Research map / Federated learning and privacy / Privacy attacks and secure learning
DAGER: Exact Gradient Inversion for Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DAGER, a search-based gradient inversion attack that exactly recovers whole text batches (up to 128) from self-attention weight gradients of LLMs in the honest-but-curious FedSGD setting.
Problem
Gradient inversion attacks on text in federated learning are approximate and limited to small batches and short sequences, and do not scale to modern decoder LLMs.
Approach
Self-attention projection gradients are low-rank and linear combinations of input embeddings when batch tokens are fewer than the hidden dimension, so a span check on the gradient column space identifies which vocabulary tokens are in the client batch; decoders use causal masks for greedy prefix extension, encoders use heuristic exhaustive search.
Key results
- On GPT-2 with B=16 to 32 on CoLA, SST-2 and RT, DAGER reaches ROUGE-1/2 of 100 where TAG and LAMP reach far lower values, with 100 batches of size 8 on RT taking 3.5 hours vs about 10 and 50 hours for TAG and LAMP.
- On LLaMa-2 (7B) DAGER achieves near-perfect reconstruction at batch size 128 (e.g., ROUGE-1 99.5 on CoLA), while GPT-2 fails at B=64-128.
- On ECHR with B=1 and 512 tokens, DAGER gets ROUGE-1/2 of 100 on GPT-2 BASE, versus 10.1 ROUGE-1 for LAMP.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DAGER instead of LAMP | GPT-2 · CoLA, B=8 | ROUGE-1: 8.9\pm1.2 -> 100.0\pm0.0 | Helped |
| Use DAGER instead of LAMP | GPT-2 · SST-2, B=8 | ROUGE-1: 8.1\pm1.1 -> 100.0\pm0.0 | Helped |
| Use DAGER instead of LAMP | GPT-2 · Rotten Tomatoes, B=8 | ROUGE-1: 6.8\pm0.7 -> 100.0^{+0.0}_{-0.1} | Helped |
| Use DAGER instead of LAMP | BERT · CoLA, B=8 | ROUGE-2: 13.1\pm1.9 -> 48.8\pm4.5 | Helped |
| Use DAGER instead of LAMP | BERT · SST-2, B=8 | ROUGE-2: 19.1\pm2.8 -> 59.8\pm2.9 | Helped |
| Use DAGER instead of LAMP | BERT · Rotten Tomatoes, B=8 | ROUGE-2: 2.0\pm0.6 -> 11.4\pm1.3 | Helped |
| Apply rank-threshold heuristic when gradients are full rank (ablation) | DAGER on GPT-2 · CoLA, B=128 | ROUGE-1: 0 -> 30.3 | Helped |
| Increase model embedding dimension from GPT-2 to LLaMa-2 (7B) | DAGER · CoLA, B=128 | ROUGE-1: 30.3\pm1.0 -> 99.5\pm0.2 | Helped |
| Increase batch size to 128 on GPT-2 | DAGER · Rotten Tomatoes | ROUGE-1: 100.0\pm0.0 -> 0.0\pm0.0 | Hurt |
| Use larger GPT-2 LARGE instead of GPT-2 BASE | DAGER · Rotten Tomatoes, B=64 | ROUGE-1: 2.8\pm1.1 -> 44.1\pm4.2 | Helped |
| Use next-token prediction setting | DAGER on GPT-2 · Rotten Tomatoes, B=32 | ROUGE-1: 98.0\pm1.7 -> 99.6^{+0.3}_{-0.9} | Helped |
| Increase FedAvg learning rate from 10^{-4} to 5\times10^{-4} (ablation) | DAGER on GPT-2 · Rotten Tomatoes, batch size 16 | ROUGE-1: 95.4\pm1.6 -> 84.2\pm1.8 | Hurt |
Surprising findings
- GPT-2 BASE reconstruction collapses at B=64 and 128 on SST-2 and RT, while LLaMa-2 7B remains near-perfect, suggesting larger embedding dimension increases leakage.
- Binary classification (sentiment) losses, usually considered less vulnerable, are fully attackable by DAGER without label priors.
Limitations
- Encoder attack relies on heuristics and exhaustive search that becomes infeasible for large batches (B>>8) and long sequences.
- Exact recovery degrades when total tokens approach or exceed the embedding dimension d, as on GPT-2 at B=64-128.
- Evaluated only in the honest-but-curious setting without defenses such as DPSGD.
Experimental setup
Datasets: CoLA SST-2 Rotten Tomatoes ECHR
Benchmarks: CoLA SST-2 Rotten Tomatoes ECHR
Metrics: ROUGE-1 ROUGE-2 runtime
Baselines: TAG LAMP
Builds on: Dr. Aduenko-style exact linear-layer gradient inversion (Fowl et al.) TAG LAMP FedSGD FedAvg LoRA
Closest papers by meaning
- SPEAR: Exact Gradient Inversion of Batches in Federated Learning (NeurIPS 2024 · similarity 0.89)
- GRAIN: Exact Graph Reconstruction from Gradients (ICLR 2025 · similarity 0.87)
- Recovering Labels from Local Updates in Federated Learning (ICML 2024 · similarity 0.85)
- Thinking Forward: Memory-Efficient Federated Finetuning of Language Models (NeurIPS 2024 · similarity 0.85)
- Gradient Inversion of Multimodal Models (ICML 2025 · similarity 0.85)
- DEPT: Decoupled Embeddings for Pre-training Language Models (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.