Professor Gautam Kamath and his international collaborators from industry and academia have received the runner-up Caspar Bowden Award at PETS 2026, the 26^th Privacy Enhancing Technologies Symposium, held this year in Calgary from July 20 to 25.

Established in 2003, the Caspar Bowden Award for Outstanding Research in Privacy Enhancing Technologies recognizes researchers who have made outstanding contributions to the theory, design, implementation, or deployment of privacy enhancing technologies.

Their paper, Differentially Private Fine-tuning of Language Models, demonstrates that advances in natural language processing, parameter efficiency, privacy accounting, and large language models can be combined to enable private fine-tuning of models with performance that approaches that of non-private models.

The paper was described as a landmark contribution to privacy-preserving machine learning that has challenged conventional wisdom about differentially private machine learning while transforming both research and practice in the field. The work identified foundation model fine-tuning as an appropriate setting for differential privacy, developed an effective parameter-efficient framework for differential privacy–preserving adaptation, and solved several major barriers to practical private training within a single approach. The resulting framework achieves state-of-the-art empirical performance, has led to real-world deployments at Microsoft and other organizations, and has inspired a large body of follow-up research.

More about this award-winning research

When trained using conventional methods, deep learning models can leak sensitive information about the data on which they are trained. To address this issue, models can instead be trained to guarantee differential privacy, a rigorous notion of data privacy that limits the influence of any individual training point on the final model. While differential privacy is one of the few approaches that can provide machine learning models with strong privacy guarantees, it often comes at a cost of reduced test accuracy. A commonly cited explanation is that differentially private training requires substantially more data. Acquiring additional data, however, can be difficult, especially where privacy is a prime concern.

Transformer-based large language models have enabled significant advances in natural language processing, achieving state-of-the-art accuracy across a wide range of tasks. These models are first pre-trained on a large and diverse public dataset and then fine-tuned for each task of interest using a much smaller task-specific dataset. This two-stage approach can be adapted to solve tasks in private learning, helping address the data shortage issue by leveraging the scale of the public pre-training dataset.

Despite their success, task-specific fine-tuning introduces challenges. In the non-private setting, the immense size of large language models makes it impractical to fine-tune the full model and store a separate copy of the parameters for hundreds of downstream tasks. Differential privacy introduces additional overheads in computation, memory use, and accuracy. A recent line of work in the non-private literature has proposed parameter-efficient methods to alleviate the issues of storage and computational cost for fine-tuning. The main focus of the award-winning paper was to explore public pre-training and private fine-tuning on large transformer-based language models.

The researchers’ primary contribution was to show that this paradigm could support rigorous privacy guarantees while only experiencing a modest drop in model utility. Their key findings are the following —

• State-of-the-art utility and privacy. Empirical evaluation of algorithms revealed that they achieve state-of-the-art accuracy versus privacy trade-offs, improving upon the previous best approaches. More importantly, for any fine-tuning tasks the utility of models trained with differential privacy approached that of non-private models.
• Larger models are better. Previous research has shown that larger language models achieve better accuracy for downstream tasks. While the power of large models has been established in the non-private setting, the researchers found that this phenomenon persists under differential privacy. Their empirical results show that fine-tuning the biggest models achieves the best accuracy.
• Simpler, sparser, and faster. Differential privacy can significantly increase computational and memory overheads. The large number of parameters contributes to the high cost of training large language models, which can increase training time by up to two orders of magnitude under privacy. The parameter-efficient approach the researchers employed partially offset this issue. As only a small fraction of the total number of parameters is updated, training becomes more computationally and memory efficient. Furthermore, as in the non-private setting, this framework leads to a modular design, where a single large pre-trained model can be augmented with lightweight modifications for downstream tasks.

To learn more about the award-winning research on which this article is based, please see Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, Huishuai Zhang. Differentially Private Fine-tuning of Language Models. Journal of Privacy and Confidentiality, vol. 14 (2) 2024.