Research map / Federated learning and privacy / Privacy attacks and secure learning

Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning

NeurIPS 2026 · Federated learning and privacy › Privacy attacks and secure learning · approach: Gradient inversion attacks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes PromptMIA, an active membership inference attack in which a malicious server injects adversarially crafted soft prompts (keys) into a federated prompt-tuning pool so that clients select and update them only when a target sample is present.

Problem

Membership inference against federated prompt-tuning, where clients exchange soft prompts and keys rather than gradients or full weights, an attack surface that existing federated MIAs do not exploit.

Approach

A malicious server crafts adversarial keys with cosine similarity to the target query slightly above the best benign key (within a controlled interval), so that the adversarial prompts are always selected and updated iff the target is in a client's data; membership is read from which prompts change in a single round, with theoretical TPR=1 and an FPR bound via a Gaussian mixture query model.

Key results

• PromptMIA achieves near-perfect attack success rate across models and datasets at small batch sizes and maintains >90% ASR and advantage at larger batch sizes.
• Naive prompt injection collapses with batch size, reaching advantage of only about 20% on the 4-dataset pool at batch size 256.
• Input noise perturbation at epsilon=3 reduces CIFAR-100 accuracy from 0.78 to 0.50, while epsilon=5 or 8 leaves PromptMIA largely effective; prompt dropout still leaves ASR above 75%.

Surprising findings

• Regularization-based MIA defenses (gradient sparsification, MixUp, data augmentation) remain ineffective against PromptMIA because it does not rely on overfitting.
• The attack is more effective on partially trained models than on randomly initialized keys.

Limitations

• Theoretical FPR bound relies on assumptions (benign keys as GMM centroids, spherical Gaussian queries) that are approximations.
• Defenses such as secure aggregation and deep anomaly detection were not fully evaluated; the paper defers them to future work.
• Experiments limited to image classification with ViT-style backbones and a 4-dataset pool constructed by the authors.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 TinyImageNet MNIST-M Fashion-MNIST CINIC-10 MMAFEDB

Benchmarks: CIFAR-10 CIFAR-100 TinyImageNet 4-dataset pool

Metrics: attack advantage attack success rate precision recall F1 TPR FPR

Baselines: Blackbox-Loss Loss-Series FedMIA-I Grad-Cosine IsolationForest LocalOutlierFactor OneClassSVM EllipticEnvelope

Builds on: Learning to Prompt (L2P) FedMIA FedAvg DP-SGD

Closest papers by meaning

• FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning (CVPR 2025 · similarity 0.91)
• FLiP: Towards Comprehensive and Reliable Evaluation of Federated Prompt Learning (NeurIPS 2025 · similarity 0.88)
• Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models (ICML 2025 · similarity 0.87)
• Attribute Inference Attacks for Federated Regression Tasks (AAAI 2025 · similarity 0.86)
• Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.86)
• Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning (CVPR 2025 · similarity 0.85)