Privacy-Enhanced Federated Prompt Tuning Against Backdoor Attack

Abstract

With the rapid development of large language models, the fine-tuning of downstream tasks has become a key problem. As a new learning paradigm, prompt learning can greatly reduce the number of updated parameters and effectively reduce the communication cost in federated learning scenarios by freezing the pre-trained model and fine-tuning soft prompt parameters. However, for the federated prompt tuning, the local prompt usually contains the user’s personal information, and the text input of the user are easily leaked through the aggregation directly on the server. Meanwhile, the soft prompt is vulnerable to poisoning attacks launched by malicious users (such as backdoor). For the above problems, this article proposes a privacy-preserving federated prompt fine-tuning against poisoning attacks. Specifically, we use homomorphic encryption to ensure the confidentiality of local prompts, and aggregate prompts under ciphertext to generate global prompts. Second, the proposed mechanism of backdoor detection is used to judge whether the prompt contains backdoors to resist the malicious attacks in the form of ciphertext. Both local and global prompts are invisible to the server during the entire training process. Finally, theoretical analysis and experimental results show that the accuracy error between the plaintext domain and the ciphertext domain is controlled within 2%-5% under backdoor attack, which effectively enhances the robustness of the model.