Research map / Federated learning and privacy / Privacy attacks and secure learning

Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning

CVPR 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Gradient inversion attacks · 6 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that a malicious server who poisons a frozen ViT backbone and adapter modules can reconstruct a large fraction of a victim's local fine-tuning images from adapter gradients alone (PEFTLeak).

Problem

Gradient inversion attacks have been shown on full fine-tuning in federated learning, but it was unknown whether private fine-tuning images can be recovered when only lightweight adapter gradients are shared in parameter-efficient fine-tuning.

Approach

Malicious design of the frozen pretrained ViT (identity-like MSA/MLP/LayerNorm) and adapter biases/weights lets patches from each target position pass through specific adapter neurons, so patch embeddings can be recovered from adapter weight/bias gradients across multiple adapter layers, with multi-round attacks for small bottlenecks.

Key results

• On CIFAR-100 with a batch of 32 images, 110 of 128 patches (85.9%) are recovered with ViT-B/16 and r=64 adapters.
• On TinyImageNet with batch 32, about 81% of the 512 patches are recovered.
• With batch size 128 on CIFAR-100, up to 72.6% of patches are recovered; with r=8, the full image is recovered over 5 training rounds.

Measured effects reported in the paper

Surprising findings

• Reducing the adapter bottleneck dimension does not guarantee privacy, since multi-round attacks recover full images even at r=8.
• PEFT, often viewed as a privacy-enhancing choice, does not defend against gradient inversion when the server is malicious.

Limitations

• Assumes a malicious server that can modify the pretrained model and adapter parameters, and the attacker needs public data to estimate patch statistics.
• Reconstruction is patch-wise and not complete; at larger batch sizes the recovery rate drops (72.6% at batch 128).
• Evaluated only on ViT-B/16 with adapter-based PEFT; other PEFT methods (LoRA, prefix-tuning) are not attacked.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 TinyImageNet ImageNet

Benchmarks: CIFAR-10 CIFAR-100 TinyImageNet ImageNet

Metrics: MSE LPIPS SSIM percentage of patches recovered

Baselines: Gradient inversion attack from Zhu et al. (DLG) Fowl et al. FFT ViT attack

Builds on: Fishing for user data in large-batch federated learning (Wen et al.) Breaking FL with imprint modules (Fowl et al.) Gradient inversion via gradient matching (Zhu et al.) Adapter modules for parameter-efficient transfer learning (Houlsby et al.)

Closest papers by meaning

• Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.89)
• A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.89)
• Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspective (AAAI 2024 · similarity 0.88)
• High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.87)
• Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.87)
• DictPFL: Efficient and Private Federated Learning on Encrypted Gradients (NeurIPS 2025 · similarity 0.86)