💻 computer science

FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs

This paper introduces FedSpy-LLM, a scalable and generalizable attack framework that leverages a novel gradient decomposition strategy to reconstruct private training data from federated learning gradients, effectively overcoming limitations in batch size, sequence length, and model architecture—including those using Parameter-Efficient Fine-Tuning (PEFT).

Original authors: Syed Irfan Ali Meerza, Feiyi Wang, Jian Liu

Published 2026-04-09

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Syed Irfan Ali Meerza, Feiyi Wang, Jian Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you and your friends are trying to solve a giant jigsaw puzzle together, but you live in different cities. To work together without sending the actual puzzle pieces (which might contain your private photos), you each send a tiny, blurry sketch of how your piece should fit. This is Federated Learning: a way for computers to learn together without sharing their private data.

Usually, we think these blurry sketches are safe. But this paper, FEDSPY-LLM, reveals a scary secret: Those sketches are actually detailed enough to rebuild your entire puzzle.

Here is the story of how they did it, explained simply:

1. The Problem: The "Blurry Sketch" is Too Clear

In the past, hackers could only guess a few words from these sketches, and only if the group was small. But modern AI (Large Language Models) is huge, and to make it run faster on personal devices, we use a trick called PEFT (Parameter-Efficient Fine-Tuning). Think of PEFT as only painting the edges of the puzzle pieces instead of the whole thing.

The researchers found that even with these "edge-only" updates, the sketches (gradients) still leaked enough information to reconstruct long sentences, large groups of people, and complex medical records. Previous hacking tools were like trying to guess a whole novel by looking at a single letter; they failed when the text got long or the group got big.

2. The Solution: FEDSPY-LLM (The "Super Detective")

The authors built a new tool called FEDSPY-LLM. Imagine a detective who doesn't just guess; they use a special set of rules to solve the mystery. Here are their three main tricks:

Trick A: The "Subspace Map" (Finding the Right Room)

Imagine the puzzle pieces are floating in a giant, dark warehouse. Most of the warehouse is empty space. The researchers realized that the "blurry sketches" only exist in a specific, narrow hallway within that warehouse.

The Analogy: Instead of searching the whole dark warehouse for the right piece, FEDSPY-LLM shines a flashlight only down that specific hallway. This makes finding the right words (tokens) incredibly fast and accurate, even if there are thousands of people (a large batch size) working on the puzzle at once.

Trick B: The "Noise Filter" (Ignoring the Static)

When using the "edge-only" painting trick (PEFT), the signal is very quiet and full of static noise. It's like trying to hear a whisper in a windstorm.

The Analogy: FEDSPY-LLM uses a special filter (called Null Space Regularization) that acts like noise-canceling headphones. It ignores the "wind" (the parts of the sketch that don't matter) and focuses only on the "whisper" (the actual data). This allows it to hear the secret words even when the signal is very weak.

Trick C: The "Sentence Re-Orderer" (Fixing the Scramble)

Sometimes, the tool finds all the right words but puts them in the wrong order. Imagine finding the words "Dog," "Bites," and "Man." The tool might guess "Man Bites Dog" instead of "Dog Bites Man." Both sentences use the same words, but the meaning is totally different.

The Analogy: FEDSPY-LLM has a final step called Sequence Order Calibration. It acts like a grammar police officer. It tests every possible order of the words against the original "blurry sketch." It asks, "Does 'Dog Bites Man' fit the sketch better than 'Man Bites Dog'?" It keeps the order that fits best, ensuring the reconstructed sentence makes perfect sense.

3. The Results: A Wake-Up Call

The researchers tested this new tool on many different types of AI models (some that read, some that write, some that do both) and found that:

It works on huge groups: It can steal data from 128 people at once, whereas old tools failed with just 8.
It works on long stories: It can reconstruct long paragraphs, not just short phrases.
It works even with the "edge-only" trick: It breaks the privacy of the efficient PEFT method.

The Big Takeaway

Think of FEDSPY-LLM as a master locksmith who found a way to pick the lock on a "secure" vault that everyone thought was unbreakable.

The paper concludes that Federated Learning is not as private as we thought. Just because you don't send your raw data doesn't mean it's safe. The "mathematical fingerprints" (gradients) you send are still detailed enough for a smart attacker to rebuild your private conversations, medical records, or legal documents.

The Lesson: We need to build better locks (stronger privacy defenses) before we trust these systems with our most sensitive secrets.

1. Problem Statement

Federated Learning (FL) combined with Parameter-Efficient Fine-Tuning (PEFT) is widely adopted to train Large Language Models (LLMs) while preserving data privacy. However, this architecture remains vulnerable to Gradient Inversion Attacks (GIA), where an adversary (e.g., an honest-but-curious server) reconstructs private client training data from shared gradients.

Existing data reconstruction attacks face critical limitations in the context of modern LLMs:

Scalability: Most prior methods (e.g., DLG, TAG, LAMP) fail to scale beyond small batch sizes (1–8) and short sequences due to the non-convex optimization landscape and the entanglement of token information.
PEFT Sparsity: PEFT methods (like LoRA and Adapters) update only a small subset of parameters, resulting in sparse gradients. This sparsity creates a large "null space," making it difficult for traditional attacks to distinguish true token embeddings from noise.
Architectural Generalization: Many attacks are tailored to specific architectures (e.g., encoder-only vs. decoder-only) and fail to generalize across diverse LLM structures (Encoder, Decoder, Encoder-Decoder).
Sequence Order Recovery: Recovering the correct order of tokens is difficult because positional embeddings are often frozen in FL, and gradients average over the batch, obscuring positional cues.

2. Methodology: FEDSPY-LLM

The authors propose FEDSPY-LLM, a scalable and generalizable attack framework designed to overcome the above challenges. The method consists of three core components:

A. Gradient Subspace Guidance (Token Recovery)

Theoretical Basis: The authors leverage the observation that LLM gradients are inherently low-rank. Specifically, the input embedding vectors lie within the column span of the gradient matrix (Theorem 2).
Mechanism: Instead of searching the entire high-dimensional embedding space, the attack projects candidate dummy embeddings onto the column space of the gradient matrix (specifically from the first attention layer's query matrix).
Benefit: This constrains the optimization search to a low-dimensional subspace, significantly improving convergence speed and enabling the handling of larger batch sizes and longer sequences.

B. Null Space Regularization (Handling PEFT)

Challenge: In PEFT, the gradient matrix has a very low rank ( $r \ll d$ ), creating a large null space where many different embeddings produce identical gradients, leading to ambiguity.
Solution: FEDSPY-LLM introduces a null space regularization term. It computes the null space of the gradient matrix and adds a penalty to the loss function for any deviation of the reconstructed embedding into this null space.
Effect: This forces the reconstructed embeddings to remain close to the true embeddings by discouraging deviations in unconstrained dimensions, effectively mitigating the ambiguity caused by sparse PEFT gradients.

C. Sequence Order Calibration

Challenge: The token recovery phase yields a set of correct tokens but in a random order.
Solution: The authors propose an iterative Sequence Order Calibration phase.
- It leverages the intuition that the gradient of a correctly ordered partial sequence is more aligned with the full-sequence gradient than a misordered one.
- The algorithm iteratively assigns tokens to positions by computing the cosine similarity between the isolated gradient of a candidate token at a specific position and the full-sequence gradient.
- The token with the highest alignment is fixed, and the process repeats for the next position.

D. Loss Function

The attack optimizes a composite loss function:
$L_{FEDSPY-LLM} = L_{rec} + \gamma L_{dis} + \eta \|P_N x^*_i\|^2$

$L_{rec}$ : Weighted layer-wise cosine similarity between true and dummy gradients.
$L_{dis}$ : Projection distance loss ensuring the dummy embedding lies within the gradient column span.
$\|P_N x^*_i\|^2$ : Null space penalty (used when PEFT is active).

3. Key Contributions

Scalability: FEDSPY-LLM successfully reconstructs data from batches up to 128 and long sequences, a significant improvement over prior methods that degrade at batch sizes >8.
PEFT Resilience: It is the first method to effectively reconstruct data from PEFT gradients (LoRA, Adapters) by utilizing null space regularization to handle gradient sparsity.
Architecture Agnosticism: The method works across Encoder (BERT), Decoder (GPT-2, Llama), and Encoder-Decoder (T5) architectures without relying on architecture-specific features like Pooler layers.
Sequence Recovery: It introduces a novel mechanism to recover the correct token ordering, addressing a major gap in previous text reconstruction attacks.
Robustness: The attack remains effective even under privacy defenses like Gradient Clipping and Differential Privacy (DP), though performance degrades as expected.

4. Experimental Results

The authors evaluated FEDSPY-LLM on diverse models (BERTBase, GPT-2, Llama-7B/13B/70B, T5base) and datasets (CoLA, Rotten Tomatoes, MIMIC-III).

Performance vs. Baselines: FEDSPY-LLM consistently outperformed state-of-the-art baselines (DLG, TAG, LAMP, FILM, DAGER).
- On Batch Size 8, it showed a 55%–160% improvement in ROUGE scores for classification tasks and a 250% increase for next-word prediction compared to the best baselines.
- At Batch Size 128, while DAGER and other search-based methods collapsed (ROUGE scores dropped to near zero), FEDSPY-LLM maintained strong reconstruction quality.
PEFT Performance: Under PEFT (SLoRA, FedAdapter), baselines struggled significantly. FEDSPY-LLM reconstructed subsequences 17%–28% longer than the best baselines.
Sequence Order: Ablation studies confirmed that the Sequence Order Calibration phase dramatically improved ROUGE-2 and ROUGE-L scores (measuring bigram and sequence structure) while maintaining ROUGE-1 (unigram) scores.
Model Size: The attack remained effective across model sizes from 7B to 70B parameters, with larger models sometimes aiding reconstruction due to stronger gradient signals.
Privacy Defenses: Even with Gaussian noise ( $\sigma=10^{-5}$ ) and gradient clipping ( $\epsilon=0.3$ ), FEDSPY-LLM recovered substantial portions of the text, significantly outperforming other attacks.

5. Significance

Privacy Risk Assessment: The paper demonstrates that the combination of FL and PEFT, often touted as a privacy-preserving solution, does not provide sufficient protection against sophisticated gradient inversion attacks.
Scalability Gap: It highlights a critical gap in current privacy defenses; as LLMs move toward larger batch sizes and PEFT for efficiency, existing privacy mechanisms are insufficient.
Call to Action: The findings underscore the urgent need for more robust privacy-preserving techniques (beyond simple gradient masking) for federated LLMs, as current methods fail to prevent the leakage of sensitive private data (e.g., medical records, personal sentiments) even under constrained settings.

In conclusion, FEDSPY-LLM represents a significant advancement in the understanding of privacy vulnerabilities in LLMs, proving that gradient leakage remains a severe threat even in the era of parameter-efficient and federated training.