Differentially Private Language Model Training
Training language models with differential privacy, adding calibrated noise during training so the model cannot memorise any single training sequence.
Tier Grades
Tier A: Frontier AI labs
Google pretrained the 1B VaultGemma fully with differential privacy on the Gemma 2 data mixture.
Tier B: Indonesian AI labs
DP pretraining needs much larger batch sizes and compute than non-private training of the same model (Google blog); Indonesian work on it is not in the sources.
Tier C: Institution units such as ITB
Training at 1B scale with DP batch sizes is a stretch for an institution unit; DP fine-tuning costs are not in the sources.
Tier D: Organisations such as SEMAI (PoT, PoC, PoV)
Pretraining with DP is beyond a delivery team; using the released VaultGemma 1B is the delivery path, and its utility matches roughly five-year-old non-private models.
Where this comes from
Anchors
- ComputeVaultGemma 1B: 1 billion parameters, pretrained fully with differential privacy; Google used DP scaling laws to set the compute for a compute-optimal 1B model and found DP training needs a much smaller model with a much larger batch size than non-private training. Total training FLOPs are not in the sources.
- DataSame training mixture as Gemma 2, split into sequences of 1,024 tokens; sequence-level guarantee of epsilon at most 2.0 and delta at most 1.1e-10. Google reports utility comparable to non-private models from roughly five years ago (a GPT-2 class baseline).
- Team size (proxy)Proxy only (author count of an exemplar paper, not a headcount): 21 authors on the VaultGemma paper (arXiv 2510.15001).
- Time horizonYears.
- Shelf-life signalsGap between DP and non-private models of the same size narrowing in later releases, User-level rather than sequence-level DP guarantees appearing in released models
- Pipeline roleTier A trains and releases DP models and scaling laws; Tier C studies privacy guarantees and audits; Tier D uses released DP models where training data must not be memorised.
Where this comes from
Who and What
Links
VaultGemma 1BGoogle, LLMModels 1
Papers
- Deep Learning with Differential PrivacyMartÃn Abadi et al., Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Sec, 2016 founding
- VaultGemma: A Differentially Private Gemma ModelAmer Sinha et al., arXiv preprint, 2025 state of the art
- Large Language Models Can Be Strong Differentially Private LearnersXuechen Li et al., arXiv preprint, 2021 state of the art
- Differentially Private Fine-tuning of Language ModelsDa Yu et al., ICLR 2022 (per arXiv comment), 2021 state of the art
- On Protecting the Data Privacy of Large Language Models (LLMs): A SurveyBiwei Yan et al., arXiv preprint, 2024 survey
Where this comes from
Sources
- arxiv.org/abs/2510.15001 https://arxiv.org/abs/2510.15001
- research.google/blog/vaultgemma-the-worlds-most-capable-diffe... https://research.google/blog/vaultgemma-the-worlds-most-capable-differentially-private-llm/
To cite this page: Project AURION, AI Use-Cases Research & Innovation, "Differentially Private Language Model Training", https://aurion.semai.id/topics/differentially-private-language-model-training/, records of October 2026.