Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI

Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI

The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms.

Publication: f41ab3c6-caf2-41f4-8dd6-be4261e27f92

attribution — pass: The reading consistently attributes the argument, method and results to the paper's authors on arXiv. It does not present their reported gains as independently verified.

Authors:Ritik K. Badiya, Siladittya Manna, Ashmit Sinha, M Yashwanth, Anirban Chakraborty

summary — uncertain: The reading is faithful but not understandable on its own for a general reader. Central terms go unexplained: federated learning, LoRA/PEFT, gradients, gradient inversion, positional embeddings, GIAS, PSNR/SSIM/LPIPS and FedAvg. A non-specialist cannot tell that the attack reconstructs a client's private training images from the updates it sends to a server. Smallest repair: add one plain-language framing sentence, and use term tooltips for LoRA, PEFT, PSNR and the other terms. The reported CIFAR-10 gains also omit the source's FedSGD condition.

in the FedSGD setting

date — pass: originalPublished is 2026-11-06, which matches the arXiv v1 submission date. The later feed date was not used.

[Submitted on 6 Nov 2026]

support — uncertain: The listed claims are source-stated. However, the significance sentence says the server's access to individual client updates can expose private image information despite LoRA-based PEFT. That drops a key condition. The source's attack works because the server itself prescribes extra trainable positional embeddings for clients to train. In other words, the server actively alters client training, which is more than passive access to updates. The source concludes that carefully incorporated embeddings help expose data. Smallest repair: state that the server injects these embeddings.

incorporates server-prescribed trainable positional embeddings into ViT blocks during fine-tuning at clients

media — pass: The selected media is the verified direct link to the original arXiv abstract page, which is the actual source.