🤖 machine learning

PRISM: Gauge-Invariant Tangent-Space Differentially Private LoRA

The paper introduces PRISM, a gauge-invariant differentially private mechanism for Low-Rank Adaptation (LoRA) that resolves the unbounded noise amplification caused by non-identifiable parameter factorizations by operating directly on the intrinsic tangent space of the update matrix.

Original authors: Shihao Wang, Xueru Zhang

Published 2026-06-02

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shihao Wang, Xueru Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Teaching a Robot Without Spilling Secrets

Imagine you have a giant, super-smart robot (a "Foundation Model") that knows everything about the world. You want to teach it a specific new skill, like writing medical reports or solving math problems, using a small set of private data (like patient records or student grades).

You can't retrain the whole robot; it's too expensive and slow. Instead, you use a technique called LoRA (Low-Rank Adaptation). Think of LoRA as giving the robot a small, detachable "glasses" or "adapter" that tweaks its behavior just enough to learn the new task.

The problem? If you train these glasses on private data, the robot might accidentally memorize and leak those secrets. To stop this, we use Differential Privacy (DP), which is like adding a layer of "static noise" to the learning process so the robot learns the pattern but forgets the specifics of any single person's data.

The Problem: The "Broken Ruler" of Privacy

The authors found that the standard way of adding this privacy noise to LoRA is fundamentally flawed. Here is the analogy:

The "Gauge" Problem (The Moving Ruler)
Imagine you are trying to measure the length of a table.

The Standard Way (Naive DP-LoRA): You have a ruler that can stretch and shrink. If you stretch the ruler, the numbers change. If you shrink it, the numbers change again. But the table's actual length hasn't changed.
In LoRA, the "ruler" is the mathematical way we break down the adapter into two parts (let's call them A and B). There are infinite ways to stretch or shrink A and B as long as their product remains the same. This is called "gauge non-identifiability."
The Mistake: The old method added privacy noise directly to parts A and B. Because the ruler was stretching and shrinking, the amount of "static noise" added to the final table (the actual model update) became chaotic. Sometimes the noise was tiny; sometimes it was huge. It was like trying to paint a wall while standing on a trampoline that keeps changing height—the paint splatter (noise) would be unpredictable and could ruin the wall.

The "Bilinear" Problem (The Double Whammy)
When you add noise to A and noise to B separately, they interact. It's like adding a little bit of sugar to a cup of coffee and a little bit of salt to a spoon, then mixing them. The interaction creates a "bilinear" effect—a weird, extra flavor (noise) that wasn't in either ingredient alone. This extra noise gets squared and amplified, making the model much worse at learning.

The Solution: PRISM (The Fixed Canvas)

The authors propose PRISM (Projected Riemannian Invariant Subspace Mechanism).

Instead of trying to measure the table with a stretchy ruler, PRISM changes the perspective. It ignores the stretchy parts (A and B) and focuses entirely on the actual table (the intrinsic update Z).

The Tangent Space (The Flat Canvas): Imagine the table exists on a curved surface. PRISM projects the learning process onto a flat "tangent plane" right next to the table. On this flat plane, the math is simple and stable.
Gauge Invariance (The Fixed Ruler): PRISM adds the privacy noise directly to this flat plane. It doesn't matter how you stretch or shrink the underlying parts (A and B); the noise added to the final result is always the same, predictable amount. It's like painting the wall while standing on solid ground.
No Double Whammy: Because PRISM adds noise to the final result directly (in the tangent space), it avoids the messy interaction between A and B. There is no "bilinear" explosion of noise.

The "Smart Optimizer" (Keeping the Train on the Tracks)

Even with the right noise, the robot's learning algorithm (the optimizer) can get confused. If the robot tries to be "smart" and adjust its learning speed based on the noisy data, it might accidentally amplify the noise even more, causing the model to crash or become unstable.

PRISM includes a special "DP-aware" rule. It puts a "floor" under the learning adjustments. Think of it like a speed bump or a governor on a car engine. If the noise gets too high, the floor prevents the learning speed from going crazy, keeping the training stable and safe.

The Results: Better Privacy, Better Learning

The authors tested PRISM on various tasks (like understanding language and solving math problems) using private data.

The Old Way: When they tried to be private, the model's performance dropped significantly because the noise was too chaotic or too strong.
PRISM: Because the noise was controlled and predictable, the model learned the tasks much better while still keeping the data private. In many tests, PRISM was the top performer, especially on complex reasoning tasks.

Summary

The Issue: The standard way of protecting privacy in LoRA is like trying to measure a moving target with a stretchy ruler. It leads to unpredictable, massive noise that ruins the model.
The Fix: PRISM ignores the stretchy parts and adds noise directly to the stable, core update. It uses a "flat canvas" approach to ensure the noise is always the right size, no matter how the math is arranged.
The Benefit: You get strong privacy protection without sacrificing the model's ability to learn. It's stable, efficient, and works better than previous methods.

In short, PRISM is a new way to teach AI models with private data that stops the "noise" from getting out of hand, ensuring the robot learns the lesson without memorizing the secrets.

Technical Summary: PRISM – Gauge-Invariant Tangent-Space Differentially Private LoRA

1. Problem Formulation

The paper addresses the challenge of applying Differential Privacy (DP) to Low-Rank Adaptation (LoRA), a dominant parameter-efficient fine-tuning (PEFT) method. While standard DP-SGD can be applied directly to the low-rank factors $(A, B)$ of a LoRA update $Z = AB^\top$ , the authors identify that this naive approach is fundamentally misaligned with the geometric structure of LoRA, leading to three critical issues:

Gauge Dependence: LoRA factorization is non-identifiable; for any invertible matrix $R \in GL(r)$ , the pairs $(A, B)$ and $(AR, BR^{-\top})$ represent the same intrinsic update $Z$ . However, applying DP-SGD to the factors $(A, B)$ results in clipping and noise injection that depend on the specific gauge (factorization) chosen. This leads to inconsistent privacy guarantees and perturbation magnitudes for the same underlying model update.
Unbounded Noise Amplification: When noise is injected independently into both factors $A$ and $B$ , the resulting intrinsic noise on $Z$ contains a second-order bilinear term ( $\eta^2 \xi_A \xi_B^\top$ ) and a first-order term whose magnitude scales with the norms of the factors ( $\|A\|_F, \|B\|_F$ ). Under gauge transformations (e.g., rescaling $A \to cA, B \to c^{-1}B$ ), the effective noise energy on $Z$ can grow unbounded, even if the target update $Z$ remains constant.
Instability with Adaptive Optimizers: Adaptive optimizers (e.g., Adam, AdamW) use preconditioners estimated from gradients. In the presence of DP noise, these preconditioners can adapt to the noise statistics rather than the signal. In the low-rank setting, this can lead to ill-conditioned Gram matrices ( $A^\top A, B^\top B$ ), causing numerical instability and further amplifying the injected privacy noise.

2. Methodology: PRISM

The authors propose PRISM (Projected Riemannian Invariant Subspace Mechanism), a DP mechanism designed to operate directly on the intrinsic geometry of the low-rank update manifold rather than the redundant factor space.

Core Components

Tangent Space Projection: Instead of perturbing factors, PRISM treats the update $Z$ as a point on the fixed-rank manifold $\mathcal{M}_r$ . It projects per-example gradients onto the tangent space $T_Z\mathcal{M}_r$ . This projection is defined using orthogonal projectors onto the column spaces of $A$ and $B$ , ensuring the gradient direction is invariant to gauge transformations.
Global Intrinsic Clipping: PRISM computes the Frobenius norm of the projected intrinsic tangent gradient $\|\Delta Z\|_F$ for each example. It aggregates these norms across all LoRA modules to compute a single global clipping coefficient, ensuring a unified sensitivity bound for the entire model update.
Isotropic Tangent Noise: Noise is injected directly into the tangent space as an isotropic Gaussian distribution supported on the manifold. The authors derive a closed-form expression for the effective intrinsic noise energy, showing it depends only on the noise multiplier $\sigma$ , clipping threshold $C$ , batch size $b$ , and layer dimensions $(m, n, r)$ , specifically proportional to $\sqrt{r(m+n-r)}$ . This eliminates the gauge-dependent scaling found in factor-space methods.
Retraction: The noisy tangent update is retracted back to the rank- $r$ manifold using a truncated SVD (best rank- $r$ approximation). This step is shown to be first-order exact, avoiding the spurious second-order bilinear noise terms inherent in naive factor updates.
DP-Aware Adaptive Update: To address Issue III, PRISM introduces a gauge-invariant adaptive update rule. It tracks rank-space moments and applies a "DP-aware floor" to the preconditioner. This floor is scaled according to the known DP noise level, preventing the preconditioner from collapsing when eigenvalues are small due to noise, thereby bounding the amplification of privacy noise.

Theoretical Guarantees

Gauge Invariance: The distribution of the intrinsic update is proven to be invariant under any gauge transformation of the factors.
Privacy: PRISM satisfies standard $(\epsilon, \delta)$ -DP guarantees via subsampled Gaussian mechanism accounting, as the core operation is a Gaussian mechanism on a linear tangent space followed by DP-preserving post-processing.
Noise Characterization: The paper provides a closed-form characterization of the effective noise, demonstrating it is bounded and independent of the factorization scale.

3. Key Contributions

Identification of Fundamental Flaws: The paper rigorously demonstrates that naive factor-space DP-LoRA leads to gauge-dependent clipping, unbounded noise amplification, and spurious bilinear noise terms.
PRISM Mechanism: The proposal of a gauge-invariant DP mechanism that operates on the intrinsic tangent space, utilizing projection, intrinsic clipping, and retraction to ensure stable and bounded perturbations.
Theoretical Analysis: Establishment of $(\epsilon, \delta)$ -DP guarantees and a closed-form characterization of the effective intrinsic noise, proving its independence from factorization gauges.
Stability Enhancement: The introduction of a DP-aware adaptive update rule that mitigates noise amplification in adaptive optimizers under low-rank constraints.

4. Experimental Results

The authors evaluate PRISM on fine-tuning the Gemma-3-4B-pt backbone across two multi-task suites: GLUE8 (Natural Language Understanding) and Math-10K (multi-step numerical reasoning).

Performance under DP: Under privacy budgets of $\epsilon \in \{3, 6\}$ , PRISM achieves the highest average performance across 12 tasks compared to baselines including naive DP-LoRA (FFA), LoRA-RITE, AdamW, LoRA+, and LAMB. Specifically, PRISM attained an average score of 0.690 at $\epsilon=6$ and 0.680 at $\epsilon=3$ , outperforming all other methods.
Robustness: PRISM demonstrated consistent superiority across different backbone sizes (Gemma-2-9B, Gemma-3-12B) and LoRA ranks ( $r \in \{8, 16, 32\}$ ).
Mechanism Diagnostics: Empirical analysis confirmed that factor-space DP exhibits significant gauge sensitivity (variability in update norms based on initialization scaling) and unbounded noise amplification. In contrast, PRISM reduced gauge sensitivity to near zero and maintained low, stable intrinsic noise energy regardless of factor scaling.
Efficiency: While PRISM incurs a runtime overhead (approximately doubling step time due to geometry-aware computations), peak memory usage remains comparable to standard LoRA implementations.

5. Significance and Claims

The paper claims that PRISM resolves the fundamental misalignment between standard DP-SGD and the non-identifiable structure of LoRA. By shifting the privacy mechanism from the redundant factor space to the intrinsic tangent space, PRISM ensures that privacy perturbations are:

Deterministic in Effect: The noise added to the model update $Z$ is independent of the arbitrary choice of factorization $(A, B)$ .
Bounded: It avoids the unbounded noise amplification that can occur in factor-space approaches.
Stable: It prevents adaptive optimizers from destabilizing the training process due to noise-induced ill-conditioning.

The authors position PRISM as a necessary step for deploying privacy-preserving LoRA fine-tuning, particularly in settings involving sensitive data where the stability and predictability of the privacy guarantee are paramount. They acknowledge that the method is currently tailored to fixed-rank LoRA updates and that extending it to other PEFT methods would require deriving their specific intrinsic geometries.