evfimievski, Johannes Gehrke, and Ramakrishnan Srikant. 2003.  Limiting privacy breaches in privacy preserving data mining.  In _Proc of SIGMOD-SIGACT-SIGART_ , pages 211–222.
  * Feyisetan et al. (2020) Oluwaseyi Feyisetan, Borja Balle, Thomas Drake, and Tom Diethe. 2020.  Privacy-and utility-preserving textual analysis via calibrated multivariate perturbations.  In _Proc. of WSDM_ , pages 178–186.
  * Hoory et al. (2021) Shlomo Hoory, Amir Feder, Avichai Tendler, Sofia Erell, Alon Peled-Cohen, Itay Laish, Hootan Nakhost, Uri Stemmer, Ayelet Benjamini, Avinatan Hassidim, et al. 2021.  Learning and evaluating a differentially private pre-trained language model.  In _proc. of EMNLP_ , pages 1178–1189.
  * Hovy et al. (2015) Dirk Hovy, Anders Johannsen, and Anders Søgaard. 2015.  User review sites as a resource for large-scale sociolinguistic studies.  In _Proc. of TheWebConf_ , pages 452–461.
  * Kerrigan et al. (2020) Gavin Kerrigan, Dylan Slack, and Jens Tuyls. 2020.  Differentially private language models benefit from public pre-training.  _arXiv preprint arXiv:2009.05886_.
  * Kingma and Ba (2014) Diederik P Kingma and Jimmy Ba. 2014.  Adam: A method for stochastic optimization.  _arXiv preprint arXiv:1412.6980_.
  * Lee et al. (2020) Jinhyuk Lee, Wonjin Yoon, Sungdong Kim, Donghyeon Kim, Sunkyu Kim, Chan Ho So, and Jaewoo Kang. 2020.  Biobert: a pre-trained biomedical language representation model for biomedical text mining.  _Bioinformatics_ , 36(4):1234–1240.
  * Lester et al. (2021) Brian Lester, Rami Al-Rfou, and Noah Constant. 2021.  The power of scale for parameter-efficient prompt tuning.  _arXiv preprint arXiv:2104.08691_.
  * Li and Liang (2021) Xiang Lisa Li and Percy Liang. 2021.  Prefix-tuning: Optimizing continuous prompts for generation.  In _Proc. of ACL_ , pages 4582–4597.
  * Li et al. (2021) Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. 2021.  Large language models can be strong differentially private learners.  _arXiv preprint arXiv:2110.05679_.
  * Liu et al. (2021) Xiao Liu, Kaixuan Ji, Yicheng Fu, Zhengxiao Du, Zhilin Yang, and Jie Tang. 2021\.  P-tuning v2: Prompt tuning can be comparable to fine-tuning universally across scales and tasks.  _arXiv preprint arXiv:2110.07602_.
  * Lyu et al. (2020) Lingjuan Lyu, Xuanli He, and Yitong Li. 2020.  Differentially private representation for NLP: Formal guarantee and an empirical study on privacy and fairness.  In _Proc. of EMNLP_ , pages 2355–2365.
  * Mamou et al. (2020) Jonathan Mamou, Hang Le, Miguel Del Rio, Cory Stephenson, Hanlin Tang, Yoon Kim, and SueYeon Chung. 2020.  Emergence of separable manifolds in deep language representations.  In _37th International Conference on Machine Learning, ICML 2020_. International Machine Learning Society (IMLS).
  * Plant et al. (2021) Richard Plant, Dimitra Gkatzia, and Valerio Giuffrida. 2021.  CAPE: Context-aware private embeddings for private language learning.  In _Proc. of EMNLP_ , pages 7970–7978.
  * Qu et al. (2021) Chen Qu, Weize Kong, Liu Yang, Mingyang Zhang, Michael Bendersky, and Marc Najork. 2021.  _Natural Language Understanding with Privacy-Preserving BERT_, page 1488–1497.
  * Raffel et al. (2020) Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020.  Exploring the limits of transfer learning with a unified text-to-text transformer.  _The Journal of Machine Learning Research_ , 21(1):5485–5551.
  * Shi et al. (2022) Weiyan Shi, Si Chen, Chiyuan Zhang, Ruoxi Jia, and Zhou Yu. 2022.  Just fine-tune twice: Selective differential privacy for large language models.  _arXiv preprint arXiv:2204.07667_.
  * Shi et al. (2021) Weiyan Shi, Aiqi Cui, Evan Li, Ruoxi Jia, and Zhou Yu. 2021.  Selective differential privacy for language modeling.  _arXiv preprint arXiv:2108.12944_.
  * Socher et al. (2013) Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013.  Recursive deep models for semantic compositionality over a sentiment treebank.  In _Proc. of EMNLP_ , pages 1631–1642.
  * Song and Raghunathan (2020) Congzheng Song and Ananth Raghunathan. 2020.  Information leakage in embedding models.  In _Proc. of ACM SIGSAC_ , pages 377–390.
  * Voita et al. (2019) Elena Voita, Rico Sennrich, and Ivan Titov. 2019.  The bottom-up evolution of representations in the transformer: A study with machine translation and language modeling objectives.  In _Proc. of ACL_ , pages 4396–4406.
  * Wu et al. (2017) Xi Wu, Fengan Li, Arun Kumar, Kamalika Chaudhuri, Somesh Jha, and Jeffrey Naughton. 2017.  Bolt-on differential privacy for scalable stochastic gradient descent-based analytics.  In _Proc. of the SIGMOD_ , pages 1307–1322.
  * Yang and Liu (2022) Zonghan Yang and Yang Liu. 2022.  On robust prefix-tuning for text classification.  _arXiv preprint arXiv:2203.10378_.
  * Yu et al. (2021a) Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. 2021a.  Differentially private fine-tuning of language models.  _arXiv preprint arXiv:2110.06500_.
  * Yu et al. (2021b) Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. 2021b.  Large scale private learning via low-rank reparametrization.  In _Proc. of ICML_ , pages 12208–12218. PMLR.

##  Appendix A Appendix

###  A.1 Results without Privacy Protection

Method | SST | QQP | TP-UK
---|---|---|---
BERT${}_{\textrm{BASE}}$
prompt tuning | 88.3 | 87.7 | 88.7
$+$Reconstruction | 88.7 | 87.2 | 88.1
prefix-tuning | 90.6 | 88.6 | 90.1
$+$Reconstruction | 90.7 | 89.9 | 90.2
Method | SST | QQP | TP-UK
T5${}_{\textrm{BASE}}$
prompt tuning | 91.2 | 94.9 | 91.4
$+$Reconstruction | 91.4 | 94.1 | 91.3
prefix-tuning | 94.6 | 95.6 | 92.1
$+$Reconstruction | 94.3 | 95.7 | 92.4

Table 6: Results of prompt tuning and prefix-tuning on different tasks. We do
not privatize the training data using text-to-text privatization.

Table 6 show the results of prompt tuning and prefix-tuning without privacy
protection. Without privacy protection, reconstructing plain tokens becomes
trivial. As a result, adding token reconstruction cannot bring further
improvements.

###  A.2 Other Fine-tuning Methods

Our privacy mechanism and privatized reconstruction task can also applicable
to other fine-tuning methods. Table 9 shows the results of using prompt
tuning, prefix-tuning, adapter, and fine-tuning for steering LLMs to
downstream tasks. No matter which fine-tuning method used, privatized token
reconstruction improves the performance on downstream tasks significantly.

###  A.3 Detailed Descriptions of Simulated Attacks

####  A.3.1 Attribute Inference Attack

An attacker $\bm{a}$ can infer user’s private attribute
$\bm{t_{i}}\in\\{0,1\\}^{|C|}$ from the hidden representations
$\bm{Z}=\\{z_{1},...,z_{n}\\}$, $|C|$ is the number of private classes.
$\bm{Z}$ can either be the mean vector of perturbed word embeddings
$\bm{M(\bm{x})}$ or the output contextualized representations $\bm{H}$ of LLM.
Specifically, the attacker’s objective is:

$\displaystyle\bm{p}$
$\displaystyle=\bm{a}(\frac{1}{n}\sum_{i=1}^{n}\bm{z}_{i};\bm{\theta_{\bm{a}}}),$
(11) $\displaystyle\mathcal{L}_{\textrm{attack}}$
$\displaystyle=-\sum_{i=1}^{|C|}t_{i}\log\bm{p}_{i},$ (12)

where $\bm{\theta_{\bm{a}}}$ is set of trainable parameters in attacker. We
utilize a 2-layer MLP with 768 hidden units and ReLU activation function as
the attribute inference attacker based on Plant et al. (2021)’s setting.

####  A.3.2 Embedding Inversion Attack

We follow Qu et al. (2021) white-box inversion setting. Given $\mathbb{R}^{d}$
is the general embedding space, for any privatized token embedding
$\bm{v}_{t}$, we could recover the original token embedding through $L_{2}$
distance

$\min\lVert\bm{v}-\bm{v}_{t}\rVert_{2},\quad\bm{v}\in\mathbb{R}^{d}.$ (13)

We leverage the nearest neighbour search as the embedding inversion attacker
to search the nearest token embedding within the original embedding space for
each perturbed word embedding.

Figure 6: t-SNE plots of private attribute (Gender) representations from the
last layer of the BERT${}_{\textrm{BASE}}$ model without privacy protection.

###  A.4 Detailed Descriptions of Other Methods

  * •

CAPE Plant et al. (2021): applying both Laplace-based embedding perturbation
and an adversarial learning objective to privatize the representation outputs
of LLM.

  * •

DPNR Lyu et al. (2020): incorporating word dropout and Laplace-based embedding
perturbation to privatize the representation outputs of LLM.

  * •

Finetuning Qu et al. (2021): using $d_{\mathcal{X}}$-privacy to perturb user
input embedding and updating the entire LLM to adopt privatized word
embeddings.

As for CAPE, we applied BERT${}_{\textrm{BASE}}$ model with privacy parameters
$\epsilon=0.01$ and $\lambda=1.5$ and set learning rate to $1e-3$ in
adversarial training process. As for DPNR, we applied BERT${}_{\textrm{BASE}}$
model and set word dropout rate $\mu=0.1$ and privacy parameters $\epsilon=5$.
We set $\eta=100$ for our rapt.

###  A.5 Effect of Prompt Length

Prompt Length | Params. | 75 | 125 | 150
---|---|---|---|---
+Privatization
10 | 0.61M | 48.3 | 49.1 | 52.6
40 | 0.95M | 49.7 | 50.4 | 54.8
100 | 1.51M | 49.4 | 50.1 | 53.2
+Reconstruction
10 | 0.61M | 49.8 | 76.1 | 87.2
40 | 0.95M | 50.4 | 77.9 | 88.6
100 | 1.51M | 50.1 | 76.8 | 87.9

Table 7: Results of prefix-tuning on SST-2 with varying prompt length and
$\eta$. ”Params.“ denotes the number of parameters in the prompt.

Table A.5 shows the performance of rapt using different prompt length. We can
see that rapt typically performs better as the length of the prompt increases
because the number of trainable parameters is proportional to the length of
the prompt. Adding privatized token construction task does not affect this
trend.

###  A.6 Plain Tokens

Table 8 shows the plain tokens used in our experiments for different tasks.

###  A.7 Visualization

Figure 6 gives a visualization of distributions of private attribute
representations for different methods. It is clear that with text-to-text
privatization, it is hard to infer private attribute based on the distribution
for prefix-tuning and rapt.

SST |  ##clusive decides discouraged adultery ##oche sampson denise cavendish epilogue humorous smart compliance michelangelo cooling disused employing cables must donald gauge like chargers ##itude machines rated love fumbled downloadable dynasties fcc ##bang demonstrations ##nate impatient roma afghan should eaten loans
---|---
QQP |  bosnian reply nowadays champs engulfed baden total identifying internet organist tribunal ##suka highlight relief ##rogate calhoun nationality pulitzer assigned 27th motorcycles clubhouse sexes calculating isabel ##aine scattered intriguing scenario snails lands livingstone wonder taken lengths governing prophets gun
TP-UK |  ##quil actress outrageous showcasing virtues battleship crimean big executions quarter vodka groups meredith arguments approached ulysses optimization bright brother sterile secretaries legitimacy leicestershire swore yahoo active bang 101 confessions ##iness ate pena ##sky hello contra ##utz ##rada accelerated gael expertise

Table 8: Plain tokens for SST, QQP, and TP-UK, respectively

Method | SST | QQP | TP-UK
---|---|---|---
75 | 100 | 125 | 150 | 175 | 75 | 100 | 125 | 150 | 175 | 75 | 100 | 125 | 150 | 175
BERT${}_{\textrm{BASE}}$
prompt tuning |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 47.1 | 48.4 | 49.4 | 49.6 | 50.2 | 55.4 | 59.1 | 63.6 | 69.8 | 73.4 | 67.1 | 71.8 | 79.3 | 81.9 | 83.6
$+$Reconstruction | 48.8 | 49.4 | 56.7 | 63.8 | 75.3 | 63.8 | 68.6 | 75.2 | 81.4 | 83.2 | 74.9 | 78.0 | 82.2 | 85.7 | 87.0
prefix-tuning |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 48.3 | 48.8 | 49.1 | 49.9 | 52.6 | 61.5 | 67.4 | 74.7 | 78.1 | 80.2 | 73.8 | 76.6 | 81.6 | 83.8 | 84.3
$+$Reconstruction | 49.9 | 50.8 | 76.0 | 84.7 | 87.2 | 65.5 | 70.0 | 77.1 | 83.3 | 85.1 | 75.1 | 78.7 | 84.9 | 87.8 | 88.8
adapter |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 49.8 | 50.2 | 53.2 | 55.3 | 59.7 | 63.1 | 70.0 | 75.3 | 79.8 | 83.1 | 72.3 | 77.9 | 83.4 | 85.2 | 87.4
$+$Reconstruction | 50.0 | 53.3 | 78.5 | 86.9 | 89.5 | 67.2 | 73.1 | 80.0 | 86.2 | 87.9 | 75.5 | 80.3 | 85.9 | 88.2 | 89.9
fine-tuning |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 49.9 | 51.4 | 79.3 | 85.9 | 89.7 | 66.2 | 72.6 | 81.0 | 86.2 | 88.2 | 75.3 | 79.9 | 86.8 | 90.2 | 90.5
$+$Reconstruction | 51.2 | 58.0 | 81.2 | 87.3 | 90.6 | 73.6 | 75.6 | 83.3 | 87.6 | 89.7 | 77.8 | 81.3 | 88.0 | 90.6 | 90.9
Method | SST | QQP | TP-UK
1 | 2 | 3 | 5 | 7 | 1 | 2 | 3 | 5 | 7 | 1 | 2 | 3 | 5 | 7
T5${}_{\textrm{BASE}}$
prompt tuning |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 49.3 | 55.6 | 67.4 | 74.9 | 85.6 | 56.3 | 77.8 | 82.2 | 85.5 | 88.7 | 70.2 | 80.5 | 82.7 | 83.6 | 84.3
$+$Reconstruction | 52.0 | 70.9 | 76.1 | 86.7 | 89.1 | 65.1 | 82.4 | 88.4 | 89.3 | 90.4 | 78.8 | 86.8 | 88.2 | 89.1 | 89.4
prefix-tuning |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 50.7 | 68.8 | 77.9 | 90.1 | 90.9 | 63.1 | 86.5 | 89.8 | 91.0 | 91.2 | 74.9 | 86.3 | 89.0 | 89.6 | 89.6
$+$Reconstruction | 64.7 | 72.6 | 86.8 | 91.6 | 92.0 | 86.1 | 89.7 | 91.6 | 91.9 | 92.3 | 84.9 | 89.2 | 90.3 | 90.6 | 90.8
adapter |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 51.2 | 70.1 | 80.5 | 90.4 | 91.8 | 65.7 | 87.2 | 90.1 | 91.4 | 92.4 | 77.8 | 85.4 | 89.9 | 90.4 | 90.7
$+$Reconstruction | 64.9 | 73.4 | 87.6 | 91.9 | 92.4 | 86.4 | 90.5 | 91.6 | 92.1 | 92.5 | 87.4 | 89.6 | 90.6 | 90.9 | 90.9
fine-tuning |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
$+$Privatization | 64.3 | 78.8 | 87.7 | 92.1 | 92.5 | 84.1 | 91.1 | 91.8 | 92.0 | 92.4 | 86.8 | 89.9 | 90.5 | 90.7 | 90.9
$+$Reconstruction | 64.8 | 79.9 | 88.8 | 92.1 | 92.6 | 87.0 | 91.8 | 91.9 | 92.0 | 92.5 | 87.9 | 90.6 | 90.9 | 91.0 | 91.3

Table 9: Comparison between prompt tuning, prefix-tuning, adapter and fine-
tuning on the SST, QQP, and TP-UK tasks with privatization and reconstruction
configuration. The privacy parameters $\eta$ are ranging from 75 to 175 for
BERT and 1 to 7 for T5.