HE-OFT: Privacy-Preserving One-Shot Federated Fine-Tuning under Homomorphic Encryption

2026-10-06

AI Summary

This study addresses the privacy risks of intermediate activation leakage and model ownership exposure in federated fine-tuning by proposing the first one-shot federated fine-tuning protocol without model delivery. Methodologically, it integrates Low-Rank Adaptation (LoRA) with multi-party CKKS homomorphic encryption, wherein clients upload only encrypted head parameter shifts while the server performs aggregation entirely over ciphertexts without decryption, ensuring no participant can access the complete model. Experimental results demonstrate that the proposed protocol achieves an accuracy of 61%–79%, retaining 85%–96% of the base model performance while reducing communication overhead to 13.5 MiB. These findings indicate that the approach attains a superior balance among privacy preservation, communication efficiency, and model utility.

Abstract

Many organizations adapt large pretrained models to their own tasks by fine-tuning on private data. Several of these parties often hold data for the same task and wish to fine-tune a model together without pooling that data. Federated learning (FL) enables joint fine-tuning, but reconstruction attacks on shared intermediate values (the model or its gradients) remain a privacy risk. A one-shot protocol that exchanges one encrypted contribution exposes no intermediate value. Such a protocol still gives the trained model to every participant, which is not permitted where the model is a regulated or proprietary asset. We present HE-OFT, the first cryptographically secure one-shot federated fine-tuning protocol in which no party receives the trained model. Each client fine-tunes a low-rank adapter and a classifier head on a frozen public backbone and keeps the adapter. The client uploads one encrypted head displacement, which the server combines under multiparty CKKS and never decrypts. A quorum of clients returns only the predicted label to the querier. On four text classification tasks and one vision task, HE-OFT reaches 61 to 79 per cent accuracy, against 20 to 48 per cent for a client training alone. HE-OFT keeps 85 to 96 per cent of the accuracy of a disclosed model. A test-time query takes 443.1 to 1713.1 s on one core, or 56.1 to 255.1 s with level restoration on a GPU. Restoring levels at the server cuts the traffic per query from up to 1.6 GiB to 13.5 MiB.

Problem

• Federated Fine-Tuning
• Privacy-Preserving
• Homomorphic Encryption
• One-Shot Protocol
• Model Confidentiality

Innovation

• One-Shot Federated Fine-Tuning
• Homomorphic Encryption
• Multiparty CKKS
• Low-Rank Adapter
• Privacy-Preserving Machine Learning