Federated Foundation Language Model Post-Training Should Focus on Open-Source Models

Technical Summary: Federated Foundation Language Model Post-Training Should Focus on Open Models

Problem Statement
The paper addresses the emerging practice of applying Federated Learning (FL) to the post-training of foundation language models (FLMs). While FL offers a decentralized paradigm for adapting models to downstream tasks without centralizing private data, recent approaches increasingly rely on black-box and gray-box foundation models (e.g., models accessed solely via API with hidden weights and architecture). The authors argue that blindly replicating centralized post-training strategies using these closed models in an FL context contradicts the core principles of federation, specifically data privacy, client autonomy, and transparency. The central problem is determining whether the convenience and performance of closed models justify the erosion of FL's fundamental benefits when applied to post-training.

Methodology and Framework
The paper employs a conceptual and analytical framework rather than empirical experimentation. The methodology involves:

1. Classification of Model Openness: The authors categorize FLMs into four distinct types based on accessibility and licensing:
   • Open-Source: Full access to weights, source code, architecture, and training data under permissive licenses.
   • Open-Weight: Full access to weights and architecture, but no source code or training data (often under restrictive licenses).
   • Gray-Box: Partial access via APIs, allowing limited fine-tuning (e.g., adapter layers or soft prompts) while the base model remains frozen and proprietary.
   • Black-Box: Restricted to token exchange via API; no access to internal parameters, architecture, or fine-tuning interfaces.
2. Comparative Analysis: The authors systematically evaluate these model types against the three pillars of FL: Privacy (keeping data local), Autonomy (client control over training and usage), and Heterogeneity (accommodating diverse data distributions).
3. Security and Privacy Audit: The paper analyzes the attack surface and available defense mechanisms (e.g., Differential Privacy, Secure Aggregation, Homomorphic Encryption) for different post-training methods (Full Fine-Tuning, LoRA, Prompt Tuning, RLHF) across the four model categories.
4. Decision Framework: A decision tree is constructed to guide practitioners in selecting model types based on specific constraints like local resources, licensing requirements, and security needs.

Key Contributions
The paper makes five primary contributions:

1. Taxonomy of Openness: A detailed classification of foundation models and their specific implications for federated post-training methods, highlighting that model openness dictates the available optimization techniques (e.g., Full Fine-Tuning is impossible with black-box models).
2. Critical Analysis of Closed Models: A rigorous discussion on why using black-box and gray-box models in FL is problematic. The authors demonstrate that relying on third-party APIs for post-training reintroduces the risk of data leakage (as inputs must leave the client) and diminishes client autonomy.
3. Argument for Open Models: A structured argument that open-source and open-weight models align better with FL goals. They enable the use of robust privacy mechanisms, allow for comprehensive control over the training process, and support a wider range of efficient post-training techniques like Parameter-Efficient Fine-Tuning (PEFT) and LoRA.
4. Security and Privacy Analysis: A granular assessment of which attacks (poisoning, membership inference, gradient inversion) are relevant to specific post-training methods and model types, and which defenses are controllable by the client in each scenario.
5. Practical Selection Guide: A decision tree and accompanying guidelines to help researchers and practitioners choose the appropriate model type (open vs. closed) based on their specific operational constraints and privacy requirements.

Results and Findings

• Compatibility: Open-source and open-weight models are fully compatible with all post-training methods (FFT, LoRA, RLHF, Prompt Tuning) and allow for local deployment, ensuring data never leaves the client.
• Limitations of Closed Models: Black-box models restrict post-training to prompt-based methods (e.g., soft prompts, textual gradients) and require clients to send data to a central provider, fundamentally violating the "data stays local" tenet of FL. Gray-box models offer a middle ground but still rely on provider-managed infrastructure.
• Control vs. Risk: While open models increase the client's attack surface (requiring clients to implement their own defenses), they grant full control over those defenses. Conversely, closed models reduce the attack surface for the client (as the provider manages the base model) but remove the client's ability to verify or control the security of the underlying system.
• Licensing Impact: Restrictive licenses (common in "open-weight" models like Llama 3) can hinder client autonomy by imposing usage restrictions that may conflict with specific federated use cases, even if the weights are accessible.

Significance and Claims
The paper claims that the current trend of adopting black-box models for federated post-training is a strategic misalignment that undermines the very purpose of federated learning. The authors assert that federated foundation language model post-training should focus on open models.

The significance of this work lies in providing a critical lens for the community to evaluate the trade-offs between the convenience of API-based closed models and the privacy/autonomy guarantees of open models. The authors position their work as a "toolbox" to help researchers make informed decisions, arguing that while closed models have advantages in centralized settings (performance, ease of deployment), they are generally unsuitable for the privacy-preserving, decentralized goals of FL. The paper concludes that open models are the default choice for FL, with closed models being a fallback only when absolutely necessary due to resource constraints or specific licensing needs.