Is Weight Tying Still Beneficial for Decoder-Only LLMs in Private Settings Under DP-SGD?

Razan El Mais; Ali Chehab; Ibrahim Issa; Razane Tajeddine

cs.LGSep 30, 2026

Is Weight Tying Still Beneficial for Decoder-Only LLMs in Private Settings Under DP-SGD?

Authors: Razan El Mais, Ali Chehab, Ibrahim Issa, Razane Tajeddine

Organizations: Department of Electrical and Computer Engineering American University of Beirut Beirut, Lebanon

Abstract

Differentially Private Stochastic Gradient Descent (DP-SGD) is a leading approach for privacy-preserving fine-tuning of large language models (LLMs). Many decoder-only LLMs employ weight tying between input and output embeddings, a design choice originally introduced for parameter efficiency and improved language modeling performance in the non-private setting. However, the impact of weight tying under differentially private training remains largely unexplored. In this work, we investigate the role of weight tying in the DP setting using GPT2 and DistilGPT2 as representative decoder-only architectures. Interestingly, we find that untied embeddings consistently outperform weight-tied models under DP-SGD, achieving gains of up to 4.74% points in accuracy on SST-2, QNLI, and QQP. Beyond improved utility, untying embeddings enables the use of memory-efficient ghost clipping for DP-SGD. By contrast, weight tying introduces shared-parameter interactions that complicate standard ghost norm computation and largely negate its computational advantages. As a result, untied models achieve over 60% lower memory usage while preserving the benefits of ghost clipping. Our results indicate that untied embeddings provide a more effective and scalable design for differentially private training of decoder-only LLMs and highlight the need to revisit standard LLM architectural choices in the privacy-preserving setting.

Figures & tables

Fig. 1: The core problem of weight tying that breaks ghost clipping’s assumption.

Model	Setting: SGD	Accuracy (%)	GPU Memory (MB)	Trainable Params
DistilGPT2	WT	$86.77\pm 0.76$	$\mathbf{3676.64}$	$\mathbf{81,912,576}$
DistilGPT2	No-WT	$86.77\pm 0.76$	$3824.64$	$120,509,952$
GPT2	WT	$89.09\pm 0.69$	$\mathbf{5390.99}$	$\mathbf{124,439,808}$
GPT2	No-WT	$89.09\pm 0.69$	$5538.99$	$163,037,184$

TABLE I: Effect of Weight Tying under Standard Non-Private Training on SST-2. Weight tying preserves predictive utility while improving parameter efficiency, reducing GPU memory usage, and slightly shortening runtime across both decoder-only models.

Model	Setting: DP-SGD with normal clipping	Accuracy (%)	Peak GPU Memory (MB)
DistilGPT2	WT	$80.61\pm 1.32$	$13813.55$
DistilGPT2	No-WT	$\mathbf{83.23\pm 0.25}$	$14256.41$
GPT2	WT	$78.44\pm 1.73$	$18530.09$
GPT2	No-WT	$\mathbf{81.48\pm 1.07}$	$18973.67$

TABLE II: Effect of Weight Tying under DP-SGD with normal clipping on SST-2. Untying embeddings consistently improves utility and optimization stability under DP across both DistilGPT2 and GPT2.

Model	Clipping Strategy (No WT)	Accuracy (%)	Peak GPU Memory (MB)
DistilGPT2	ghost clipping	$83.23\pm 0.25$	$\mathbf{4747.19}$
DistilGPT2	normal clipping	$83.23\pm 0.25$	$14256.41$
GPT2	ghost clipping	$81.48\pm 1.07$	$\mathbf{6786.90}$
GPT2	normal clipping	$81.48\pm 1.07$	$18973.67$

TABLE III: Comparison between ghost clipping and standard DP-SGD normal clipping under untied embeddings (No-WT) on SST-2. When the additive gradient separability assumption remains valid, ghost clipping preserves identical utility and optimization stability while substantially reducing GPU memory consumption across both DistilGPT2 and GPT2.

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	80.61 $\pm$ 1.32	13813.55	Baseline with moderate memory
No WT + Normal Clipping	83.23 $\pm$ 0.25	14256.41	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	83.23 $\pm$ 0.25	4747.19	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE IV: Comparison of weight tying and clipping strategies under DP-SGD on SST-2 (DistilGPT2). The best utility is achieved with untied weights, while the most efficient configuration in terms of memory is Ghost Clipping with untied weights.

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	78.44 $\pm$ 1.73%	18530.09 MB	Baseline with moderate memory
No WT + Normal Clipping	81.48 $\pm$ 1.07%	18973.67 MB	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	81.48 $\pm$ 1.07%	6786.90 MB	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE V: Comparison of weight tying and clipping strategies under DP-SGD on SST-2 (GPT2). The best utility is achieved with untied weights, while the most efficient configuration in terms of memory is Ghost Clipping with untied weights.

Training Setting	Embedding	DistilGPT2		GPT2
Training Setting	Embedding	Accuracy (%)	Std. Dev.	Accuracy (%)	Std. Dev.
Standard SGD	WT	86.77	0.76	89.09	0.69
Standard SGD	No-WT	86.77	0.76	89.09	0.69
DP-SGD (Normal)	WT	80.61	1.32	78.44	1.73
DP-SGD (Normal)	No-WT	83.23	0.25	81.48	1.07
DP-SGD (Ghost)	No-WT	83.23	0.25	81.48	1.07

TABLE VI: Overall comparison of standard and differentially private training under weight tying (WT) and untied embeddings (No-WT) on SST-2 For DistilGPT2 and GPT2. Best DP utility is shown in bold.

Dataset	Task Type	Split	Size (MB)	#Samples
SST-2	Sentiment Analysis	Train	11.82	67,349 (59,560 bal.)
		Validation	0.15	872
		Test	0.32	1,821
QQP	Paraphrase Detection	Train	63.85	363,846 (268,756 bal.)
		Validation	7.09	40,430
		Test	68.61	390,965

TABLE VII: GLUE Dataset Statistics with Task Types and Balanced Training Sizes

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	72.59 $\pm$ 1.07	15157.99	Baseline with moderate memory
No WT + Normal Clipping	73.57 $\pm$ 0.69	15600.46	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	73.57 $\pm$ 0.69	8068.70	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE VIII: Comparison of weight tying and clipping strategies under DP-SGD on QNLI (DistilGPT2). Untied embeddings improve utility, while Ghost Clipping preserves these gains with substantially lower memory usage.

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	63.95 $\pm$ 0.81	20032.06	Baseline with moderate memory
No WT + Normal Clipping	68.69 $\pm$ 2.18	20474.68	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	68.69 $\pm$ 2.18	11641.93	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE IX: Comparison of weight tying and clipping strategies under DP-SGD on QNLI (GPT2). Untied embeddings improve utility, while Ghost Clipping preserves these gains with substantially lower memory usage.

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	71.88 $\pm$ 1.08	15158.75	Baseline with moderate memory
No WT + Normal Clipping	73.20 $\pm$ 1.05	15601.22	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	73.20 $\pm$ 1.05	8068.05	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE X: Comparison of weight tying and clipping strategies under DP-SGD on QQP (DistilGPT2). Untied embeddings improve utility, while Ghost Clipping preserves these gains with substantially lower memory usage.

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	68.82 $\pm$ 1.19	20032.06 MB	Baseline with moderate memory
No WT + Normal Clipping	69.46 $\pm$ 0.63	20474.68	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	69.46 $\pm$ 0.63	11641.39 MB	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE XI: Comparison of weight tying and clipping strategies under DP-SGD on QQP (GPT2). Untied embeddings improve utility, while Ghost Clipping preserves these gains with substantially lower memory usage..

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	79.38 $\pm$ 0.41	13813.55	Baseline with moderate memory
No WT + Normal Clipping	82.25 $\pm$ 2.81	14256.41	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	82.25 $\pm$ 2.81	4747.19	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE XII: Comparison of weight tying and clipping strategies under DP-SGD on SST-2 (DistilGPT2) with

\epsilon=1

. The best utility is achieved with untied weights, while the most efficient configuration in terms of memory is Ghost Clipping with untied weights.

Configuration	Accuracy (%)	Memory (MB)	Effects
WT + Normal Clipping	80.14 $\pm$ 0.82	13813.55	Baseline with moderate memory
No WT + Normal Clipping	81.13 $\pm$ 0.58	14256.41	Untie weights $\Rightarrow$ $\uparrow$ Higher Utility & $\uparrow$ Higher Memory
No WT + Ghost Clipping	81.13 $\pm$ 0.58	4747.19	Ghost clipping $\Rightarrow$ preserved Utility & $\downarrow\downarrow$ Lower Memory

TABLE XIII: Comparison of weight tying and clipping strategies under DP-SGD on SST-2 (DistilGPT2) with

\epsilon=5

. The best utility is achieved with untied weights, while the most efficient configuration in terms of memory is Ghost Clipping with untied weights.

Explore similar work

Efficient DP-SGD for LLMs with Randomized Clipping
May 24, 2026Enayat Ullah, Sai Aparna Aketi, Devansh Gupta +2Large Language Model Training Gradient Clipping
Meta Platforms Inc. · University of Southern California
DP-SelFT: Differentially Private Selective Fine-Tuning for Large Language Models
May 17, 2026Haichao Sha, Zihao Wang, Yuncheng Wu +2Large Language Model Fine-Tuning Continual Fine-Tuning
Renmin University of China · Nanyang Technological University
DP-LAC: Lightweight Adaptive Clipping for Differentially Private Federated Fine-tuning of Language Models
May 11, 2026Haaris Mehmood, Jie Xu, Karthikeyan Saravanan +2Federated Learning Gradient Clipping
Samsung R&D Institute UK (SRUK) · Samsung AI Centre Cambridge

May 24, 2026, cs.LGJ/K move · Enter open · S save

Efficient DP-SGD for LLMs with Randomized Clipping

Enayat Ullah, Sai Aparna Aketi, Devansh Gupta, Huanyu Zhang+1

Meta Platforms Inc. · University of Southern California

Large Language Model Training Gradient Clipping Stochastic Gradient Descent

Open paper AskPDF arXiv

Large language models (LLMs) are trained on vast datasets that may contain sensitive information. Differential privacy (DP), the de facto standard for formal privacy guarantees, provides a principled framework for training LLMs with provable privacy protection. However, state-of-the-art DP training implementations rely on fast gradient clipping techniques with memory overhead

O(B \min\{T^2, d^2\})

, where

B

is the batch size,

T

is the sequence length, and

d

is the model width. This becomes prohibitive as both model size and context length grow. We propose DP-SGD-RC, a novel variant of DP-SGD with randomized clipping that reduces memory and compute complexity. DP-SGD-RC leverages stochastic trace estimation methods, specifically Hutchinson's estimator[Hutchinson, 1989] and its improved variant, Hutch++[Meyer et al., 2021], to reduce the memory footprint of per-sample gradient norm estimation. We provide a tight privacy analysis showing that DP-SGD-RC achieves noise multipliers competitive with deterministic clipping. Experiments fine-tuning Llama~3.2-1B on long-context benchmarks spanning classification, question answering, and summarization tasks demonstrate that DP-SGD-RC matches baseline utility while significantly reducing memory and compute requirements.

Abstract

Explore similar work

Efficient DP-SGD for LLMs with Randomized Clipping

DP-SelFT: Differentially Private Selective Fine-Tuning for Large Language Models

DP-LAC: Lightweight Adaptive Clipping for Differentially Private Federated Fine-tuning of Language Models