When Privacy Hurts Mergeability: Geometry-Aware Model Merging under Differential Privacy

# When Privacy Hurts Mergeability: Geometry-Aware Model Merging under Differential Privacy
Source: [https://arxiv.org/html/2608.26655](https://arxiv.org/html/2608.26655)
###### Abstract

Model merging promises to construct a single multi\-task model from independently fine\-tuned task models without accessing the original task data\. This makes it attractive when task data cannot be centralized, but released task models may still leak private fine\-tuning data\. Differential privacy \(DP\) provides a principled mechanism for limiting such leakage, yet its effect on model merging remains poorly understood\. In this paper, we study the geometry of differentially private model merging and identify two geometric obstacles that make private task models difficult to merge:*local sharpness*, which makes task losses sensitive to the parameter displacement induced by merging, and*reference drift*, which measures the displacement of private task models from the shared pretrained initialization and amplifies cross\-task interference\. Based on these observations, we proposeDP\-Merging, a geometry\-aware framework that improves the mergeability of differentially private task models\. DP\-Merging uses a DP\-compatible sharpness\-aware objective to guide each private task model toward flatter loss regions, and a reference\-based alignment regularizer to keep task models close to the shared pretrained initialization\. We derive a merge\-gap upper bound showing that reducing local curvature and reference drift tightens the bound on the loss increase induced by merging\. Experiments on vision and language tasks across multiple privacy budgets show that DP\-Merging consistently improves private merged\-model performance while preserving the privacy guarantees of the underlying DP fine\-tuning procedures\.

## 1Introduction

Fine\-tuning pretrained models has become the standard way to adapt foundation models to diverse downstream tasks[Liu et al\. \(2026\)](https://arxiv.org/html/2608.26655#bib.bib1);[Wang et al\. \(2026\)](https://arxiv.org/html/2608.26655#bib.bib2)\. As task\-specific models accumulate, storing and deploying them independently becomes increasingly costly\. Multi\-task learning can integrate these capabilities into a model, but requires joint access to data from all tasks and expensive retraining[Fifty et al\. \(2021\)](https://arxiv.org/html/2608.26655#bib.bib4);[Agiza et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib5)\. Model merging has recently emerged as a practical alternative[Yang et al\. \(2026\)](https://arxiv.org/html/2608.26655#bib.bib3): it directly combines independently fine\-tuned models in parameter space to obtain a unified model, without accessing the original task data\. This makes model merging particularly attractive when task data are decentralized or cannot be shared\.

Despite its potential, data\-free merging is not inherently privacy\-preserving\. Although raw data are not shared during merging, the released task\-specific weights and task vectors are derived from private data, posing a risk of sensitive information leakage[Zhang et al\. \(2024a\)](https://arxiv.org/html/2608.26655#bib.bib6);[Wang et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib7);[Yuan et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib8)\. Differential privacy \(DP\)[Dwork et al\. \(2006\)](https://arxiv.org/html/2608.26655#bib.bib9)provides a rigorous framework for limiting such leakage by bounding the influence of any single training example on the released models\. A natural solution is therefore to fine\-tune each task model under DP and then merge the resulting private models\. However, as we show empirically, this straightforward solution can suffer from a degradation that goes beyond the utility loss of individual private models: DP can specifically damage the geometric compatibility required for parameter\-space merging\. This raises a central question:what makes differentially private models difficult to merge, and how can we improve their mergeability under privacy constraints?

![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/non.png)\(a\)Non\-private mergeing
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/dp.png)\(b\)Naive DP merging
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/ours.png)\(c\)DP\-Merging \(Ours\)

Figure 1:Geometric illustration of model merging under DP\. Task vectors are fine\-tuned fromw0w\_\{0\}and merged in parameter space\. \(a\) Without DP, flat and compatible solutions merge effectively\. \(b\) Naive DP can yield sharper solutions with weaker reference alignment, leading to high\-loss merging\. \(c\) DP\-Merging improves flatness and reference alignment, yielding lower\-loss merging under DP\.We argue that the difficulty is not merely that DP lowers the accuracy of the models being merged\. Rather, parameter\-space merging relies on geometric compatibility among task\-specific solutions, which can be disrupted by DP fine\-tuning\. Prior work suggests that merging often benefits when independently fine\-tuned models remain geometrically compatible[Ainsworth et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib10)\. In particular, interpolation or averaging tends to incur smaller loss increase when the path between models stays in relatively flat, low\-loss regions[Peña et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib11);[Ito et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib12)\. In the private setting, these geometric conditions become more fragile\. The clipping and noise used by DP may leave each task solution in a sharper local basin, making its loss more sensitive to the parameter displacement induced by merging\. Meanwhile, independent private fine\-tuning can move task models farther from the shared pretrained initialization, increasing their mutual mismatch and amplifying cross\-task interference\. We refer to these two obstacles as*local sharpness*and*reference drift*\. These effects make private task models more sensitive to merge\-induced displacement and less compatible in parameter space, leading to high\-loss merged solutions, as illustrated in Figure[1](https://arxiv.org/html/2608.26655#S1.F1)\.

Motivated by this geometric view, we proposeDP\-Merging, a simple geometry\-aware framework for differentially private model merging\. Rather than designing a new post\-hoc merging operator, DP\-Merging applies two minimal interventions during private fine\-tuning to restore the geometric conditions required by merging\. First, a DP\-compatible sharpness\-aware objective encourages each private task model to lie in a flatter local region, reducing its sensitivity to merge\-induced displacement\. Second, a reference\-anchored alignment regularizer keeps task vectors close to the shared pretrained initialization, limiting reference drift and reducing cross\-task interference\. Since the final merging step only processes DP\-released task models, it remains a post\-processing operation and incurs no additional privacy loss\. We provide a theoretical merge\-gap analysis showing that reducing local curvature and reference drift improves mergeability, and empirically validate DP\-Merging across vision and language tasks under multiple privacy budgets\.

In summary, we make the following contributions:

- •We identify a geometric failure mode of differentially private model merging, termed*DP\-induced mergeability degradation*\. We show that DP fine\-tuning can make task\-specific models harder to merge by increasing local sharpness and reference drift, which amplify parameter interference after merging\.
- •We proposeDP\-Merging, a simple geometry\-aware private fine\-tuning framework\. DP\-Merging combines a DP\-compatible sharpness\-aware objective with a reference\-based alignment regularizer to produce private task models that are flatter and more geometrically aligned for parameter\-space merging\.
- •We provide theoretical and empirical evidence\. Our merge\-gap bound shows that the loss increase after merging is controlled by local curvature and merge\-induced parameter displacement, and experiments on vision and language tasks across multiple privacy budgets demonstrate consistent improvements over standard DP fine\-tuning followed by merging\.

## 2Related Work

#### Non\-private model merging\.

Existing work on model merging mainly studies the non\-private setting\. Representative approaches include direct weight\-space averaging, such as Weight Averaging[Wortsman et al\. \(2022\)](https://arxiv.org/html/2608.26655#bib.bib34), task\-vector composition such as Task Arithmetic[Ilharco et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib36), and more structured rules based on parameter importance or interference resolution, such as Fisher\-weighted merging[Matena and Raffel \(2022\)](https://arxiv.org/html/2608.26655#bib.bib37), RegMean[Jin et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib35), TIES\-Merging[Yadav et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib38), PCB Merging[DU et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib39), and WUDI\-Merging[Cheng et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib40)\. These methods typically assume direct access to task\-specific weights, parameter deltas, or importance statistics\. In contrast, we study a privacy\-constrained setting where task\-specific models must be obtained under differential privacy before they can be released and merged\.

#### Differentially private fine\-tuning\.

DP fine\-tuning of pretrained models has become increasingly practical, with most methods relying on per\-example gradient clipping and Gaussian noise injection to improve the privacy–utility trade\-off for a single released model[Yu et al\. \(2022\)](https://arxiv.org/html/2608.26655#bib.bib13);[Park et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib14);[Bu et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib15);[Li et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib16)\. Other work also explores alternative private fine\-tuning paradigms[Bu et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib15), such as forward\-pass perturbation[Du et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib17)or zeroth\-order optimization[Zhang et al\. \(2024b\)](https://arxiv.org/html/2608.26655#bib.bib18)\. However, these methods are designed mainly to preserve the utility of individual private models\. They do not address whether multiple privately fine\-tuned task models remain geometrically compatible for post\-hoc merging, which is the focus of our work\.

#### Geometry of mergeability and sharpness\.

Prior work indicates that the success of model merging can be influenced not only by the merging method but also by geometric properties of the models, such as alignment in parameter space, low\-loss connectivity, and landscape structure\. Averaging or interpolation is more reliable when fine\-tuned models lie in compatible low\-loss regions or admit low\-loss connectivity[Garipov et al\. \(2018\)](https://arxiv.org/html/2608.26655#bib.bib19);[Draxler et al\. \(2018\)](https://arxiv.org/html/2608.26655#bib.bib20);[Wortsman et al\. \(2022\)](https://arxiv.org/html/2608.26655#bib.bib34), while direct merging can fail when parameters are misaligned, for example due to permutation symmetries[Ainsworth et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib10);[Ito et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib12);[Zhang et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib21)\. Sharpness\-aware optimization methods, such as Sharpness Aware Minimization \(SAM[Foret et al\. \(2021\)](https://arxiv.org/html/2608.26655#bib.bib42)\) seeks flatter solutions by optimizing losses under local parameter perturbations, and is closely related to interpolation stability and low\-loss connectivity[Lee et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib41)\. These studies clarify important geometric conditions for merging in non\-private settings, but do not examine how privatization perturbs those conditions before composition\.

## 3Preliminaries

![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/bar_eur.png)\(a\)EuroSAT
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/bar_sun.png)\(b\)SUN397
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/bar_sst2.png)\(c\)SST\-2
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/bar_qnli.png)\(d\)QNLI

Figure 2:Interpolation loss landscapes fromwtw\_\{t\}towmergew\_\{\\mathrm\{merge\}\}\. We evaluate test loss alongw⁡\(γ\)=\(1−γ\)​wt\+γ​wmergew\(\\gamma\)=\(1\-\\gamma\)w\_\{t\}\+\\gamma w\_\{\\mathrm\{merge\}\}\. DP\-Merging consistently reduces the sharp loss barriers induced by standard DP, yielding smoother paths across vision and language tasks\.### 3\.1Problem Setup

Private Task\-specific Fine\-tuning\.Letw0∈ℝdw\_\{0\}\\in\\mathbb\{R\}^\{d\}denote a public pretrained foundation model\. We considerTTdownstream tasks, where each taskt∈\[T\]t\\in\[T\]is associated with a private dataset𝒟t\\mathcal\{D\}\_\{t\}\. Starting from the same initializationw0w\_\{0\}, each task independently applies a randomized fine\-tuning algorithm𝒜t\\mathcal\{A\}\_\{t\}to obtain a task\-specific modelwt=𝒜t​\(w0,𝒟t\)\.w\_\{t\}=\\mathcal\{A\}\_\{t\}\(w\_\{0\},\\mathcal\{D\}\_\{t\}\)\.For tasktt, we define the empirical loss asℒt​\(w\):=1\|𝒟t\|​∑\(x,y\)∈𝒟tℓ⁡\(w,x,y\),\\mathcal\{L\}\_\{t\}\(w\):=\\frac\{1\}\{\|\\mathcal\{D\}\_\{t\}\|\}\\sum\_\{\(x,y\)\\in\\mathcal\{D\}\_\{t\}\}\\ell\(w;x,y\),which serves as a proxy for the task risk\.

Differential privacy\.Each task\-specific fine\-tuning algorithm𝒜t\\mathcal\{A\}\_\{t\}is\(ε,δ\)\(\\varepsilon,\\delta\)\-differentially private with respect to its local dataset𝒟t\\mathcal\{D\}\_\{t\}\. Specifically, for each tasktt, for any neighboring datasets𝒟t\\mathcal\{D\}\_\{t\}and𝒟t′\\mathcal\{D\}^\{\\prime\}\_\{t\}differing in one example, and any measurable output set𝒮\\mathcal\{S\},

Pr\[𝒜t\(w0,𝒟t\)∈𝒮\]≤eεPr\[𝒜t\(w0,𝒟t′\)∈𝒮\]\+δ\.\\Pr\[\\mathcal\{A\}\_\{t\}\(w\_\{0\},\\mathcal\{D\}\_\{t\}\)\\in\\mathcal\{S\}\]\\leq e^\{\\varepsilon\}\\Pr\[\\mathcal\{A\}\_\{t\}\(w\_\{0\},\\mathcal\{D\}^\{\\prime\}\_\{t\}\)\\in\\mathcal\{S\}\]\+\\delta\.\(1\)Since each private example contributes to only one task, releasing\{wt\}t=1T\\\{w\_\{t\}\\\}\_\{t=1\}^\{T\}preserves\(ε,δ\)\(\\varepsilon,\\delta\)\-DP by parallel composition\. Subsequent merging is a post\-processing step over the released models and public information, and thus incurs no additional privacy loss\.

Post\-hoc Model Merging\.Given the released task\-specific models\{wt\}t=1T\\\{w\_\{t\}\\\}\_\{t=1\}^\{T\}, a post\-hoc merging rule constructs a unified modelwmerge=ℳ⁡\(w1,…,wT\)\.w\_\{\\mathrm\{merge\}\}=\\mathcal\{M\}\(w\_\{1\},\\dots,w\_\{T\}\)\.Equivalently, with task vectorsΔt:=wt−w0\\Delta\_\{t\}:=w\_\{t\}\-w\_\{0\}, we writewmerge=w0\+ℳΔ​\(Δ1,…,ΔT\),w\_\{\\mathrm\{merge\}\}=w\_\{0\}\+\\mathcal\{M\}\_\{\\Delta\}\(\\Delta\_\{1\},\\dots,\\Delta\_\{T\}\),ℳΔ\\mathcal\{M\}\_\{\\Delta\}is the merging rule in task\-vector space\. Our goal is a data\-free, privacy\-preserving merged model with low average task loss1T​∑t=1Tℒt​\(wmerge\)\.\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\.

### 3\.2Geometric Challenges of Private Mergeability

We use the merge gap as a diagnostic measure of private mergeability\. For tasktt, the task\-wise merge gap is defined asGapt​\(wmerge\):=ℒt​\(wmerge\)−ℒt​\(wt\)\.\\mathrm\{Gap\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\):=\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\-\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\.A smallerGapt\\mathrm\{Gap\}\_\{t\}indicates better mergeability, whileℒt\\mathcal\{L\}\_\{t\}is used solely as an evaluation diagnostic and is not available to the post\-hoc merging rule\. Consider a second\-order expansion ofℒt\\mathcal\{L\}\_\{t\}around the task\-specific modelwtw\_\{t\}:

ℒt\(wmerge\)=ℒt\(wt\)\+∇ℒt\(wt\)⊤\(wmerge−wt\)\+12\(wmerge−wt\)⊤Ht\(wmerge−wt\)\+Rt,\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)=\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\+\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)^\{\\top\}\(w\_\{\\mathrm\{merge\}\}\-w\_\{t\}\)\+\\frac\{1\}\{2\}\(w\_\{\\mathrm\{merge\}\}\-w\_\{t\}\)^\{\\top\}H\_\{t\}\(w\_\{\\mathrm\{merge\}\}\-w\_\{t\}\)\+R\_\{t\},\(2\)whereHt=∇2ℒt​\(wt\)H\_\{t\}=\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)andRtR\_\{t\}collects higher\-order terms\. This expansion suggests that the merge gap increases with both the local curvature aroundwtw\_\{t\}and the displacement fromwtw\_\{t\}towmergew\_\{\\mathrm\{merge\}\}:

Gapt​\(wmerge\)≈12​λmax​\(Ht\)⏟local curvature​‖wmerge−wt‖22⏟merging displacement\.\\mathrm\{Gap\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\\approx\\frac\{1\}\{2\}\\underbrace\{\\lambda\_\{\\max\}\(H\_\{t\}\)\}\_\{\\text\{local curvature\}\}\\underbrace\{\\\|w\_\{\\mathrm\{merge\}\}\-w\_\{t\}\\\|\_\{2\}^\{2\}\}\_\{\\text\{merging displacement\}\}\.\(3\)To visualize the loss barrier induced by merging, we evaluate the loss along the interpolation pathw⁡\(γ\)=\(1−γ\)​wt\+γ​wmergew\(\\gamma\)=\(1\-\\gamma\)w\_\{t\}\+\\gamma w\_\{\\mathrm\{merge\}\}\. Figure[2](https://arxiv.org/html/2608.26655#S3.F2)shows that Naive DP produces sharper and higher loss barriers, whereas DP\-Merging yields smoother interpolation paths\.

#### Challenge 1: local sharpness\.

DP fine\-tuning perturbs the optimization trajectory through gradient clipping and Gaussian noise\. Under tight privacy budgets, the released task model may become more sensitive to parameter perturbations\. This is harmful for merging because the merged model induces a displacement away from the task\-specific solution\. We measure this effect using a perturbation\-based sharpness proxy:Sharpt​\(wt,ρ\)=ℒt​\(wt\+ρ​∇ℒt​\(wt\)‖∇ℒt​\(wt\)‖2\)−ℒt​\(wt\)\\mathrm\{Sharp\}\_\{t\}\(w\_\{t\};\\rho\)=\\mathcal\{L\}\_\{t\}\\left\(w\_\{t\}\+\\rho\\frac\{\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\}\{\\\|\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\}\\right\)\-\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\. Figure[3\(a\)](https://arxiv.org/html/2608.26655#S3.F3.sf1)shows that, averaged over the eight vision tasks, Naive DP exhibits larger local sharpness around task\-specific models under tighter privacy budgets, while DP\-Merging consistently reduces this sensitivity\.

![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/challenge_1.png)\(a\)Average Sharpness
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/challenge_2.png)\(b\)Reference Drift

Figure 3:Empirical validation on the eight vision tasks using CLIP ViT\-B/32\.
#### Challenge 2: reference drift\.

The displacement term in Eq\. \([3](https://arxiv.org/html/2608.26655#S3.E3)\) is affected by how far private task models move away from the shared pretrained initialization\. Consider weight averaging, wherewmerge=w0\+Δ¯w\_\{\\mathrm\{merge\}\}=w\_\{0\}\+\\bar\{\\Delta\}andΔ¯=1T​∑j=1TΔj\\bar\{\\Delta\}=\\frac\{1\}\{T\}\\sum\_\{j=1\}^\{T\}\\Delta\_\{j\}\. Thenwmerge−wt=Δ¯−Δt\.w\_\{\\mathrm\{merge\}\}\-w\_\{t\}=\\bar\{\\Delta\}\-\\Delta\_\{t\}\.Thus, merging displacement grows when task updates are large or poorly aligned\. Indeed,‖Δ¯−Δt‖2≤1T​∑j=1T‖Δj‖2\+‖Δt‖2,\\\|\\bar\{\\Delta\}\-\\Delta\_\{t\}\\\|\_\{2\}\\leq\\frac\{1\}\{T\}\\sum\_\{j=1\}^\{T\}\\\|\\Delta\_\{j\}\\\|\_\{2\}\+\\\|\\Delta\_\{t\}\\\|\_\{2\},showing that large drift fromw0w\_\{0\}can enlarge merge\-induced displacement\. We quantify reference drift asDrift=1T​∑t=1T‖wt−w0‖2‖w0‖2\.\\mathrm\{Drift\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\frac\{\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}\}\{\\\|w\_\{0\}\\\|\_\{2\}\}\.As shown in Figure[3\(b\)](https://arxiv.org/html/2608.26655#S3.F3.sf2), Naive DP exhibits larger reference drift under stronger privacy constraints, whereas DP\-Merging limits this drift\.

## 4DP\-Merging

The analysis in Sec\.[3\.2](https://arxiv.org/html/2608.26655#S3.SS2)identifies two obstacles to private mergeability: \(1\) local sharpness of private task\-specific solutions, and \(2\) reference drift from the shared pretrained initialization\. Based on this insight, we proposeDP\-Merging, a geometry\-aware framework for differentially private model merging\. The central idea is to train private task models that are inherently robust to the parameter perturbations induced by merging\. DP\-Merging consists of two complementary components: \(1\)*DP\-compatible sharpness\-aware fine\-tuning*, which constructs sharpness\-aware updates using clipped noisy gradients, and \(2\)*reference\-anchored alignment*, which limits the displacement between task models through reference anchoring to the pretrained initializationw0w\_\{0\}\. Intuitively, flatness controls how harmful a displacement is, while anchoring controls how large the displacement becomes\.

### 4\.1DP\-Compatible Sharpness\-Aware Fine\-Tuning

We first address the curvature term in Eq\. \([3](https://arxiv.org/html/2608.26655#S3.E3)\)\. When a task model lies in a sharp local region, even a moderate parameter displacement can produce a large increase in task loss after merging\. To mitigate this effect, DP\-Merging follows a sharpness\-aware principle[Foret et al\. \(2021\)](https://arxiv.org/html/2608.26655#bib.bib42): instead of optimizing the loss only at the current model, it optimizes the loss in a nearby adversarial neighborhood\. As a result, the learned solution becomes locally stable against merge\-induced perturbations\.

We use flatness not merely to improve the standalone task model, but to make the released model robust to the parameter shift it will undergo during merging\. For a modelwwand minibatchBB, define the clipped Gaussian gradient estimator

g~​\(w,B\)=1\|B\|​\(∑zi∈Bgimax⁡\{1,‖gi‖2/C\}\+𝒩⁡\(0,σ2​C2​I\)\),gi=∇ℓ​\(w,zi\)\\tilde\{g\}\(w;B\)=\\frac\{1\}\{\|B\|\}\\left\(\\sum\_\{z\_\{i\}\\in B\}\\frac\{g\_\{i\}\}\{\\max\\\{1,\\\|g\_\{i\}\\\|\_\{2\}/C\\\}\}\+\\mathcal\{N\}\(0,\\sigma^\{2\}C^\{2\}I\)\\right\),\\quad g\_\{i\}=\\nabla\\ell\(w;z\_\{i\}\)\(4\)whereCCis the clipping threshold andσ\\sigmais the noise multiplier\. At iterationkkfor tasktt, we first compute the private gradientg~t,k=g~​\(wt,k,Bt,k\)\\tilde\{g\}\_\{t,k\}=\\tilde\{g\}\(w\_\{t,k\};B\_\{t,k\}\)and use it to construct a local ascent perturbation

ϵt,k=ρt​g~t,k‖g~t,k‖2,\\epsilon\_\{t,k\}=\\rho\_\{t\}\\frac\{\\tilde\{g\}\_\{t,k\}\}\{\\\|\\tilde\{g\}\_\{t,k\}\\\|\_\{2\}\},\(5\)whereρt\\rho\_\{t\}controls the neighborhood size\. We then evaluate a private gradient at the perturbed point:

h~t,k=g~​\(wt,k\+ϵt,k,Bt,k\)\.\\tilde\{h\}\_\{t,k\}=\\tilde\{g\}\(w\_\{t,k\}\+\\epsilon\_\{t,k\};B\_\{t,k\}\)\.\(6\)
The first gradientg~t,k\\tilde\{g\}\_\{t,k\}identifies a nearby high\-loss direction, while the second gradienth~t,k\\tilde\{h\}\_\{t,k\}updates the model against the loss at that perturbed location\. Consequently, the optimization no longer favors solutions that are only locally optimal at a single point, but instead prefers solutions whose loss remains stable within a neighborhood\. Both gradient evaluations are privatized using clipped Gaussian mechanisms and are accounted for in the privacy analysis\.

### 4\.2Reference\-Anchored Alignment

Flatness reduces local sensitivity, but it does not ensure that independently trained task models stay close to one another\. We therefore add a simple anchor to the shared initialization\. At iterationkk, DP\-Merging updates taskttby

wt,k\+1=wt,k−η⁡\(h~t,k\+2​λ​\(wt,k−w0\)\),w\_\{t,k\+1\}=w\_\{t,k\}\-\\eta\\left\(\\tilde\{h\}\_\{t,k\}\+2\\lambda\(w\_\{t,k\}\-w\_\{0\}\)\\right\),\(7\)whereλ\\lambdacontrols the alignment strength\. The second term is the gradient ofλ​‖wt,k−w0‖22\\lambda\\\|w\_\{t,k\}\-w\_\{0\}\\\|\_\{2\}^\{2\}\. Since it depends only on model parameters and the public initialization, it incurs no additional privacy cost\.

This anchor is useful because it controls the displacement term in Eq\. \([3](https://arxiv.org/html/2608.26655#S3.E3)\)\. For uniform averaging, letwmerge=1T​∑s=1Twsw\_\{\\mathrm\{merge\}\}=\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}w\_\{s\}\. Then

‖wmerge−wt‖2=‖1T​∑s=1T\(ws−wt\)‖2≤1T​∑s=1T‖ws−wt‖2≤1T​∑s=1T\(‖ws−w0‖2\+‖wt−w0‖2\)\\begin\{aligned\} \\\|w\_\{\\mathrm\{merge\}\}\-w\_\{t\}\\\|\_\{2\}&=\\left\\\|\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}\(w\_\{s\}\-w\_\{t\}\)\\right\\\|\_\{2\}\\leq\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}\\\|w\_\{s\}\-w\_\{t\}\\\|\_\{2\}\\\\ &\\leq\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}\\left\(\\\|w\_\{s\}\-w\_\{0\}\\\|\_\{2\}\+\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}\\right\)\\end\{aligned\}

\(8\)Thus, keeping each task model close tow0w\_\{0\}reduces an upper bound on the distance between the merged model and each task\-specific solution\. This alignment is induced only through the common reference point and does not require communication between tasks during fine\-tuning\.

After private fine\-tuning, we obtain released task models\{wtDP\}t=1T\\\{w\_\{t\}^\{\\mathrm\{DP\}\}\\\}\_\{t=1\}^\{T\}\. For clarity, we use weight averaging as the default merging rule:wmerge=1T​∑t=1TwtDP\.w\_\{\\mathrm\{merge\}\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}w\_\{t\}^\{\\mathrm\{DP\}\}\.The same released models can also be used with other post\-hoc merging rules\. Since the final merging step only processes DP outputs, it is post\-processing and preserves the privacy guarantees of task\-specific fine\-tuning\.

Algorithm 1DP\-Merging

## 5Theoretical Analysis

### 5\.1Privacy guarantee of DP\-Merging

We analyze the privacy guarantee of DP\-Merging in Appendix[C\.1](https://arxiv.org/html/2608.26655#A3.SS1)\. Each iteration uses two privatized clipped\-gradient evaluations, while the sharpness perturbation, reference anchor, and final merging step are post\-processing operations\. Therefore, they incur no additional privacy loss beyond the underlying private gradient evaluations\.

###### Theorem 5\.1\(Privacy guarantee of DP\-Merging\)\.

Assume that each task dataset𝒟t\\mathcal\{D\}\_\{t\}is disjoint, and each private example belongs to at most one task\. For tasktt, suppose Algorithm[1](https://arxiv.org/html/2608.26655#alg1)runs forKKiterations with Poisson sampling rateqq, clipping thresholdCC, and Gaussian noise multiplierσ\\sigma\. Letεpair​\(α,q,σ\)\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)denote the order\-α\\alphaRDP[Mironov \(2017\)](https://arxiv.org/html/2608.26655#bib.bib45)cost of one Poisson\-subsampled paired Gaussian mechanism that releases the two noisy clipped\-gradient quantities used in one DP\-Merging iteration\. Then, for any Rényi orderα\>1\\alpha\>1, the released task modelwtDPw\_\{t\}^\{\\mathrm\{DP\}\}satisfies\(α,K​εpair​\(α,q,σ\)\)​\-RDP\.\(\\alpha,\\,K\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)\)\\text\{\-RDP\}\.Consequently, for anyδt∈\(0,1\)\\delta\_\{t\}\\in\(0,1\),wtDPw\_\{t\}^\{\\mathrm\{DP\}\}satisfies\(εt,δt\)\(\\varepsilon\_\{t\},\\delta\_\{t\}\)\-DP with

εt=minα\>1⁡\{K​εpair​\(α,q,σ\)\+log⁡\(1/δt\)α−1\}\.\\small\\varepsilon\_\{t\}=\\min\_\{\\alpha\>1\}\\left\\\{K\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)\+\\frac\{\\log\(1/\\delta\_\{t\}\)\}\{\\alpha\-1\}\\right\\\}\.\(9\)Since the task datasets are disjoint, releasing all private task models\{wtDP\}t=1T\\\{w\_\{t\}^\{\\mathrm\{DP\}\}\\\}\_\{t=1\}^\{T\}satisfies\(maxt∈\[T\]⁡εt,maxt∈\[T\]⁡δt\)​\-DP\.\\left\(\\max\_\{t\\in\[T\]\}\\varepsilon\_\{t\},\\,\\max\_\{t\\in\[T\]\}\\delta\_\{t\}\\right\)\\text\{\-DP\}\.The merged modelwmerge=1T​∑t=1TwtDPw\_\{\\mathrm\{merge\}\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}w\_\{t\}^\{\\mathrm\{DP\}\}incurs no additional privacy loss by post\-processing\.

### 5\.2Mergeability Analysis

We provide a theoretical analysis explaining why DP\-Merging improves the mergeability of differentially private task models\. Letwt:=wtDPw\_\{t\}:=w\_\{t\}^\{\\mathrm\{DP\}\}be the private task model returned by Algorithm[1](https://arxiv.org/html/2608.26655#alg1), and define the task vectorut:=wt−w0u\_\{t\}:=w\_\{t\}\-w\_\{0\}\. For weight averaging,u¯:=1T​∑s=1Tus,wmerge:=w0\+u¯,Δt:=wmerge−wt=u¯−ut\.\\bar\{u\}:=\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}u\_\{s\},w\_\{\\mathrm\{merge\}\}:=w\_\{0\}\+\\bar\{u\},\\Delta\_\{t\}:=w\_\{\\mathrm\{merge\}\}\-w\_\{t\}=\\bar\{u\}\-u\_\{t\}\.We measure mergeability by the average merge gap

Gmerge:=1T​∑t=1T\(ℒt​\(wmerge\)−ℒt​\(wt\)\)\.\\small G\_\{\\mathrm\{merge\}\}:=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\bigl\(\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\-\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\bigr\)\.\(10\)
###### Theorem 5\.2\(Mergeability bound for DP\-Merging\)\.

Assume that, for each tasktt,ℒt\\mathcal\{L\}\_\{t\}is three\-times differentiable along the segment\{wt\+γ​Δt:γ∈\[0,1\]\}\\\{w\_\{t\}\+\\gamma\\Delta\_\{t\}:\\gamma\\in\[0,1\]\\\}\. Letβt:=supγ∈\[0,1\]λmax​\(∇2ℒt​\(wt\+γ​Δt\)\),\\beta\_\{t\}:=\\sup\_\{\\gamma\\in\[0,1\]\}\\lambda\_\{\\max\}\\\!\\left\(\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\+\\gamma\\Delta\_\{t\}\)\\right\),and assume that the third\-order Taylor remainder is bounded by\|Rt\|≤Mt6​‖Δt‖23\.\|R\_\{t\}\|\\leq\\frac\{M\_\{t\}\}\{6\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{3\}\.If the returned private task model satisfies‖∇ℒt​\(wt\)‖2≤εt,\\\|\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\\leq\\varepsilon\_\{t\},then

Gmerge≤1T​∑t=1T\[εt​‖Δt‖2\+βt2​‖Δt‖22\+Mt6​‖Δt‖23\]\.\\small G\_\{\\mathrm\{merge\}\}\\leq\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\left\[\\varepsilon\_\{t\}\\\|\\Delta\_\{t\}\\\|\_\{2\}\+\\frac\{\\beta\_\{t\}\}\{2\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{2\}\+\\frac\{M\_\{t\}\}\{6\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{3\}\\right\]\.\(11\)

Theorem[5\.2](https://arxiv.org/html/2608.26655#S5.Thmtheorem2)shows that the merge gap decreases when either the local curvatureβt\\beta\_\{t\}is small or the merging displacement‖Δt‖2\\\|\\Delta\_\{t\}\\\|\_\{2\}is small\. This directly matches the two design choices of DP\-Merging\. The DP\-compatible sharpness\-aware update reduces sensitivity to local perturbations, thereby targeting the curvature term\. The reference\-anchored regularizer controls the task\-vector norm‖wt−w0‖2\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}, which in turn controls‖Δt‖2\\\|\\Delta\_\{t\}\\\|\_\{2\}\.

To make the role of the anchor explicit, define the robust lossLt,ρt​\(w\):=max‖ϵ‖2≤ρt⁡ℒt​\(w\+ϵ\),L\_\{t,\\rho\_\{t\}\}\(w\):=\\max\_\{\\\|\\epsilon\\\|\_\{2\}\\leq\\rho\_\{t\}\}\\mathcal\{L\}\_\{t\}\(w\+\\epsilon\),and the regularized robust objective approximately optimized by DP\-Merging:Φt​\(w\):=Lt,ρt​\(w\)\+λ​‖w−w0‖22\.\\Phi\_\{t\}\(w\):=L\_\{t,\\rho\_\{t\}\}\(w\)\+\\lambda\\\|w\-w\_\{0\}\\\|\_\{2\}^\{2\}\.Suppose the returned model satisfies‖∇Lt,ρt​\(wt\)‖2≤Gt,‖∇Φt​\(wt\)‖2≤ζt\.\\\|\\nabla L\_\{t,\\rho\_\{t\}\}\(w\_\{t\}\)\\\|\_\{2\}\\leq G\_\{t\},\\\|\\nabla\\Phi\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\\leq\\zeta\_\{t\}\.Then the anchor gives‖wt−w0‖2≤Gt\+ζt2​λ\.\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}\\leq\\frac\{G\_\{t\}\+\\zeta\_\{t\}\}\{2\\lambda\}\.Consequently, ifAt:=Gt\+ζt2​λ,A¯:=1T​∑s=1TAs,A\_\{t\}:=\\frac\{G\_\{t\}\+\\zeta\_\{t\}\}\{2\\lambda\},\\bar\{A\}:=\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}A\_\{s\},then‖Δt‖2=‖u¯−ut‖2≤At\+A¯\.\\\|\\Delta\_\{t\}\\\|\_\{2\}=\\\|\\bar\{u\}\-u\_\{t\}\\\|\_\{2\}\\leq A\_\{t\}\+\\bar\{A\}\.Substituting this into Theorem[5\.2](https://arxiv.org/html/2608.26655#S5.Thmtheorem2)yields

Gmerge≤1T​∑t=1T\[εt​\(At\+A¯\)\+βt2​\(At\+A¯\)2\+Mt6​\(At\+A¯\)3\]\.\\small G\_\{\\mathrm\{merge\}\}\\leq\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\left\[\\varepsilon\_\{t\}\(A\_\{t\}\+\\bar\{A\}\)\+\\frac\{\\beta\_\{t\}\}\{2\}\(A\_\{t\}\+\\bar\{A\}\)^\{2\}\+\\frac\{M\_\{t\}\}\{6\}\(A\_\{t\}\+\\bar\{A\}\)^\{3\}\\right\]\.\(12\)In the uniform case whereεt≤ε\\varepsilon\_\{t\}\\leq\\varepsilon,βt≤β\\beta\_\{t\}\\leq\\beta,Mt≤MM\_\{t\}\\leq M,Gt≤GG\_\{t\}\\leq G, andζt≤ζ\\zeta\_\{t\}\\leq\\zetafor alltt, we obtain the simplified bound

Gmerge≤ε​G\+ζλ\+β2​\(G\+ζλ\)2\+M6​\(G\+ζλ\)3\.\\small G\_\{\\mathrm\{merge\}\}\\leq\\varepsilon\\frac\{G\+\\zeta\}\{\\lambda\}\+\\frac\{\\beta\}\{2\}\\left\(\\frac\{G\+\\zeta\}\{\\lambda\}\\right\)^\{2\}\+\\frac\{M\}\{6\}\\left\(\\frac\{G\+\\zeta\}\{\\lambda\}\\right\)^\{3\}\.\(13\)This bound explains DP\-Merging’s improved private mergeability: the sharpness\-aware component reducesβ\\beta, and the anchor increases geometric compatibility by reducing the displacement scale\(G\+ζ\)/λ\(G\+\\zeta\)/\\lambda\.

Table 1:Multi\-task accuracy \(%\) on the 8\-task vision benchmark with ViT\-B/32,ε=4\\varepsilon=4\.Table 2:Multi\-task accuracy \(%\) on the 8\-task vision benchmark with ViT\-L/14,ε=4\\varepsilon=4\.

## 6Experiments

### 6\.1Experimental Settings

Datasets and Models\.We evaluate our method onvision and language tasks\.For vision tasks, following[Yang et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib22);[Cheng et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib40), we study multi\-task model merging across eight image classification datasets, namely SUN397\([Xiao et al\., 2016](https://arxiv.org/html/2608.26655#bib.bib23)\), Cars\([Krause et al\., 2013](https://arxiv.org/html/2608.26655#bib.bib24)\), RESISC45\([Cheng et al\., 2017](https://arxiv.org/html/2608.26655#bib.bib25)\), EuroSAT\([Helber et al\., 2019](https://arxiv.org/html/2608.26655#bib.bib26)\), SVHN\([Yuval, 2011](https://arxiv.org/html/2608.26655#bib.bib27)\), GTSRB\([Stallkamp et al\., 2011](https://arxiv.org/html/2608.26655#bib.bib28)\), MNIST\([LeCun, 1998](https://arxiv.org/html/2608.26655#bib.bib29)\), and DTD\([Cimpoi et al\., 2014](https://arxiv.org/html/2608.26655#bib.bib30)\), and adopt CLIP\-based ViT backbones\([Radford et al\., 2021](https://arxiv.org/html/2608.26655#bib.bib31)\), including ViT\-B/32, ViT\-B/16, and ViT\-L/14\. For language tasks, we use the GLUE benchmark\([Wang et al\., 2018](https://arxiv.org/html/2608.26655#bib.bib32)\)and evaluate with RoBERTa\-Base and RoBERTa\-Large\([Liu et al\., 2019](https://arxiv.org/html/2608.26655#bib.bib33)\)\.

Baselines\.We compare with representative merging methods under the same DP setting, including Weight Averaging[Wortsman et al\. \(2022\)](https://arxiv.org/html/2608.26655#bib.bib34), RegMean[Jin et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib35), Task Arithmetic[Ilharco et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib36), TIES\-Merging[Yadav et al\. \(2023\)](https://arxiv.org/html/2608.26655#bib.bib38), PCB Merging[DU et al\. \(2024\)](https://arxiv.org/html/2608.26655#bib.bib39), and WUDI\-Merging[Cheng et al\. \(2025\)](https://arxiv.org/html/2608.26655#bib.bib40)\. All baselines independently train task\-specific models with the same DP optimizer and privacy budget, and then merge the released DP models without accessing private data\. The merging step is post\-processing and therefore incurs no additional privacy loss\. We apply the same operators to the task models produced by DP\-Merging to evaluate whether our merge\-aware fine\-tuning improves mergeability across merging rules\.

Implementation Details\.We implement sample\-level DP fine\-tuning with Opacus[Yousefpour et al\. \(2021\)](https://arxiv.org/html/2608.26655#bib.bib43)and use AdamW[Loshchilov et al\. \(2017\)](https://arxiv.org/html/2608.26655#bib.bib44)as the default optimizer\. Unless otherwise specified, each task model is trained with clipping normC=0\.2C=0\.2, batch size1616, learning rate1​e−51e\-5, weight decay1​e−21e\-2, and1010training epochs/steps\. Privacy loss is computed using the Opacus privacy accountant and reported as\(ε,δ\)\(\\varepsilon,\\delta\)\-DP, whereδ=1/N\\delta=1/Nandε∈\{1,2,4,8\}\\varepsilon\\in\\\{1,2,4,8\\\}\. For DP\-Merging, the perturbation radiusρ=0\.05\\rho=0\.05and the alignment coefficientλ=0\.05\\lambda=0\.05\. Additional implementation details are provided in Appendix[B\.3](https://arxiv.org/html/2608.26655#A2.SS3)\.

### 6\.2Main Results

Evaluation on Visual Tasks\.We evaluate DP\-Merging on the 8\-task vision benchmark underε=4\\varepsilon=4\. Table[1](https://arxiv.org/html/2608.26655#S5.T1)and Table[2](https://arxiv.org/html/2608.26655#S5.T2)report the main results with ViT\-B/32 and ViT\-L/14, and additional results with ViT\-B/16 are provided in Appendix[B\.4](https://arxiv.org/html/2608.26655#A2.SS4)\. Across both backbones, standard merging methods exhibit a clear drop from the DP individual reference, suggesting that DP fine\-tuning hurts task\-vector mergeability\. DP\-Merging consistently improves the merged accuracy under all merging operators\. For instance, on ViT\-B/32, WUDI\-Merging improves from56\.5%56\.5\\%to60\.8%60\.8\\%when applied to DP\-Merging task models\. The same trend holds for ViT\-L/14 and ViT\-B/16\.

Evaluation on Language Tasks\.Table[3](https://arxiv.org/html/2608.26655#S6.T3)summarizes the multi\-task performance of RoBERTa\-Large models underε=4\\varepsilon=4\. Compared with standard DP baselines, DP\-Merging consistently achieves higher average accuracy across different merging operators\. For example, the average score for DP\-Merging ranges from 73\.9 to 77\.0, depending on the merging method used\. The average score for naive DP ranges from 71\.6 to 74\.7\. These results indicate that merge\-aware DP fine\-tuning consistently maintains strong performance across multiple language understanding tasks\.

Table 3:Multi\-task performance of RoBERTa\-Large models on GLUE benchmark,ε=4\\varepsilon=4\.Table 4:Performance under different privacy budgets on visual and language tasks using TIES\-Merging\. Smallerε\\varepsilonindicates stronger privacy protection\.
### 6\.3Analysis under Different Privacy Budgets

To evaluate DP\-Merging under varying privacy budgetsε\\varepsilon, we keep the merging protocol unchanged\. A smallerε\\varepsiloncorresponds to stronger privacy protection and usually introduces larger optimization perturbations through clipping and noise\. As shown in Table[4](https://arxiv.org/html/2608.26655#S6.T4), DP\-Merging consistently outperforms naive DP merging across different privacy budgets\. The improvement is more pronounced under stronger privacy constraints, suggesting that the proposed flatness and alignment components effectively mitigate the geometry distortion caused by differential privacy\.

### 6\.4Ablation Study

We conduct ablation studies to understand the contribution of each component in DP\-Merging and analyze its sensitivity to key hyperparameters\. All experiments useε=4\\varepsilon=4and default settings\.

Effect of each component\.DP\-Merging contains two key components: sharpness\-aware fine\-tuning and reference\-anchored alignment\. To evaluate their individual contributions, we compare the full method with two variants: \(1\) removing the alignment component, and \(2\) removing the sharpness\-aware fine\-tuning\. As shown in Table[5](https://arxiv.org/html/2608.26655#S6.T5), both components improve performance over naive DP\. The sharpness\-aware fine\-tuning mainly improves local robustness by encouraging flatter task\-specific solutions, while the alignment component enhances cross\-task compatibility by reducing discrepancies among task vectors\. Combining both components yields the best performance, demonstrating that sharpness and alignment are complementary\.

Table 5:Ablation study of different merging algorithms on the 8\-task vision benchmark with ViT\-B/32\. “w/o Alignment” represents without the reference\-anchored alignment component, and “w/o Flatness” represents without sharpness\-aware fine\-tuning\.Sensitivity to the flatness radiusρ\\rho\.We study the influence of the flatness radiusρ\\rhoon merged accuracy\. When varyingρ\\rho, the alignment strengthλ\\lambdais fixed to its default value\. As shown in Table[6](https://arxiv.org/html/2608.26655#S6.T6), moderate values ofρ\\rhoconsistently improve merged accuracy, while overly large values may hurt task\-specific adaptation or over\-constrain different tasks\.

Sensitivity to the alignment strengthλ\\lambda\.We study the effect of alignment strengthλ\\lambdaon merged accuracy \(flatness radiusρ\\rhofixed\)\. As shown in Table[7](https://arxiv.org/html/2608.26655#S6.T7), moderate values ofλ\\lambdaconsistently improve merged accuracy, while excessively large values may limit flexibility across tasks\.

Table 6:Sensitivity to the flatness radiusρ\\rhoon ViT\-B/32 using TIES\-Merging\.

Table 7:Sensitivity to the alignment strengthλ\\lambdaon ViT\-B/32 using TIES\-Merging\.

Robustness to merging operators\.Since our method improves the private fine\-tuning stage rather than designing a new merging rule, we evaluate whether it works with different data\-free merging operators\. As shown in Table[8](https://arxiv.org/html/2608.26655#S6.T8), DP\-Merging consistently improves the final merged model across different representative merging operators, demonstrating that our method enhances the intrinsic mergeability of task\-specific models\.

Table 8:Robustness to different merging operators on the 8\-task vision benchmark with ViT\-B/32\.

## 7Conclusion

We studied differentially private model merging, where independently fine\-tuned private models are combined without sharing task data\. The challenge arises not only from the utility loss of DP fine\-tuned models, but also from their geometric incompatibility, caused by local curvature and displacement from the pretrained anchor\. To address this, we propose DP\-Merging, which combines a flatness objective with a pretrained\-anchor regularizer to improve robustness and control task\-specific drift\. Experiments on vision and language benchmarks show that DP\-Merging consistently improves merged\-model performance under different privacy budgets and merging settings\. We hope this work contributes to a better understanding of, and advances in, model merging under privacy constraints\.

## References

- \[1\]A\. Agiza, M\. Neseem, and S\. Reda\(2024\)Mtlora: low\-rank adaptation approach for efficient multi\-task learning\.InProceedings of the IEEE/CVF conference on computer vision and pattern recognition,pp\. 16196–16205\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p1.1)\.
- \[2\]S\. Ainsworth, J\. Hayase, and S\. Srinivasa\(2023\)Git re\-basin: merging models modulo permutation symmetries\.InThe Eleventh International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=CQsmMYmlP5T)Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p3.1),[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1)\.
- \[3\]Z\. Bu, Y\. Wang, S\. Zha, and G\. Karypis\(2024\)Differentially private bias\-term fine\-tuning of foundation models\.InInternational Conference on Machine Learning,pp\. 4730–4751\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px2.p1.1)\.
- \[4\]G\. Cheng, J\. Han, and X\. Lu\(2017\)Remote sensing image scene classification: benchmark and state of the art\.Proceedings of the IEEE105\(10\),pp\. 1865–1883\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[5\]R\. Cheng, F\. Xiong, Y\. Wei, W\. Zhu, and C\. Yuan\(2025\)Whoever started the interference should end it: guiding data\-free model merging via task vectors\.InForty\-second International Conference on Machine Learning,Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p2.1)\.
- \[6\]M\. Cimpoi, S\. Maji, I\. Kokkinos, S\. Mohamed, and A\. Vedaldi\(2014\)Describing textures in the wild\.InCVPR,pp\. 3606–3613\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[7\]F\. Draxler, K\. Veschgini, M\. Salmhofer, and F\. Hamprecht\(2018\)Essentially no barriers in neural network energy landscape\.InInternational conference on machine learning,pp\. 1309–1318\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1)\.
- \[8\]G\. DU, J\. Lee, J\. Li, R\. Jiang, Y\. Guo, S\. Yu, H\. Liu, S\. K\. Goh, H\. Tang, D\. He, and M\. Zhang\(2024\)Parameter competition balancing for model merging\.InThe Thirty\-eighth Annual Conference on Neural Information Processing Systems,Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p2.1)\.
- \[9\]M\. Du, X\. Yue, S\. S\. Chow, T\. Wang, C\. Huang, and H\. Sun\(2023\)Dp\-forward: fine\-tuning and inference on language models with differential privacy in forward pass\.InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security,pp\. 2665–2679\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px2.p1.1)\.
- \[10\]C\. Dwork, F\. McSherry, K\. Nissim, and A\. Smith\(2006\)Calibrating noise to sensitivity in private data analysis\.InTheory of cryptography conference,pp\. 265–284\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p2.1)\.
- \[11\]C\. Fifty, E\. Amid, Z\. Zhao, T\. Yu, R\. Anil, and C\. Finn\(2021\)Efficiently identifying task groupings for multi\-task learning\.Advances in Neural Information Processing Systems34,pp\. 27503–27516\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p1.1)\.
- \[12\]P\. Foret, A\. Kleiner, H\. Mobahi, and B\. Neyshabur\(2021\)Sharpness\-aware minimization for efficiently improving generalization\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=6Tm1mposlrM)Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2608.26655#S4.SS1.p1.1)\.
- \[13\]T\. Garipov, P\. Izmailov, D\. Podoprikhin, D\. P\. Vetrov, and A\. G\. Wilson\(2018\)Loss surfaces, mode connectivity, and fast ensembling of dnns\.Advances in neural information processing systems31\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1)\.
- \[14\]P\. Helber, B\. Bischke, A\. Dengel, and D\. Borth\(2019\)Eurosat: a novel dataset and deep learning benchmark for land use and land cover classification\.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing12\(7\),pp\. 2217–2226\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[15\]G\. Ilharco, M\. T\. Ribeiro, M\. Wortsman, L\. Schmidt, H\. Hajishirzi, and A\. Farhadi\(2023\)Editing models with task arithmetic\.InThe Eleventh International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p2.1)\.
- \[16\]A\. Ito, M\. Yamada, and A\. Kumagai\(2025\)Linear mode connectivity between multiple models modulo permutation symmetries\.InForty\-second International Conference on Machine Learning,External Links:[Link](https://openreview.net/forum?id=qaJuLzY6iL)Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p3.1),[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1)\.
- \[17\]X\. Jin, X\. Ren, D\. Preotiuc\-Pietro, and P\. Cheng\(2023\)Dataless knowledge fusion by merging weights of language models\.InThe Eleventh International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p2.1)\.
- \[18\]J\. Krause, M\. Stark, J\. Deng, and L\. Fei\-Fei\(2013\)3d object representations for fine\-grained categorization\.InICCV workshops,pp\. 554–561\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[19\]Y\. LeCun\(1998\)The mnist database of handwritten digits\.http://yann\. lecun\. com/exdb/mnist/\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[20\]Y\. Lee, J\. Jung, and S\. Baik\(2025\)Mitigating parameter interference in model merging via sharpness\-aware fine\-tuning\.InThe Thirteenth International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1)\.
- \[21\]X\. Li, R\. Zmigrod, Z\. Ma, X\. Liu, and X\. Zhu\(2024\)Fine\-tuning language models with differential privacy through adaptive noise allocation\.InFindings of the Association for Computational Linguistics: EMNLP 2024,pp\. 8368–8375\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px2.p1.1)\.
- \[22\]J\. Liu, Y\. Miao, N\. Xi, and J\. Liu\(2026\)Rethinking loRA for privacy\-preserving federated learning in large models\.InThe Fourteenth International Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p1.1)\.
- \[23\]Y\. Liu, M\. Ott, N\. Goyal, J\. Du, M\. Joshi, D\. Chen, O\. Levy, M\. Lewis, L\. Zettlemoyer, and V\. Stoyanov\(2019\)Roberta: a robustly optimized bert pretraining approach\.arXiv preprint arXiv:1907\.11692\.Cited by:[§B\.2](https://arxiv.org/html/2608.26655#A2.SS2.SSS0.Px2.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[24\]I\. Loshchilov F\. Hutteret al\.\(2017\)Fixing weight decay regularization in adam\.arXiv preprint arXiv:1711\.051015\(5\),pp\. 5\.Cited by:[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p3.1)\.
- \[25\]M\. S\. Matena and C\. A\. Raffel\(2022\)Merging models with fisher\-weighted averaging\.Advances in Neural Information Processing Systems35,pp\. 17703–17716\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1)\.
- \[26\]I\. Mironov\(2017\)Rényi differential privacy\.InProc\. IEEE computer security foundations symposium \(CSF\),pp\. 263–275\.Cited by:[Theorem 5\.1](https://arxiv.org/html/2608.26655#S5.Thmtheorem1.p1.1.1)\.
- \[27\]J\. Park, H\. Kim, Y\. Choi, and J\. Lee\(2023\)Differentially private sharpness\-aware training\.InInternational Conference on Machine Learning,pp\. 27204–27224\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px2.p1.1)\.
- \[28\]F\. A\. G\. Peña, H\. R\. Medeiros, T\. Dubail, M\. Aminbeidokhti, E\. Granger, and M\. Pedersoli\(2023\)Re\-basin via implicit sinkhorn differentiation\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 20237–20246\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p3.1)\.
- \[29\]A\. Radford, J\. W\. Kim, C\. Hallacy, A\. Ramesh, G\. Goh, S\. Agarwal, G\. Sastry, A\. Askell, P\. Mishkin, J\. Clark,et al\.\(2021\)Learning transferable visual models from natural language supervision\.InInternational conference on machine learning,pp\. 8748–8763\.Cited by:[§B\.2](https://arxiv.org/html/2608.26655#A2.SS2.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[30\]J\. Stallkamp, M\. Schlipsing, J\. Salmen, and C\. Igel\(2011\)The german traffic sign recognition benchmark: a multi\-class classification competition\.InIJCNN,pp\. 1453–1460\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[31\]A\. Wang, A\. Singh, J\. Michael, F\. Hill, O\. Levy, and S\. Bowman\(2018\)GLUE: a multi\-task benchmark and analysis platform for natural language understanding\.InProceedings of the 2018 EMNLP workshop BlackboxNLP: Analyzing and interpreting neural networks for NLP,pp\. 353–355\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px2.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[32\]L\. Wang, J\. Wang, T\. Cong, X\. He, Z\. Qin, and X\. Huang\(2025\)From purity to peril: backdooring merged models from" harmless" benign components\.In34th USENIX Security Symposium \(USENIX Security 25\),pp\. 6339–6358\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p2.1)\.
- \[33\]Z\. Wang, J\. Liang, R\. He, Z\. Wang, and T\. Tan\(2026\)Taming momentum: rethinking optimizer states through low\-rank approximation\.InThe Fourteenth International Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p1.1)\.
- \[34\]M\. Wortsman, G\. Ilharco, S\. Y\. Gadre, R\. Roelofs, R\. Gontijo\-Lopes, A\. S\. Morcos, H\. Namkoong, A\. Farhadi, Y\. Carmon, S\. Kornblith,et al\.\(2022\)Model soups: averaging weights of multiple fine\-tuned models improves accuracy without increasing inference time\.InInternational conference on machine learning,pp\. 23965–23998\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p2.1)\.
- \[35\]J\. Xiao, K\. A\. Ehinger, J\. Hays, A\. Torralba, and A\. Oliva\(2016\)Sun database: exploring a large collection of scene categories\.IJCV119,pp\. 3–22\.Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[36\]P\. Yadav, D\. Tam, L\. Choshen, C\. Raffel, and M\. Bansal\(2023\)TIES\-merging: resolving interference when merging models\.InThirty\-seventh Conference on Neural Information Processing Systems,Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p2.1)\.
- \[37\]E\. Yang, L\. Shen, G\. Guo, X\. Wang, X\. Cao, J\. Zhang, and D\. Tao\(2026\)Model merging in llms, mllms, and beyond: methods, theories, applications, and opportunities\.ACM Computing Surveys58\(8\),pp\. 1–41\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p1.1)\.
- \[38\]E\. Yang, Z\. Wang, L\. Shen, S\. Liu, G\. Guo, X\. Wang, and D\. Tao\(2024\)AdaMerging: adaptive model merging for multi\-task learning\.InThe Twelfth International Conference on Learning Representations,Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[39\]A\. Yousefpour, I\. Shilov, A\. Sablayrolles, D\. Testuggine, K\. Prasad, M\. Malek, J\. Nguyen, S\. Ghosh, A\. Bharadwaj, J\. Zhao,et al\.\(2021\)Opacus: user\-friendly differential privacy library in pytorch\.arXiv preprint arXiv:2109\.12298\.Cited by:[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p3.1)\.
- \[40\]D\. Yu, S\. Naik, A\. Backurs, S\. Gopi, H\. A\. Inan, G\. Kamath, J\. Kulkarni, Y\. T\. Lee, A\. Manoel, L\. Wutschitz, S\. Yekhanin, and H\. Zhang\(2022\)Differentially private fine\-tuning of language models\.InInternational Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px2.p1.1)\.
- \[41\]Z\. Yuan, Y\. Xu, J\. Shi, P\. Zhou, and L\. Sun\(2025\)Merge hijacking: backdoor attacks to model merging of large language models\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 32688–32703\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p2.1)\.
- \[42\]N\. Yuval\(2011\)Reading digits in natural images with unsupervised feature learning\.InNIPS Workshop on Deep Learning and Unsupervised Feature Learning,Cited by:[§B\.1](https://arxiv.org/html/2608.26655#A2.SS1.SSS0.Px1.p1.1),[§6\.1](https://arxiv.org/html/2608.26655#S6.SS1.p1.1)\.
- \[43\]B\. Zhang, Z\. Zheng, Z\. Chen, and J\. Li\(2025\)Beyond the permutation symmetry of transformers: the role of rotation for model fusion\.InInternational Conference on Machine Learning,pp\. 77090–77106\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px3.p1.1)\.
- \[44\]J\. Zhang, J\. Chi, Z\. Li, K\. Cai, Y\. Zhang, and Y\. Tian\(2024\)Badmerging: backdoor attacks against model merging\.InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security,pp\. 4450–4464\.Cited by:[§1](https://arxiv.org/html/2608.26655#S1.p2.1)\.
- \[45\]L\. Zhang, B\. Li, K\. K\. Thekumparampil, S\. Oh, and N\. He\(2024\)DPZero: private fine\-tuning of language models without backpropagation\.InInternational Conference on Machine Learning,pp\. 59210–59246\.Cited by:[§2](https://arxiv.org/html/2608.26655#S2.SS0.SSS0.Px2.p1.1)\.

When Privacy Hurts Mergeability: Geometry\-Aware Model Merging under Differential Privacy

Supplementary Material

LIST OF APPENDICES

[B: Implementation of Experiments](https://arxiv.org/html/2608.26655#A2)

1. B\.1
2. B\.2
3. B\.3
4. B\.4
5. B\.5

## Appendix ANotation

Table[9](https://arxiv.org/html/2608.26655#A1.T9)summarizes the main notation used throughout the paper\.

Table 9:Summary of notation\.
## Appendix BImplementation of Experiments

### B\.1Datasets

We evaluate DP\-Merging on both vision and language benchmarks\. For all tasks, the training data are treated as private and are only used during DP fine\-tuning\. The merging stage only accesses the released DP task models and does not use the original training data\.

#### Vision tasks\.

For vision experiments, we follow the standard multi\-task model\-merging setting used in prior work\[[38](https://arxiv.org/html/2608.26655#bib.bib22),[5](https://arxiv.org/html/2608.26655#bib.bib40)\]\. We consider eight image classification tasks: SUN397\[[35](https://arxiv.org/html/2608.26655#bib.bib23)\]for scene recognition, Cars\[[18](https://arxiv.org/html/2608.26655#bib.bib24)\]for fine\-grained car classification, RESISC45\[[4](https://arxiv.org/html/2608.26655#bib.bib25)\]and EuroSAT\[[14](https://arxiv.org/html/2608.26655#bib.bib26)\]for remote\-sensing and land\-cover recognition, SVHN\[[42](https://arxiv.org/html/2608.26655#bib.bib27)\]and MNIST\[[19](https://arxiv.org/html/2608.26655#bib.bib29)\]for digit recognition, GTSRB\[[30](https://arxiv.org/html/2608.26655#bib.bib28)\]for traffic\-sign recognition, and DTD\[[6](https://arxiv.org/html/2608.26655#bib.bib30)\]for texture classification\. These tasks cover diverse visual domains and therefore provide a broad testbed for evaluating whether DP task models remain mergeable across heterogeneous classification problems\. For each dataset, we independently fine\-tune a private task model from the same pretrained vision backbone under sample\-level differential privacy\. The released DP task models are then merged into a single model without accessing the original training data\. We report classification accuracy on each task and use the average accuracy across all eight tasks as the main vision metric\.

#### Language tasks\.

For language experiments, we use eight tasks from the GLUE benchmark\[[31](https://arxiv.org/html/2608.26655#bib.bib32)\]: CoLA for linguistic acceptability, SST\-2 for sentiment classification, MRPC and QQP for paraphrase detection, STS\-B for semantic textual similarity, MNLI and RTE for natural language inference, and QNLI for question\-answering natural language inference\. For each task, we fine\-tune a separate private language model under sample\-level differential privacy and merge the released DP task models without accessing the original GLUE training data\. Following the standard GLUE protocol, we report Matthew’s correlation for CoLA, Spearman correlation for STS\-B, F1/accuracy for MRPC and QQP, and accuracy for SST\-2, MNLI, QNLI, and RTE\. All task scores are converted to a00–100100scale, and the average score over the eight tasks is used as the main language metric\.

### B\.2Models

#### Vision models\.

For vision experiments, we use CLIP\-pretrained Vision Transformer backbones\[[29](https://arxiv.org/html/2608.26655#bib.bib31)\], including ViT\-B/32, ViT\-B/16, and ViT\-L/14\. ViT\-B/32 and ViT\-B/16 share the same base\-size Transformer architecture with 12 layers and hidden dimension 768, but use different patch sizes of32×3232\\times 32and16×1616\\times 16, respectively\. ViT\-L/14 is a larger backbone with 24 layers, hidden dimension 1024, and14×1414\\times 14image patches\. For each backbone, all task\-specific models are initialized from the same public CLIP checkpoint and independently fine\-tuned on each private vision dataset under sample\-level DP\. During merging, we merge the shared visual encoder parameters of the released DP task models\. Since the eight vision datasets have different label spaces, task\-specific classification heads are kept separate for evaluation\. Thus, the merged vision model consists of one shared visual encoder and the corresponding task head for each dataset\.

#### Language models\.

For language experiments, we use RoBERTa\-Base and RoBERTa\-Large\[[23](https://arxiv.org/html/2608.26655#bib.bib33)\]\. RoBERTa\-Base has 12 Transformer layers with hidden dimension 768, while RoBERTa\-Large has 24 Transformer layers with hidden dimension 1024\. For each GLUE task, all task\-specific models are initialized from the same public RoBERTa checkpoint and independently fine\-tuned under sample\-level DP\. During merging, we merge the shared RoBERTa encoder parameters of the released DP task models\. Because GLUE tasks have different label spaces and output formats, task\-specific prediction heads are kept separate for evaluation\. The merged language model, therefore, uses one shared encoder together with the corresponding task head for each evaluation task\.

### B\.3Implementation Details

This section provides additional implementation details that are omitted from the main text due to space limits\. All experiments are conducted on NVIDIA RTX 5090 GPUs\.

#### Training schedules\.

All task\-specific models are fine\-tuned using sample\-level differential privacy with gradient clippingC=0\.2C=0\.2, batch size1616, learning rate1×10−51\\times 10^\{\-5\}, weight decay1×10−21\\times 10^\{\-2\}, and1010training epochs/steps\. We use AdamW as the optimizer with parameters\(β1,β2\)=\(0\.9,0\.999\)\(\\beta\_\{1\},\\beta\_\{2\}\)=\(0\.9,0\.999\)\. For clarity, different task types follow the same DP fine\-tuning defaults; any deviations from this default schedule are explicitly noted in the corresponding experiment description in the main text\.

#### Merging hyperparameters\.

For all experiments, we use fixed merging hyperparameters for each merging method to ensure fair comparison: For Task Arithmetic, the scaling coefficient is0\.30\.3\. For TIES\-Merging, pruning density is0\.20\.2\. For PCB Merging and WUDI\-Merging, we use default configurations from the original papers unless otherwise specified\.

The same merging hyperparameters are used for both the standard DP fine\-tuning baselines and DP\-Merging\. For DP\-Merging specifically, the perturbation radiusρ=0\.05\\rho=0\.05and the alignment coefficientλ=0\.05\\lambda=0\.05are used consistently across all tasks\.

Table 10:Multi\-task accuracy \(%\) on the 8\-task vision benchmark with ViT\-B/16,ε=4\\varepsilon=4\.

### B\.4More Results on Vision Tasks

Table[10](https://arxiv.org/html/2608.26655#A2.T10)reports the multi\-task accuracy \(%\) of various training strategies on eight vision benchmarks\. Each method is evaluated, including individual training \(DP \+ Individual\), simple weight averaging \(DP \+ Weight Averaging\), and various DP\-Merging variants combined with regularization or task\-specific aggregation strategies\. Individual training achieves the highest average accuracy \(80\.0%\), but does not leverage knowledge sharing across tasks, whereas simple weight averaging results in a substantially lower average accuracy \(46\.8%\)\. Incorporating DP\-Merging with different weighting or aggregation strategies significantly improves multi\-task performance, with DP\-Merging \+ Task Arithmetic reaching 61\.4%, and DP\-Merging \+ WUDI\-Merging achieving the highest average accuracy among merged approaches \(60\.2%\), demonstrating that careful parameter merging and task coordination can effectively enhance generalization in multi\-task settings\. The numbers in red indicate improvements relative to the corresponding non\-merged baseline, highlighting the positive impact of merging strategies\.

Loss Landscape Visualization\.To illustrate the effect of different DP fine\-tuning and merging strategies on the geometry of merged models, we visualize the loss landscapes of the final merged ViT models under privacy budgetε=4\\varepsilon=4\. Figure[4](https://arxiv.org/html/2608.26655#A2.F4)shows the landscapes of models merged using Task Arithmetic after Naive DP fine\-tuning, while Figure[5](https://arxiv.org/html/2608.26655#A2.F5)shows the landscapes of models merged using Task Arithmetic after DP\-Merging\. All visualized models are final merged models for three ViT variants \(ViT\-B/32, ViT\-B/16, ViT\-L/14\)\. Comparing the two sets of landscapes, we observe that DP\-Merging produces wider and smoother low\-loss regions, indicating improved stability and geometric compatibility of the merged models\.

![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/DP_loss_vit_b_32.png)\(a\)ViT\-B/32
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/DP_loss_vit_b_16.png)\(b\)ViT\-B/16
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/DP_loss_vit_l_14.png)\(c\)ViT\-L/14

Figure 4:Loss landscapes of ViT models that were first Naive DP fine\-tuned underε=4\\varepsilon=4and then merged using Task Arithmetic \(ViT\-B/32, ViT\-B/16, ViT\-L/14\)\.![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/DP-Merging_loss_vit_b_32.png)\(a\)ViT\-B/32
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/DP-Merging_loss_vit_b_32.png)\(b\)ViT\-B/16
![Refer to caption](https://arxiv.org/html/2608.26655v1/fig/DP-Merging_loss_vit_l_14.png)\(c\)ViT\-L/14

Figure 5:Loss landscapes of the merged ViT models \(ViT\-B/32, ViT\-B/16, and ViT\-L/14\) underε=4\\varepsilon=4, obtained using DP\-Merging with Task Arithmetic\.
### B\.5More Results on Language Tasks

Table[11](https://arxiv.org/html/2608.26655#A2.T11)reports the multi\-task performance of RoBERTa\-Base models on the GLUE benchmark \(CoLA, MNLI, MRPC, QNLI, QQP, RTE, SST2, STSB\)\. Individual training \(DP \+ Individual\) achieves the highest average score \(79\.8\), while simple weight averaging drops it to 72\.3\. DP\-Merging strategies consistently improve results, with DP\-Merging \+ Task Arithmetic reaching 73\.9 and DP\-Merging \+ WUDI\-Merging achieving 76\.5, demonstrating that parameter merging and task coordination enhance multi\-task generalization\.

Table 11:Multi\-task performance of RoBERTa\-Base models on GLUE benchmark,ε=4\\varepsilon=4\.

## Appendix CImplementation of Theoretical Analysis

### C\.1Privacy guarantee of DP\-Merging

Each DP\-Merging iteration uses two privatized clipped\-gradient evaluations: one to construct the sharpness\-aware perturbation and one to update the model at the perturbed point\. The perturbation itself is a deterministic function of the first private gradient and therefore is post\-processing\. The reference\-anchoring term depends only on the current model and the public initialization, so it incurs no additional privacy loss\. Finally, the merging step only processes already released private task models and is also post\-processing\.

###### Theorem C\.1\(Privacy guarantee of DP\-Merging\)\.

Assume that each task dataset𝒟t\\mathcal\{D\}\_\{t\}is disjoint, and each private example belongs to at most one task\. For tasktt, suppose Algorithm[1](https://arxiv.org/html/2608.26655#alg1)runs forKKiterations with Poisson sampling rateqq, clipping thresholdCC, and Gaussian noise multiplierσ\\sigma\. Letεpair​\(α,q,σ\)\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)denote the order\-α\\alphaRDP cost of one Poisson\-subsampled paired Gaussian mechanism that releases the two noisy clipped\-gradient quantities used in one DP\-Merging iteration\. Then, for any Rényi orderα\>1\\alpha\>1, the released task modelwtDPw\_\{t\}^\{\\mathrm\{DP\}\}satisfies

\(α,K​εpair​\(α,q,σ\)\)​\-RDP\.\(\\alpha,\\,K\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)\)\\text\{\-RDP\}\.Consequently, for anyδt∈\(0,1\)\\delta\_\{t\}\\in\(0,1\),wtDPw\_\{t\}^\{\\mathrm\{DP\}\}satisfies\(εt,δt\)\(\\varepsilon\_\{t\},\\delta\_\{t\}\)\-DP with

εt=minα\>1⁡\{K​εpair​\(α,q,σ\)\+log⁡\(1/δt\)α−1\}\.\\varepsilon\_\{t\}=\\min\_\{\\alpha\>1\}\\left\\\{K\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)\+\\frac\{\\log\(1/\\delta\_\{t\}\)\}\{\\alpha\-1\}\\right\\\}\.Since the task datasets are disjoint, releasing all private task models\{wtDP\}t=1T\\\{w\_\{t\}^\{\\mathrm\{DP\}\}\\\}\_\{t=1\}^\{T\}satisfies

\(maxt∈\[T\]⁡εt,maxt∈\[T\]⁡δt\)​\-DP\.\\left\(\\max\_\{t\\in\[T\]\}\\varepsilon\_\{t\},\\,\\max\_\{t\\in\[T\]\}\\delta\_\{t\}\\right\)\\text\{\-DP\}\.The merged model

wmerge=1T​∑t=1TwtDPw\_\{\\mathrm\{merge\}\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}w\_\{t\}^\{\\mathrm\{DP\}\}incurs no additional privacy loss by post\-processing\.

We provide a detailed proof of Theorem[C\.1](https://arxiv.org/html/2608.26655#A3.Thmtheorem1)\. The analysis is at the sample level and uses the standard add/remove neighboring relation: two datasets are neighboring if they differ in the presence or absence of one training example\. We assume that each private example appears in at most one task dataset𝒟t\\mathcal\{D\}\_\{t\}\. The replace\-one neighboring relation can be handled by doubling the clipping sensitivity, equivalently replacingσ\\sigmabyσ/2\\sigma/2in the accountant\.

For a per\-example lossℓ⁡\(w,z\)\\ell\(w;z\), define the clipped gradient

g¯​\(w,z\)=∇ℓ​\(w,z\)⋅min⁡\{1,C‖∇ℓ​\(w,z\)‖2\}\.\\bar\{g\}\(w;z\)=\\nabla\\ell\(w;z\)\\cdot\\min\\left\\\{1,\\,\\frac\{C\}\{\\\|\\nabla\\ell\(w;z\)\\\|\_\{2\}\}\\right\\\}\.Thus,

‖g¯​\(w,z\)‖2≤C\\\|\\bar\{g\}\(w;z\)\\\|\_\{2\}\\leq Cfor allwwandzz\. Given a Poisson minibatchB⊆𝒟tB\\subseteq\\mathcal\{D\}\_\{t\}sampled with probabilityqq, the private gradient oracle used by DP\-Merging can be written as

g~​\(w,B\)=1s​\(∑zi∈Bg¯​\(w,zi\)\+ξ\),ξ∼𝒩⁡\(0,σ2​C2​I\),\\tilde\{g\}\(w;B\)=\\frac\{1\}\{s\}\\left\(\\sum\_\{z\_\{i\}\\in B\}\\bar\{g\}\(w;z\_\{i\}\)\+\\xi\\right\),\\qquad\\xi\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}C^\{2\}I\),wheressis a deterministic normalization factor\. The value ofssdoes not affect the privacy analysis because it scales both the sensitivity and the noise by the same factor\.

#### One\-iteration mechanism\.

Fix a taskttand an iterationkk\. Conditioned on all previous private outputs, the current parameterwt,kw\_\{t,k\}is fixed\. In one iteration, DP\-Merging first computes

g~t,k=g~​\(wt,k,Bt,k\),\\tilde\{g\}\_\{t,k\}=\\tilde\{g\}\(w\_\{t,k\};B\_\{t,k\}\),then constructs

ϵt,k=ρt​g~t,k‖g~t,k‖2\.\\epsilon\_\{t,k\}=\\rho\_\{t\}\\frac\{\\tilde\{g\}\_\{t,k\}\}\{\\\|\\tilde\{g\}\_\{t,k\}\\\|\_\{2\}\}\.If‖g~t,k‖2=0\\\|\\tilde\{g\}\_\{t,k\}\\\|\_\{2\}=0, we setϵt,k=0\\epsilon\_\{t,k\}=0\. In either case,ϵt,k\\epsilon\_\{t,k\}is a deterministic function of the first private outputg~t,k\\tilde\{g\}\_\{t,k\}and public hyperparameters\. Therefore, constructingϵt,k\\epsilon\_\{t,k\}is post\-processing and does not increase privacy loss\.

The second private gradient query is

h~t,k=g~​\(wt,k\+ϵt,k,Bt,k\)\.\\tilde\{h\}\_\{t,k\}=\\tilde\{g\}\(w\_\{t,k\}\+\\epsilon\_\{t,k\};B\_\{t,k\}\)\.Conditional ong~t,k\\tilde\{g\}\_\{t,k\}, the perturbed pointwt,k\+ϵt,kw\_\{t,k\}\+\\epsilon\_\{t,k\}is fixed\. Hence, the second query is another Gaussian mechanism applied to clipped per\-example gradients at a fixed model parameter\. The two private gradient queries are adaptive, but adaptive composition is allowed under RDP\.

#### Full\-batch paired Gaussian mechanism\.

We first ignore subsampling and analyze the paired mechanism that releases both noisy clipped\-gradient quantities on the same dataset\. LetDDandD′D^\{\\prime\}be neighboring datasets that differ in one example\. For the first query, the difference between the two clipped gradient sums is bounded by

‖∑zi∈Dg¯​\(wt,k,zi\)−∑zi∈D′g¯​\(wt,k,zi\)‖2≤C\.\\left\\\|\\sum\_\{z\_\{i\}\\in D\}\\bar\{g\}\(w\_\{t,k\};z\_\{i\}\)\-\\sum\_\{z\_\{i\}\\in D^\{\\prime\}\}\\bar\{g\}\(w\_\{t,k\};z\_\{i\}\)\\right\\\|\_\{2\}\\leq C\.Similarly, after conditioning on the first private output, the perturbed model is fixed, and the second query satisfies

‖∑zi∈Dg¯​\(wt,k\+ϵt,k,zi\)−∑zi∈D′g¯​\(wt,k\+ϵt,k,zi\)‖2≤C\.\\left\\\|\\sum\_\{z\_\{i\}\\in D\}\\bar\{g\}\(w\_\{t,k\}\+\\epsilon\_\{t,k\};z\_\{i\}\)\-\\sum\_\{z\_\{i\}\\in D^\{\\prime\}\}\\bar\{g\}\(w\_\{t,k\}\+\\epsilon\_\{t,k\};z\_\{i\}\)\\right\\\|\_\{2\}\\leq C\.Therefore, if we view the two released gradients as one concatenated vector, theℓ2\\ell\_\{2\}sensitivity of the paired query is bounded by

Δpair≤C2\+C2=2​C\.\\Delta\_\{\\mathrm\{pair\}\}\\leq\\sqrt\{C^\{2\}\+C^\{2\}\}=\\sqrt\{2\}\\,C\.The paired mechanism adds independent Gaussian noise with covarianceσ2​C2​I\\sigma^\{2\}C^\{2\}Ito each query\. Hence, for any Rényi orderα\>1\\alpha\>1, the full\-batch paired Gaussian mechanism satisfies

εfull​\(α\)≤α​Δpair22​σ2​C2≤ασ2\.\\varepsilon\_\{\\mathrm\{full\}\}\(\\alpha\)\\leq\\frac\{\\alpha\\Delta\_\{\\mathrm\{pair\}\}^\{2\}\}\{2\\sigma^\{2\}C^\{2\}\}\\leq\\frac\{\\alpha\}\{\\sigma^\{2\}\}\.Equivalently, this is the same as composing two Gaussian mechanisms, each with RDP costα/\(2​σ2\)\\alpha/\(2\\sigma^\{2\}\):

α2​σ2\+α2​σ2=ασ2\.\\frac\{\\alpha\}\{2\\sigma^\{2\}\}\+\\frac\{\\alpha\}\{2\\sigma^\{2\}\}=\\frac\{\\alpha\}\{\\sigma^\{2\}\}\.

#### Poisson subsampling\.

Algorithm[1](https://arxiv.org/html/2608.26655#alg1)samples the minibatchBt,kB\_\{t,k\}using Poisson sampling with rateqq\. Since the two gradient evaluations in one iteration use the same minibatch, privacy amplification must be applied to the joint paired mechanism rather than independently to the two queries\.

For integer ordersα≥2\\alpha\\geq 2, a valid RDP upper bound for one subsampled paired Gaussian iteration is

εpair\+​\(α,q,σ\)=1α−1​log⁡\(∑j=0α\(αj\)​\(1−q\)α−j​qj​exp⁡\(j⁡\(j−1\)σ2\)\)\.\\varepsilon\_\{\\mathrm\{pair\}\}^\{\+\}\(\\alpha;q,\\sigma\)=\\frac\{1\}\{\\alpha\-1\}\\log\\left\(\\sum\_\{j=0\}^\{\\alpha\}\\binom\{\\alpha\}\{j\}\(1\-q\)^\{\\alpha\-j\}q^\{j\}\\exp\\left\(\\frac\{j\(j\-1\)\}\{\\sigma^\{2\}\}\\right\)\\right\)\.The exponent differs from the standard single\-query subsampled Gaussian mechanism by a factor of two because the paired query has sensitivity2​C\\sqrt\{2\}Crather thanCC\.

For the reverse neighboring direction, a simple valid bound is

εpair−​\(α,q,σ\)≤−log⁡\(1−q\)\.\\varepsilon\_\{\\mathrm\{pair\}\}^\{\-\}\(\\alpha;q,\\sigma\)\\leq\-\\log\(1\-q\)\.Thus, one may take

εpair​\(α,q,σ\)=max⁡\{εpair\+​\(α,q,σ\),εpair−​\(α,q,σ\)\}\.\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)=\\max\\left\\\{\\varepsilon\_\{\\mathrm\{pair\}\}^\{\+\}\(\\alpha;q,\\sigma\),\\varepsilon\_\{\\mathrm\{pair\}\}^\{\-\}\(\\alpha;q,\\sigma\)\\right\\\}\.In practice, the same theorem also holds whenεpair​\(α,q,σ\)\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)is computed by a tighter numerical RDP accountant for the subsampled paired Gaussian mechanism\.

#### Composition over iterations\.

For a fixed tasktt, DP\-Merging runs forKKiterations\. RDP composes additively under adaptive composition\. Therefore, afterKKiterations, the released private task modelwtDPw\_\{t\}^\{\\mathrm\{DP\}\}satisfies

\(α,εtRDP​\(α\)\)​\-RDP,εtRDP​\(α\)≤K​εpair​\(α,q,σ\)\.\(\\alpha,\\varepsilon\_\{t\}^\{\\mathrm\{RDP\}\}\(\\alpha\)\)\\text\{\-RDP\},\\qquad\\varepsilon\_\{t\}^\{\\mathrm\{RDP\}\}\(\\alpha\)\\leq K\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)\.Using the standard conversion from RDP to approximate DP, for anyδt∈\(0,1\)\\delta\_\{t\}\\in\(0,1\),wtDPw\_\{t\}^\{\\mathrm\{DP\}\}is\(εt,δt\)\(\\varepsilon\_\{t\},\\delta\_\{t\}\)\-DP with

εt=minα\>1⁡\{K​εpair​\(α,q,σ\)\+log⁡\(1/δt\)α−1\}\.\\varepsilon\_\{t\}=\\min\_\{\\alpha\>1\}\\left\\\{K\\varepsilon\_\{\\mathrm\{pair\}\}\(\\alpha;q,\\sigma\)\+\\frac\{\\log\(1/\\delta\_\{t\}\)\}\{\\alpha\-1\}\\right\\\}\.

#### No privacy cost from reference anchoring\.

The update rule of DP\-Merging is

wt,k\+1=wt,k−η⁡\(h~t,k\+2​λ​\(wt,k−w0\)\)\.w\_\{t,k\+1\}=w\_\{t,k\}\-\\eta\\left\(\\tilde\{h\}\_\{t,k\}\+2\\lambda\(w\_\{t,k\}\-w\_\{0\}\)\\right\)\.The anchoring term2​λ​\(wt,k−w0\)2\\lambda\(w\_\{t,k\}\-w\_\{0\}\)depends only on the current model parameterwt,kw\_\{t,k\}and the public pretrained initializationw0w\_\{0\}\. It does not directly query any private example\. Therefore, after the private gradienth~t,k\\tilde\{h\}\_\{t,k\}has been produced, adding the reference\-anchoring term is a deterministic transformation of already privatized quantities and public information\. By post\-processing, it incurs no additional privacy loss\.

#### Parallel composition over tasks\.

TheTTtask models are trained on disjoint datasets\{𝒟t\}t=1T\\\{\\mathcal\{D\}\_\{t\}\\\}\_\{t=1\}^\{T\}\. Since each private example belongs to at most one task, changing one example affects the training procedure of at most one task\. Therefore, releasing all private task models

\{wtDP\}t=1T\\\{w\_\{t\}^\{\\mathrm\{DP\}\}\\\}\_\{t=1\}^\{T\}satisfies parallel composition\. Hence, the collection of released task models is

\(maxt∈\[T\]⁡εt,maxt∈\[T\]⁡δt\)​\-DP\.\\left\(\\max\_\{t\\in\[T\]\}\\varepsilon\_\{t\},\\,\\max\_\{t\\in\[T\]\}\\delta\_\{t\}\\right\)\\text\{\-DP\}\.When all tasks use the same privacy parameters, this reduces to\(εt,δt\)\(\\varepsilon\_\{t\},\\delta\_\{t\}\)\-DP\.

#### Post\-processing by model merging\.

The final merged model is computed as

wmerge=1T​∑t=1TwtDP\.w\_\{\\mathrm\{merge\}\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}w\_\{t\}^\{\\mathrm\{DP\}\}\.This operation is a deterministic function of the released private task models and does not access any private training example\. Therefore, by the post\-processing property of differential privacy, releasingwmergew\_\{\\mathrm\{merge\}\}incurs no additional privacy loss\. This proves Theorem[C\.1](https://arxiv.org/html/2608.26655#A3.Thmtheorem1)\.

### C\.2Mergeability Analysis

Letwt:=wtDPw\_\{t\}:=w\_\{t\}^\{\\mathrm\{DP\}\}be the private task model returned by Algorithm[1](https://arxiv.org/html/2608.26655#alg1)\. Define

ut:=wt−w0,u¯:=1T​∑s=1Tus,wmerge:=w0\+u¯,u\_\{t\}:=w\_\{t\}\-w\_\{0\},\\qquad\\bar\{u\}:=\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}u\_\{s\},\\qquad w\_\{\\mathrm\{merge\}\}:=w\_\{0\}\+\\bar\{u\},and

Δt:=wmerge−wt=u¯−ut\.\\Delta\_\{t\}:=w\_\{\\mathrm\{merge\}\}\-w\_\{t\}=\\bar\{u\}\-u\_\{t\}\.The average merge gap is

Gmerge:=1T​∑t=1T\(ℒt​\(wmerge\)−ℒt​\(wt\)\)\.G\_\{\\mathrm\{merge\}\}:=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\bigl\(\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\-\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\bigr\)\.
###### Assumption C\.2\(Local third\-order smoothness\)\.

For each tasktt,ℒt\\mathcal\{L\}\_\{t\}is three\-times differentiable along the segment\{wt\+γ​Δt:γ∈\[0,1\]\}\\\{w\_\{t\}\+\\gamma\\Delta\_\{t\}:\\gamma\\in\[0,1\]\\\}\. Define

βt:=supγ∈\[0,1\]λmax​\(∇2ℒt​\(wt\+γ​Δt\)\)\.\\beta\_\{t\}:=\\sup\_\{\\gamma\\in\[0,1\]\}\\lambda\_\{\\max\}\\\!\\left\(\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\+\\gamma\\Delta\_\{t\}\)\\right\)\.The third\-order Taylor remainder satisfies

\|Rt\|≤Mt6​‖Δt‖23\.\|R\_\{t\}\|\\leq\\frac\{M\_\{t\}\}\{6\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{3\}\.

###### Assumption C\.3\(Approximate stationarity\)\.

The returned private model satisfies

‖∇ℒt​\(wt\)‖2≤εt,\\\|\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\\leq\\varepsilon\_\{t\},whereεt\\varepsilon\_\{t\}captures the optimization error, clipping bias, and DP noise\.

###### Theorem C\.4\(Average merge\-gap bound\)\.

Under Assumptions[C\.2](https://arxiv.org/html/2608.26655#A3.Thmtheorem2)and[C\.3](https://arxiv.org/html/2608.26655#A3.Thmtheorem3),

Gmerge≤1T​∑t=1T\[εt​‖Δt‖2\+βt2​‖Δt‖22\+Mt6​‖Δt‖23\]\.G\_\{\\mathrm\{merge\}\}\\leq\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\left\[\\varepsilon\_\{t\}\\\|\\Delta\_\{t\}\\\|\_\{2\}\+\\frac\{\\beta\_\{t\}\}\{2\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{2\}\+\\frac\{M\_\{t\}\}\{6\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{3\}\\right\]\.

###### Proof\.

For each tasktt, apply Taylor’s theorem toℒt\\mathcal\{L\}\_\{t\}atwtw\_\{t\}along the directionΔt=wmerge−wt\\Delta\_\{t\}=w\_\{\\mathrm\{merge\}\}\-w\_\{t\}:

ℒt\(wmerge\)=ℒt\(wt\)\+∇ℒt\(wt\)⊤Δt\+12Δt⊤∇2ℒt\(wt\+γtΔt\)Δt\+Rt\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)=\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\+\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)^\{\\top\}\\Delta\_\{t\}\+\\frac\{1\}\{2\}\\Delta\_\{t\}^\{\\top\}\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\+\\gamma\_\{t\}\\Delta\_\{t\}\)\\Delta\_\{t\}\+R\_\{t\}for someγt∈\[0,1\]\\gamma\_\{t\}\\in\[0,1\]\. Therefore,

ℒt​\(wmerge\)−ℒt​\(wt\)≤‖∇ℒt​\(wt\)‖2​‖Δt‖2\+βt2​‖Δt‖22\+Mt6​‖Δt‖23\.\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\-\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\leq\\\|\\nabla\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\\\|\\Delta\_\{t\}\\\|\_\{2\}\+\\frac\{\\beta\_\{t\}\}\{2\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{2\}\+\\frac\{M\_\{t\}\}\{6\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{3\}\.Using Assumption[C\.3](https://arxiv.org/html/2608.26655#A3.Thmtheorem3)gives

ℒt​\(wmerge\)−ℒt​\(wt\)≤εt​‖Δt‖2\+βt2​‖Δt‖22\+Mt6​‖Δt‖23\.\\mathcal\{L\}\_\{t\}\(w\_\{\\mathrm\{merge\}\}\)\-\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\leq\\varepsilon\_\{t\}\\\|\\Delta\_\{t\}\\\|\_\{2\}\+\\frac\{\\beta\_\{t\}\}\{2\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{2\}\+\\frac\{M\_\{t\}\}\{6\}\\\|\\Delta\_\{t\}\\\|\_\{2\}^\{3\}\.Averaging overt=1,…,Tt=1,\\ldots,Tcompletes the proof\. ∎

### C\.3Reference Anchoring Controls Merging Displacement

Theorem[C\.4](https://arxiv.org/html/2608.26655#A3.Thmtheorem4)shows that the merge gap depends on the displacement‖Δt‖2\\\|\\Delta\_\{t\}\\\|\_\{2\}\. We now show that the reference anchor in DP\-Merging controls this quantity\.

Define the robust loss

Lt,ρt​\(w\):=max‖ϵ‖2≤ρt⁡ℒt​\(w\+ϵ\),L\_\{t,\\rho\_\{t\}\}\(w\):=\\max\_\{\\\|\\epsilon\\\|\_\{2\}\\leq\\rho\_\{t\}\}\\mathcal\{L\}\_\{t\}\(w\+\\epsilon\),and the anchored robust objective

Φt​\(w\):=Lt,ρt​\(w\)\+λ​‖w−w0‖22\.\\Phi\_\{t\}\(w\):=L\_\{t,\\rho\_\{t\}\}\(w\)\+\\lambda\\\|w\-w\_\{0\}\\\|\_\{2\}^\{2\}\.
###### Assumption C\.5\(Approximate stationarity of the anchored robust objective\)\.

For each tasktt, the returned model satisfies

‖∇Lt,ρt​\(wt\)‖2≤Gt,‖∇Φt​\(wt\)‖2≤ζt\.\\\|\\nabla L\_\{t,\\rho\_\{t\}\}\(w\_\{t\}\)\\\|\_\{2\}\\leq G\_\{t\},\\qquad\\\|\\nabla\\Phi\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\\leq\\zeta\_\{t\}\.

###### Lemma C\.6\(Anchor\-induced task\-vector bound\)\.

Under Assumption[C\.5](https://arxiv.org/html/2608.26655#A3.Thmtheorem5),

‖wt−w0‖2≤Gt\+ζt2​λ\.\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}\\leq\\frac\{G\_\{t\}\+\\zeta\_\{t\}\}\{2\\lambda\}\.Consequently, if

At:=Gt\+ζt2​λ,A¯:=1T​∑s=1TAs,A\_\{t\}:=\\frac\{G\_\{t\}\+\\zeta\_\{t\}\}\{2\\lambda\},\\qquad\\bar\{A\}:=\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}A\_\{s\},then

‖Δt‖2≤At\+A¯\.\\\|\\Delta\_\{t\}\\\|\_\{2\}\\leq A\_\{t\}\+\\bar\{A\}\.

###### Proof\.

By definition,

∇Φt​\(wt\)=∇Lt,ρt​\(wt\)\+2​λ​\(wt−w0\)\.\\nabla\\Phi\_\{t\}\(w\_\{t\}\)=\\nabla L\_\{t,\\rho\_\{t\}\}\(w\_\{t\}\)\+2\\lambda\(w\_\{t\}\-w\_\{0\}\)\.Thus,

2​λ​‖wt−w0‖2≤‖∇Φt​\(wt\)‖2\+‖∇Lt,ρt​\(wt\)‖2≤ζt\+Gt,2\\lambda\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}\\leq\\\|\\nabla\\Phi\_\{t\}\(w\_\{t\}\)\\\|\_\{2\}\+\\\|\\nabla L\_\{t,\\rho\_\{t\}\}\(w\_\{t\}\)\\\|\_\{2\}\\leq\\zeta\_\{t\}\+G\_\{t\},which proves the task\-vector bound\. Next,

‖Δt‖2\\displaystyle\\\|\\Delta\_\{t\}\\\|\_\{2\}=‖u¯−ut‖2\\displaystyle=\\\|\\bar\{u\}\-u\_\{t\}\\\|\_\{2\}=‖1T​∑s=1Tus−ut‖2\\displaystyle=\\left\\\|\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}u\_\{s\}\-u\_\{t\}\\right\\\|\_\{2\}≤1T​∑s=1T‖us‖2\+‖ut‖2\\displaystyle\\leq\\frac\{1\}\{T\}\\sum\_\{s=1\}^\{T\}\\\|u\_\{s\}\\\|\_\{2\}\+\\\|u\_\{t\}\\\|\_\{2\}≤A¯\+At\.\\displaystyle\\leq\\bar\{A\}\+A\_\{t\}\.This completes the proof\. ∎

###### Corollary C\.7\(Explicit DP\-Merging merge\-gap bound\)\.

Under Assumptions[C\.2](https://arxiv.org/html/2608.26655#A3.Thmtheorem2),[C\.3](https://arxiv.org/html/2608.26655#A3.Thmtheorem3), and[C\.5](https://arxiv.org/html/2608.26655#A3.Thmtheorem5),

Gmerge≤1T​∑t=1T\[εt​\(At\+A¯\)\+βt2​\(At\+A¯\)2\+Mt6​\(At\+A¯\)3\]\.G\_\{\\mathrm\{merge\}\}\\leq\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\left\[\\varepsilon\_\{t\}\(A\_\{t\}\+\\bar\{A\}\)\+\\frac\{\\beta\_\{t\}\}\{2\}\(A\_\{t\}\+\\bar\{A\}\)^\{2\}\+\\frac\{M\_\{t\}\}\{6\}\(A\_\{t\}\+\\bar\{A\}\)^\{3\}\\right\]\.Ifεt≤ε\\varepsilon\_\{t\}\\leq\\varepsilon,βt≤β\\beta\_\{t\}\\leq\\beta,Mt≤MM\_\{t\}\\leq M,Gt≤GG\_\{t\}\\leq G, andζt≤ζ\\zeta\_\{t\}\\leq\\zetafor alltt, then

Gmerge≤ε​G\+ζλ\+β2​\(G\+ζλ\)2\+M6​\(G\+ζλ\)3\.G\_\{\\mathrm\{merge\}\}\\leq\\varepsilon\\frac\{G\+\\zeta\}\{\\lambda\}\+\\frac\{\\beta\}\{2\}\\left\(\\frac\{G\+\\zeta\}\{\\lambda\}\\right\)^\{2\}\+\\frac\{M\}\{6\}\\left\(\\frac\{G\+\\zeta\}\{\\lambda\}\\right\)^\{3\}\.

###### Proof\.

The first bound follows by substituting Lemma[C\.6](https://arxiv.org/html/2608.26655#A3.Thmtheorem6)into Theorem[C\.4](https://arxiv.org/html/2608.26655#A3.Thmtheorem4)\. For the uniform bound, note that

At\+A¯≤G\+ζ2​λ\+G\+ζ2​λ=G\+ζλ\.A\_\{t\}\+\\bar\{A\}\\leq\\frac\{G\+\\zeta\}\{2\\lambda\}\+\\frac\{G\+\\zeta\}\{2\\lambda\}=\\frac\{G\+\\zeta\}\{\\lambda\}\.Substituting this inequality into the first bound gives the result\. ∎

### C\.4Connection to Joint\-Task Loss Linearity

We further connect the above mergeability analysis to joint\-task loss linearity, following the same style of Hessian\-based arguments commonly used in sharpness\-aware model\-merging analyses\.

For two tasksssandtt, define the joint\-task loss

LJTL​\(w,𝒟s∪𝒟t\):=Ls​\(w\)\+ℒt​\(w\)\.L\_\{\\mathrm\{JTL\}\}\(w;\\mathcal\{D\}\_\{s\}\\cup\\mathcal\{D\}\_\{t\}\):=L\_\{s\}\(w\)\+\\mathcal\{L\}\_\{t\}\(w\)\.Forα∈\[0,1\]\\alpha\\in\[0,1\], define the joint\-task loss linearity gap

δs,t​\(α\):=LJTL​\(α​ws\+\(1−α\)​wt\)−α​LJTL​\(ws\)−\(1−α\)​LJTL​\(wt\)\.\\delta\_\{s,t\}\(\\alpha\):=L\_\{\\mathrm\{JTL\}\}\(\\alpha w\_\{s\}\+\(1\-\\alpha\)w\_\{t\}\)\-\\alpha L\_\{\\mathrm\{JTL\}\}\(w\_\{s\}\)\-\(1\-\\alpha\)L\_\{\\mathrm\{JTL\}\}\(w\_\{t\}\)\.A smaller\|δs,t​\(α\)\|\|\\delta\_\{s,t\}\(\\alpha\)\|means that the interpolation between two task models is closer to being linear on the joint\-task loss landscape\.

###### Theorem C\.8\(Flatness and anchoring imply joint\-task loss linearity\)\.

AssumeLsL\_\{s\}andℒt\\mathcal\{L\}\_\{t\}are locally third\-order smooth aroundwsw\_\{s\}andwtw\_\{t\}, respectively\. Let

λs:=λmax​\(∇2Ls​\(ws\)\),λt:=λmax​\(∇2ℒt​\(wt\)\)\.\\lambda\_\{s\}:=\\lambda\_\{\\max\}\(\\nabla^\{2\}L\_\{s\}\(w\_\{s\}\)\),\\qquad\\lambda\_\{t\}:=\\lambda\_\{\\max\}\(\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\)\.Then

\|δs,t​\(α\)\|≤12​α​\(1−α\)​\(λs\+λt\)​‖ws−wt‖22\+\|Rs,t\|,\|\\delta\_\{s,t\}\(\\alpha\)\|\\leq\\frac\{1\}\{2\}\\alpha\(1\-\\alpha\)\(\\lambda\_\{s\}\+\\lambda\_\{t\}\)\\\|w\_\{s\}\-w\_\{t\}\\\|\_\{2\}^\{2\}\+\|R\_\{s,t\}\|,whereRs,tR\_\{s,t\}collects the third\-order Taylor remainders\. Moreover, under Lemma[C\.6](https://arxiv.org/html/2608.26655#A3.Thmtheorem6),

‖ws−wt‖2≤As\+At,\\\|w\_\{s\}\-w\_\{t\}\\\|\_\{2\}\\leq A\_\{s\}\+A\_\{t\},and therefore

\|δs,t​\(α\)\|≤12​α​\(1−α\)​\(λs\+λt\)​\(As\+At\)2\+\|Rs,t\|\.\|\\delta\_\{s,t\}\(\\alpha\)\|\\leq\\frac\{1\}\{2\}\\alpha\(1\-\\alpha\)\(\\lambda\_\{s\}\+\\lambda\_\{t\}\)\(A\_\{s\}\+A\_\{t\}\)^\{2\}\+\|R\_\{s,t\}\|\.

###### Proof\.

Letv:=wt−ws\.v:=w\_\{t\}\-w\_\{s\}\.First expandLs​\(α​ws\+\(1−α\)​wt\)L\_\{s\}\(\\alpha w\_\{s\}\+\(1\-\\alpha\)w\_\{t\}\)aroundwsw\_\{s\}\. Since

α​ws\+\(1−α\)​wt=ws\+\(1−α\)​v,\\alpha w\_\{s\}\+\(1\-\\alpha\)w\_\{t\}=w\_\{s\}\+\(1\-\\alpha\)v,we have

Ls\(ws\+\(1−α\)v\)=Ls\(ws\)\+\(1−α\)∇Ls\(ws\)⊤v\+12\(1−α\)2v⊤∇2Ls\(ws\)v\+Rs\.L\_\{s\}\(w\_\{s\}\+\(1\-\\alpha\)v\)=L\_\{s\}\(w\_\{s\}\)\+\(1\-\\alpha\)\\nabla L\_\{s\}\(w\_\{s\}\)^\{\\top\}v\+\\frac\{1\}\{2\}\(1\-\\alpha\)^\{2\}v^\{\\top\}\\nabla^\{2\}L\_\{s\}\(w\_\{s\}\)v\+R\_\{s\}\.Similarly,

Ls\(wt\)=Ls\(ws\)\+∇Ls\(ws\)⊤v\+12v⊤∇2Ls\(ws\)v\+Rs′\.L\_\{s\}\(w\_\{t\}\)=L\_\{s\}\(w\_\{s\}\)\+\\nabla L\_\{s\}\(w\_\{s\}\)^\{\\top\}v\+\\frac\{1\}\{2\}v^\{\\top\}\\nabla^\{2\}L\_\{s\}\(w\_\{s\}\)v\+R\_\{s\}^\{\\prime\}\.Substituting these two expansions into

δs:=Ls​\(α​ws\+\(1−α\)​wt\)−α​Ls​\(ws\)−\(1−α\)​Ls​\(wt\)\\delta\_\{s\}:=L\_\{s\}\(\\alpha w\_\{s\}\+\(1\-\\alpha\)w\_\{t\}\)\-\\alpha L\_\{s\}\(w\_\{s\}\)\-\(1\-\\alpha\)L\_\{s\}\(w\_\{t\}\)gives

δs=−12​α​\(1−α\)​v⊤​∇2Ls​\(ws\)​v\+Rs−\(1−α\)​Rs′\.\\delta\_\{s\}=\-\\frac\{1\}\{2\}\\alpha\(1\-\\alpha\)v^\{\\top\}\\nabla^\{2\}L\_\{s\}\(w\_\{s\}\)v\+R\_\{s\}\-\(1\-\\alpha\)R\_\{s\}^\{\\prime\}\.Repeating the same argument forℒt\\mathcal\{L\}\_\{t\}aroundwtw\_\{t\}gives

δt=−12​α​\(1−α\)​v⊤​∇2ℒt​\(wt\)​v\+Rt−α​Rt′\.\\delta\_\{t\}=\-\\frac\{1\}\{2\}\\alpha\(1\-\\alpha\)v^\{\\top\}\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)v\+R\_\{t\}\-\\alpha R\_\{t\}^\{\\prime\}\.Therefore,

δs,t​\(α\)=−12​α​\(1−α\)​v⊤​\(∇2Ls​\(ws\)\+∇2ℒt​\(wt\)\)​v\+Rs,t,\\delta\_\{s,t\}\(\\alpha\)=\-\\frac\{1\}\{2\}\\alpha\(1\-\\alpha\)v^\{\\top\}\\left\(\\nabla^\{2\}L\_\{s\}\(w\_\{s\}\)\+\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)\\right\)v\+R\_\{s,t\},where

Rs,t:=Rs−\(1−α\)​Rs′\+Rt−α​Rt′\.R\_\{s,t\}:=R\_\{s\}\-\(1\-\\alpha\)R\_\{s\}^\{\\prime\}\+R\_\{t\}\-\\alpha R\_\{t\}^\{\\prime\}\.Using

v⊤​∇2Ls​\(ws\)​v≤λs​‖v‖22,v⊤​∇2ℒt​\(wt\)​v≤λt​‖v‖22,v^\{\\top\}\\nabla^\{2\}L\_\{s\}\(w\_\{s\}\)v\\leq\\lambda\_\{s\}\\\|v\\\|\_\{2\}^\{2\},\\qquad v^\{\\top\}\\nabla^\{2\}\\mathcal\{L\}\_\{t\}\(w\_\{t\}\)v\\leq\\lambda\_\{t\}\\\|v\\\|\_\{2\}^\{2\},we obtain

\|δs,t​\(α\)\|≤12​α​\(1−α\)​\(λs\+λt\)​‖v‖22\+\|Rs,t\|\.\|\\delta\_\{s,t\}\(\\alpha\)\|\\leq\\frac\{1\}\{2\}\\alpha\(1\-\\alpha\)\(\\lambda\_\{s\}\+\\lambda\_\{t\}\)\\\|v\\\|\_\{2\}^\{2\}\+\|R\_\{s,t\}\|\.Finally,

‖ws−wt‖2=‖\(ws−w0\)−\(wt−w0\)‖2≤‖ws−w0‖2\+‖wt−w0‖2≤As\+At,\\\|w\_\{s\}\-w\_\{t\}\\\|\_\{2\}=\\\|\(w\_\{s\}\-w\_\{0\}\)\-\(w\_\{t\}\-w\_\{0\}\)\\\|\_\{2\}\\leq\\\|w\_\{s\}\-w\_\{0\}\\\|\_\{2\}\+\\\|w\_\{t\}\-w\_\{0\}\\\|\_\{2\}\\leq A\_\{s\}\+A\_\{t\},where the last inequality follows from Lemma[C\.6](https://arxiv.org/html/2608.26655#A3.Thmtheorem6)\. This proves the theorem\. ∎

#### Interpretation\.

Theorem[C\.8](https://arxiv.org/html/2608.26655#A3.Thmtheorem8)shows that DP\-Merging improves joint\-task loss linearity through the same two geometric mechanisms that improve mergeability\. The sharpness\-aware component reduces the dominant Hessian eigenvaluesλs\\lambda\_\{s\}andλt\\lambda\_\{t\}, while the reference anchor reduces the distance‖ws−wt‖2\\\|w\_\{s\}\-w\_\{t\}\\\|\_\{2\}between task models\. Together, they reduce the joint\-task loss linearity gap, which corresponds to weaker parameter interference during model merging\.

## Appendix DLimitations and Future Work

While our DP\-Merging and multi\-task strategies demonstrate consistent improvements across vision and NLP benchmarks, several limitations remain\. First, the effectiveness of parameter merging depends on task\-specific compatibility, and its performance on highly heterogeneous tasks or models with substantially different architectures is not fully explored\. Second, the experiments are limited to standard benchmarks and mid\- to large\-scale models \(ViT\-L/14, RoBERTa\-Large\), leaving the applicability to larger models or more complex, real\-world datasets untested\. Third, while average scores demonstrate clear overall gains, individual task performance can vary, with some tasks showing only marginal improvements or slight declines, highlighting the need for more task\-specific analysis\.

Future work includes developing adaptive merging strategies that account for task similarity and parameter sensitivity, extending the approach to larger and more diverse model architectures, and exploring dynamic task balancing and uncertainty\-aware weighting mechanisms during training to improve stability and consistency across tasks\.