🤖 AI

MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning

This paper introduces MineGrad, an analytical gradient inversion attack that enables a malicious server to reconstruct high-fidelity private user data from LoRA fine-tuning gradients by leveraging a poisoned pretrained model, effectively exposing critical privacy vulnerabilities in parameter-efficient federated learning across both language and vision tasks.

Original authors: Hasin Us Sami, Swapneel Sen, Basak Guler

Published 2026-08-04

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Hasin Us Sami, Swapneel Sen, Basak Guler

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where giant, super-smart computers (called AI models) are so huge that no single person can carry them in their pocket. To make them useful for everyone, scientists let these models "learn" from data sitting on your phone or laptop without ever actually seeing that data. This is like having a master chef who sends you a basic recipe book, and you tweak the instructions slightly using your own secret family ingredients, then just send the tiny changes back to the chef. This method, called "federated learning" with "LoRA," is supposed to be a privacy superpower: the chef gets smarter, but your secret ingredients stay hidden in your kitchen.

But what if the chef isn't just a chef? What if the chef is a sneaky spy who sent you a slightly tampered recipe book in the first place? This paper explores a scary possibility: that a malicious server (the "chef") could trick your device into spilling its secrets back through the tiny changes you send. The researchers found that by carefully poisoning the initial recipe and the tools used to make changes, the server can mathematically reverse-engineer your private data—like your text messages or photos—just by looking at the "gradient" (the list of tiny adjustments) you sent back. It's a reminder that even when you think you're only sharing a few crumbs, a clever adversary might be able to reconstruct the whole cake.

The Paper's Big Discovery: "MineGrad"

The authors of this paper, Hasin Us Sami, Swapneel Sen, and Ba¸sak Guler, introduce a new attack they call MineGrad. Think of it as a high-tech treasure hunt where the "treasure" is your private data, and the "map" is hidden inside the tiny updates you send to the server.

In the past, researchers knew that if you sent back all the changes to a giant model, a bad actor could sometimes guess your data. But with LoRA (Low-Rank Adaptation), you only send a tiny, compressed version of the changes. Scientists thought this small size made it much harder to steal data. They also thought that if the data was too big (like a long sentence or a whole image), the math wouldn't work to steal it back.

MineGrad shatters those assumptions. The researchers showed that a malicious server can still steal your data, even when you only send those tiny LoRA updates, and even when you have long sentences or complex images.

Here is how the "heist" works, using a simple analogy:

The Poisoned Recipe Book: Before you even start, the server sends you a "pretrained model" (the base recipe). The server secretly tweaks this book. It's like the server adding invisible, glowing ink to specific pages of the recipe. You don't notice it because the recipe still works fine for cooking.
The Secret Signal: When you use this poisoned book to cook with your own secret ingredients (your private data), the math of the cooking process creates a special signal. The server designed the "glowing ink" so that when you calculate the tiny changes (gradients) to send back, those changes act like a spotlight.
The Spotlight Effect: Normally, the changes you send back are a messy mix of all your ingredients. But because of the server's trick, the changes for specific parts of the recipe become huge and loud for one specific ingredient and quiet for everything else. It's like if you were mixing a smoothie, and the server made the blender scream so loudly only when you added strawberries, but stayed silent for bananas.
The Reconstruction: The server receives your tiny update. Because of the spotlight effect, the server can mathematically isolate the "scream" and figure out exactly what ingredient caused it. By doing this for different parts of the recipe, the server can piece together your entire secret smoothie recipe, word by word or pixel by pixel.

What They Found (and What They Didn't)

The researchers tested this on two very different types of data: text (like news articles and reviews) and images (like pictures of cats and cars).

For Text: They used models like BERT and RoBERTa. The results were startlingly accurate. In their tests, the server recovered the text with near-perfect precision. If the original sentence was "Microsoft sends digital business cards," the recovered text was almost identical, getting a score of 1.0 (perfect) on standard measurement scales like BLEU and ROUGE-L.
For Images: They tested on images from the CIFAR-10 and CIFAR-100 datasets. The recovered images looked very similar to the originals. The researchers measured the difference using a metric called LPIPS, getting scores around 0.20 to 0.21, which indicates the images are visually very close to the originals.
The "Too Many Tokens" Myth: A previous attack called DAGER failed if you had more words in your sentence than the "rank" (a measure of size) of the LoRA module. The authors of this paper showed that MineGrad works even when the number of words is much larger than the rank. They proved that by using multiple "layers" of the model (like using multiple flashlights instead of one), they could recover data even with small LoRA ranks (as low as 4) and long sequences.

The Limits of the Attack

It is important to note what this paper doesn't say. The attack relies on the server being malicious and having control over the initial model you download. If you download a model from a trusted source that you can verify, or if the server is honest, this specific attack doesn't work.

Also, the paper suggests that this attack is most effective when the server doesn't care about the quality of the final model. Because the server is tampering with the recipe to steal data, the model's performance might get a little worse. However, the authors note that in many real-world scenarios (like training overnight while your phone charges), users don't watch the model's performance closely, so they might not notice the model is getting slightly "dumber" while their data is being stolen.

The researchers also tested what happens if you send a whole batch of sentences at once (like 64 sentences). In these cases, the recovery isn't perfect for every single word, but they found that even with a batch size of 64, they could still recover about 52.2% of the tokens (words) in some datasets.

Why This Matters

This paper doesn't just say "it's possible"; it provides a working blueprint (code available online) showing exactly how the math works. It suggests that the privacy guarantees we thought we had with efficient methods like LoRA might be an illusion if the server is untrustworthy.

The authors conclude that we need new ways to check if the models we download are safe, because simply trusting the server might not be enough. They didn't solve the problem of how to stop this; instead, they sounded a very loud alarm, showing that without better defenses, our private data could be mined right out of the tiny updates we thought were safe to share.

Technical Summary: MineGrad – Gradient Inversion Attacks on LoRA Fine-Tuning

Problem Statement
Parameter-Efficient Fine-Tuning (PEFT), particularly Low-Rank Adaptation (LoRA), has become a standard approach in Federated Learning (FL) to mitigate the communication and computational costs associated with fine-tuning large-scale pretrained models. In this paradigm, users download a frozen pretrained model, locally fine-tune lightweight LoRA modules, and share only the gradients of these modules with a central server. While this reduces the volume of shared data, the robustness of this setup against a malicious server remains underexplored.

Existing gradient inversion attacks, which reconstruct private training data from shared gradients, face significant limitations when applied to LoRA. Prior works often rely on computationally expensive adversarial pretraining with public datasets, require the number of training tokens to be less than the rank of the LoRA matrices (a condition often violated in practice), or are restricted to text data with predefined vocabularies. Furthermore, attacks like DAGER (Petrov et al., 2024) struggle with the reduced gradient space inherent to LoRA, where only a small number of gradient vectors (determined by the rank $r$ ) are observable per layer.

Methodology: MineGrad
The authors propose MineGrad, a novel analytical gradient inversion attack that allows a malicious server to recover private user data (both text and images) by leveraging a poisoned pretrained model and manipulated global LoRA parameters. Unlike previous methods, MineGrad does not require public datasets from the target domain, does not rely on the token count being smaller than the LoRA rank, and is applicable to both language and vision tasks.

The attack operates under a threat model where the server can:

Disseminate a poisoned pretrained model to users before fine-tuning begins.
Modify the global LoRA parameters sent to users in each training round.

Key Design Principles:

Adversarial Parameterization: The server designs the pretrained model's position encoding vectors and the LoRA matrices ( $A$ and $B$ ) to embed fine-tuning data directly into the gradients.
Identity Mapping and Token Isolation: In the "target encoders" (Encoders 1 to $S-1$ ), the server configures the self-attention mechanism to act as an identity mapping. The LoRA matrices are specifically crafted such that the gradient with respect to a specific column of matrix $B$ isolates a specific target token embedding. This is achieved by manipulating position encodings to create large, distinct values at specific dimensions, ensuring that the weight associated with the target token in the gradient calculation dominates all others.
Aggregation for Full Recovery: Since a single LoRA matrix of rank $r$ can only reveal $r$ tokens per encoder, MineGrad utilizes multiple encoders. Each encoder targets a distinct subset of tokens.
Classification Layer Manipulation: The final encoder and classification layer are designed to ensure the loss function produces a non-zero gradient that carries the aggregated information of the target tokens. The server manipulates the classification weights to force a specific class score, enabling the analytical extraction of the token embeddings from the gradient.
Reconstruction: The server analytically recovers the token embeddings by dividing the observed gradients by known constants derived from the poisoned parameters. The original word embeddings are then recovered by subtracting the known (poisoned) position encoding vectors.

Key Contributions

Novel Attack Vector: Introduction of MineGrad, the first analytical gradient inversion attack specifically designed for LoRA fine-tuning in FL that works without public domain datasets or restrictive rank constraints.
Broad Applicability: Demonstration that the attack is effective on both language tasks (using Transformer encoders like BERT and RoBERTa) and vision tasks (using Vision Transformers), overcoming the vocabulary limitations of previous text-only attacks.
Overcoming Rank Constraints: The method successfully recovers data even when the number of training tokens exceeds the rank of the LoRA matrices, a scenario where prior attacks like DAGER fail.
Scalability: The use of multiple encoders allows the recovery of full sequences regardless of the low rank ( $r$ ) of individual LoRA modules.

Experimental Results
The authors evaluated MineGrad on multiple text classification datasets (AG's News, DBPedia, Yahoo Answers, Yelp, TREC-6) and image classification datasets (CIFAR-10, CIFAR-100).

Text Recovery: The attack achieved near-perfect reconstruction, with BLEU and ROUGE-L scores approaching 1.0 across various models (BERT-base/large, RoBERTa-base/large) and datasets. Table 2 illustrates that ground-truth sentences are recovered with high fidelity.
Rank Independence: Experiments showed that while reconstruction quality improves with higher rank for a single encoder, deploying multiple encoders allows MineGrad to achieve the same high-fidelity recovery with a very small rank (e.g., $r=2$ ) as a single encoder with a large rank ( $r=16$ ).
Sequence Length: Performance degrades as sequence length increases, but remains effective. The authors note that performance can be further enhanced by tampering with pretrained word embeddings.
Image Recovery: For Vision Transformers, the attack recovered images with low LPIPS scores (0.20 ± 0.04 for CIFAR-10), indicating high visual similarity to the original inputs.
Batch Processing: Even with batch sizes up to 64, the attack recovered a significant percentage of tokens (e.g., 52.2% for TREC-6), though recovery rates decrease as batch size increases due to the averaging of embeddings.
Comparison: MineGrad significantly outperformed DAGER, which suffered severe performance degradation when the token count exceeded the LoRA rank.

Significance and Claims
The paper claims that MineGrad reveals critical vulnerabilities in the privacy guarantees of Federated LoRA fine-tuning. The authors emphasize that:

The reduced gradient space in LoRA does not inherently protect against a strong adversary capable of manipulating the pretrained model.
Current assumptions that PEFT offers better privacy than full fine-tuning are insufficient when the server is adversarial.
The attack is "one-shot," capable of recovering data in a single training round (potentially early in training when accuracy is low), meaning users may not detect the attack even if they monitor training loss later.
The work highlights an urgent need for verifiable defense mechanisms for PEFT in federated settings. The authors note that the attack performance against popular defenses such as secure aggregation, pruning, and noise addition is presented in the appendices of the paper.

The authors conclude that while their attack is a demonstration of vulnerability, it provides new design principles for understanding the interaction between poisoned models and gradient propagation, urging the community to develop robust defenses for the growing adoption of PEFT in privacy-sensitive environments.

The Paper's Big Discovery: "MineGrad"

What They Found (and What They Didn't)

The Limits of the Attack

Why This Matters

Technical Summary: MineGrad – Gradient Inversion Attacks on LoRA Fine-Tuning

More like this