Technical Summary: TIGER – Inverting Transformer Gradients via Embedding-Subspace Distance Optimization

Problem Statement

Federated Learning (FL) enables collaborative training of shared models while keeping raw client data local. However, gradient inversion attacks have demonstrated that model updates (gradients) can leak sufficient information to reconstruct private client inputs. While these attacks have been successful on image data, reconstructing text from Transformer-based Large Language Models (LLMs) remains challenging.

Existing text inversion methods face significant limitations in realistic FL settings:

1. Optimization-based approaches: Methods that optimize dummy inputs to match full gradients are computationally expensive and unstable for modern models, particularly with large batch sizes.
2. Subspace-based approaches: Prior work (e.g., DAGER) exploits the low-rank structure of Transformer linear-layer gradients to identify a subspace containing true layer embeddings. However, these methods rely on discrete membership tests (checking if candidate tokens lie in the subspace). This approach is brittle under numerical noise (e.g., from quantization or Differential Privacy) and scales poorly for encoder models with non-causal attention, where sequential token recovery is impossible.

Consequently, existing attacks often fail or underestimate privacy risks in defended FL environments involving large batches, quantized gradients, or noise.

Methodology: TIGER

The authors introduce TIGER (Transformer Data Inversion from Gradients via Embedding-subspace Reconstruction), a continuous gradient inversion attack that transforms the subspace signal into a differentiable objective. Instead of searching over discrete tokens or matching full gradients, TIGER directly optimizes continuous token embeddings to minimize their distance to the gradient-induced subspaces.

Core Mechanism

TIGER leverages the observation that for a linear layer in a Transformer, the row span of the layer inputs coincides with the column space of the corresponding weight gradient (under mild rank conditions).

• Subspace Signal: Given observed gradients $\frac{\partial \mathcal{L}}{\partial W^l_Q}$, the attacker computes the column span $S_l$.
• Continuous Objective: Rather than testing discrete candidates, TIGER optimizes a continuous raw input embedding matrix $\bar{Z}_0$. The goal is to ensure that the hidden states $\bar{Z}_l$ induced by the forward pass align with the observed subspaces $S_l$.
• Loss Function: The primary objective is a forward span-distance loss ($\ell_{forw}$), which minimizes the squared distance between normalized recovered hidden states and their projection onto the gradient-induced subspace.

Architecture-Specific Adaptations

TIGER employs distinct strategies for decoder-only and encoder-only models:

1. Decoder-Only Models (Causal):

   • Exploits causal attention masks to recover tokens sequentially (token-by-token).
   • Since the representation at position $i$ depends only on preceding tokens, the attack optimizes embeddings one by one.
   • Deduplication: To prevent multiple sequences in a batch from collapsing to the same first token, a deduplication loss ($\ell_{dedup}$) is added. This penalizes the current first-token embedding if it aligns with the subspace already occupied by previously recovered first tokens in the batch.

2. Encoder-Only Models (Non-Causal):

   • Causal sequential recovery is infeasible because all tokens in a sequence are interdependent.
   • TIGER performs joint optimization of the entire batch's raw embeddings.
   • Bidirectional Alignment: To prevent degenerate solutions (e.g., all recovered tokens collapsing to a single direction), TIGER introduces a backward span-distance loss ($\ell_{back}$). This loss enforces that the gradient-induced basis directions must also lie within the span of the recovered hidden states. This ensures the recovered batch covers the full observed subspace, discouraging repeated-token or duplicate-sequence solutions.

Initialization and Optimization

• Initialization: TIGER uses a position-dependent Gaussian prior fitted to a large corpus (e.g., WikiText) to initialize embeddings, providing a strong starting point for the non-convex optimization.
• Optimization: The attack runs multiple independent optimizations ($N_{init}$) with different initializations, using Adam optimization to minimize the span-distance loss.
• Discretization: After continuous optimization converges, recovered embeddings are projected to the nearest vocabulary token via cosine similarity.

Key Contributions

1. TIGER Attack: A robust, scalable, continuous gradient inversion attack for Transformer LLMs that recovers private text across challenging settings (large batches, quantized gradients, DP noise).
2. Differentiable Subspace Objective: A novel formulation that converts low-rank gradient structure into a differentiable embedding-subspace objective. This avoids brittle discrete filtering and extends to encoder-only models via a bidirectional alignment loss.
3. Comprehensive Evaluation: Extensive experiments on modern models (GEMMA-3-4B-IT and EMBEDDINGGEMMA-300M) demonstrating that TIGER substantially outperforms prior attacks in defended and encoder-only settings while remaining competitive in undefended decoder settings.
4. Open Source: An open-source implementation to facilitate future research on privacy risks and defenses.

Experimental Results

The authors evaluated TIGER on WikiText batches with varying batch sizes, sequence lengths, and defense levels (gradient noise and quantization), measuring performance via ROUGE-1 and ROUGE-L.

• Robustness to Noise (Decoder): In undefended settings, TIGER is competitive with or slightly outperforms DAGER. However, under Differential Privacy-style gradient noise ($\sigma = 10^{-3}$), DAGER collapses to near-zero reconstruction quality, whereas TIGER maintains meaningful recovery (ROUGE-1 > 70%).
• Encoder Performance: On encoder-only models, where causal recovery is impossible, TIGER achieves a ROUGE-1 of ~60% on batches of 16 sequences, significantly outperforming prior optimization-based attacks (e.g., LAMP).
• Quantization: TIGER remains effective under BF16 precision, whereas DAGER fails completely due to the unreliability of its threshold-based discrete tests.
• Scalability: TIGER scales to longer sequences and larger batch sizes more effectively than prior methods, particularly in encoder settings.

Significance and Claims

The paper claims that TIGER reveals significant privacy vulnerabilities in Transformer LLMs that were previously underestimated.

• Resilience of Gradients: The study demonstrates that transformer gradients retain substantial textual information even after common perturbations like additive noise (DP) or reduced numerical precision (quantization).
• Limitations of Current Defenses: The results suggest that modest gradient noise or lower-precision computation should not be assumed to eliminate reconstruction risks.
• Broader Threat: By enabling successful reconstructions in settings where prior attacks fail (large batches, encoders, defended settings), TIGER expands the practical threat landscape of gradient inversion, highlighting the need for carefully evaluated and applied privacy defenses in federated learning deployments.

The authors note limitations, specifically that the attack relies on the low-rank structure of gradients, which diminishes when the total number of tokens exceeds the hidden dimension. They also acknowledge that while TIGER recovers substantial content, it does not always produce an exact ordered reconstruction, suggesting potential for hybrid approaches combining continuous subspace recovery with discrete refinement.