While open Large Language Models (LLMs) have made significant progress, they still fall short of matching the performance of their closed, proprietary counterparts, making the latter attractive even for the use on highly \textit{private} data. Recently, various new methods have been proposed to adapt closed LLMs to private data without leaking private information to third parties and/or the LLM provider. In this work, we analyze the privacy protection and performance of the four most recent methods for private adaptation of closed LLMs. By examining their threat models and thoroughly comparing their performance under different privacy levels according to differential privacy (DP), various LLM architectures, and multiple datasets for classification and generation tasks, we find that: (1) all the methods leak query data, i.e., the (potentially sensitive) user data that is queried at inference time, to the LLM provider, (2) three out of four methods also leak large fractions of private training data to the LLM provider while the method that protects private data requires a local open LLM, (3) all the methods exhibit lower performance compared to three private gradient-based adaptation methods for \textit{local open LLMs}, and (4)~the private adaptation methods for closed LLMs incur higher monetary training and query costs than running the alternative methods on local open LLMs. This yields the conclusion that, to achieve truly \textit{privacy-preserving LLM adaptations} that yield high performance and more privacy at lower costs, taking into account current methods and models, one should use open LLMs. It is important to note that the field of privacy-preserving adaptations of LLMs is relatively new and rapidly evolving. Consequently, our findings are based on the currently available methods and may evolve as new techniques are developed.
Conference on Neural Information Processing Systems (NeurIPS)
2024
2024-10-16