{"id":"6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc","title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI","argument":"The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The abstract reports reconstruction-quality metrics on CIFAR-10, CelebA, and CARS, and mentions higher batch sizes and FedAvg settings; it does not establish how the method performs beyond these reported evaluations. The abstract describes image reconstruction results but does not report whether reconstructed images enable particular real-world harms.","speaker":{"name":"Badiya, Ritik K., Manna, Siladittya, Sinha, Ashmit, Yashwanth, M, Chakraborty, Anirban","roleAtSource":"Article author"},"source":{"title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.09652","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors argue that LoRA-based PEFT does not by itself prevent private data leakage in federated learning.","excerpt":"These results indicate that LoRA-based PEFT does not, by itself, prevent data leakage in FL","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"},{"text":"The authors attribute limits on reconstruction quality to reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","excerpt":"quality of reconstruction is limited by two coupled ambiguities: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"},{"text":"Adding spatial anchoring to GIAS improves reported image-quality metrics on CIFAR-10 and PSNR on CelebA and CARS.","excerpt":"Adding our proposed spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098 on CIFAR-10, as well as PSNR gains of 7.83 and 11.74 dB on high-resolution CelebA and CARS datasets, respectively","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"},{"text":"The authors report that the image-quality gains persist at higher batch sizes and in FedAvg settings.","excerpt":"Such gains in reconstructed image quality metrics are also maintained at higher batch sizes and in FedAvg settings.","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09652","checkedAt":"2026-11-10T06:50:09.142Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well does spatial anchoring reconstruct private images beyond the datasets and settings reported in the abstract?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI","summary":"The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms.","question":"How well does spatial anchoring reconstruct private images beyond the datasets and settings reported in the abstract?","claims":[{"text":"The authors argue that LoRA-based PEFT does not by itself prevent private data leakage in federated learning.","excerpt":"These results indicate that LoRA-based PEFT does not, by itself, prevent data leakage in FL","support":"source-stated"},{"text":"The authors attribute limits on reconstruction quality to reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","excerpt":"quality of reconstruction is limited by two coupled ambiguities: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","support":"source-stated"},{"text":"Adding spatial anchoring to GIAS improves reported image-quality metrics on CIFAR-10 and PSNR on CelebA and CARS.","excerpt":"Adding our proposed spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098 on CIFAR-10, as well as PSNR gains of 7.83 and 11.74 dB on high-resolution CelebA and CARS datasets, respectively","support":"source-stated"},{"text":"The authors report that the image-quality gains persist at higher batch sizes and in FedAvg settings.","excerpt":"Such gains in reconstructed image quality metrics are also maintained at higher batch sizes and in FedAvg settings.","support":"source-stated"}],"limitations":["The abstract reports reconstruction-quality metrics on CIFAR-10, CelebA, and CARS, and mentions higher batch sizes and FedAvg settings; it does not establish how the method performs beyond these reported evaluations.","The abstract describes image reconstruction results but does not report whether reconstructed images enable particular real-world harms."],"mediaId":"b2c165d5bbe6eaa3de365dca5e5ac42ddfb76e363b1dd6abab0797577683041a","correctionReason":null,"id":"6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc","publicationId":"f41ab3c6-caf2-41f4-8dd6-be4261e27f92","version":1,"sourceUrl":"https://arxiv.org/abs/2611.09652","sourceTitle":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-09T05:03:44.496Z","createdAt":"2026-11-10T05:47:37.039Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"b2c165d5bbe6eaa3de365dca5e5ac42ddfb76e363b1dd6abab0797577683041a","kind":"article","url":"https://arxiv.org/abs/2611.09652","sourceUrl":"https://arxiv.org/abs/2611.09652","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-10T05:46:36.484Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09652","checkedAt":"2026-11-10T06:50:09.142Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"b2c165d5bbe6eaa3de365dca5e5ac42ddfb76e363b1dd6abab0797577683041a","confidence":0.8500000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"aa362778a21136248623208c2c42df0b50a936c1551734c54d20a79b072e6ff3","decidedAt":"2026-11-10T05:46:39.542Z"},"provenance":{"textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observationId":"4f49d8a53dab2fedcbb3d7f81230a7cda1c73d713c01c288a1ecfa7084f184c4","retrievedAt":"2026-11-10T05:46:36.013Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"898e539e-0a62-4439-86f4-b6496b9c86d5"},"reviewer":{"model":"gpt-6-luna","runId":"12735540-7d03-4745-8f3e-067286e5c980"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-10T05:47:37.039Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Badiya, Ritik K.","url":null,"kind":"unknown"},{"name":"Manna, Siladittya","url":null,"kind":"unknown"},{"name":"Sinha, Ashmit","url":null,"kind":"unknown"},{"name":"Yashwanth, M","url":null,"kind":"unknown"},{"name":"Chakraborty, Anirban","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Badiya, Ritik K.","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Badiya, Ritik K.","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Manna, Siladittya","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Manna, Siladittya","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Sinha, Ashmit","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Sinha, Ashmit","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Yashwanth, M","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yashwanth, M","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Chakraborty, Anirban","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chakraborty, Anirban","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.09652","snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z","basis":"publisher-page-metadata","sourceLinks":47,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc/source"}},"canonicalUrl":"https://escapemeridian.com/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346","formats":{"html":"/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346","markdown":"/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346.md","json":"/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-embedding-vector","name":"Embedding vector","explanation":"A list of numbers that represents a piece of text, an image or another item so software can compare meanings.","referenceUrl":"https://developers.google.com/machine-learning/glossary#embedding-vector"},{"id":"term-fine-tuning","name":"Fine-tuning","explanation":"Further training of an existing model to adapt it to a particular task or use.","referenceUrl":"https://developers.google.com/machine-learning/glossary#fine-tuning"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc","revision":"f41ab3c6-caf2-41f4-8dd6-be4261e27f92","revisionKind":"publication-id","title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI","url":"https://escapemeridian.com/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.09652","revision":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","revisionKind":"sha256-source-text","title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers","url":"https://arxiv.org/abs/2611.09652"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc","title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI","argument":"The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The abstract reports reconstruction-quality metrics on CIFAR-10, CelebA, and CARS, and mentions higher batch sizes and FedAvg settings; it does not establish how the method performs beyond these reported evaluations. The abstract describes image reconstruction results but does not report whether reconstructed images enable particular real-world harms.","speaker":{"name":"Badiya, Ritik K., Manna, Siladittya, Sinha, Ashmit, Yashwanth, M, Chakraborty, Anirban","roleAtSource":"Article author"},"source":{"title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.09652","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors argue that LoRA-based PEFT does not by itself prevent private data leakage in federated learning.","excerpt":"These results indicate that LoRA-based PEFT does not, by itself, prevent data leakage in FL","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"},{"text":"The authors attribute limits on reconstruction quality to reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","excerpt":"quality of reconstruction is limited by two coupled ambiguities: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"},{"text":"Adding spatial anchoring to GIAS improves reported image-quality metrics on CIFAR-10 and PSNR on CelebA and CARS.","excerpt":"Adding our proposed spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098 on CIFAR-10, as well as PSNR gains of 7.83 and 11.74 dB on high-resolution CelebA and CARS datasets, respectively","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"},{"text":"The authors report that the image-quality gains persist at higher batch sizes and in FedAvg settings.","excerpt":"Such gains in reconstructed image quality metrics are also maintained at higher batch sizes and in FedAvg settings.","url":"https://arxiv.org/abs/2611.09652","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09652","checkedAt":"2026-11-10T06:50:09.142Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well does spatial anchoring reconstruct private images beyond the datasets and settings reported in the abstract?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI","summary":"The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms.","question":"How well does spatial anchoring reconstruct private images beyond the datasets and settings reported in the abstract?","claims":[{"text":"The authors argue that LoRA-based PEFT does not by itself prevent private data leakage in federated learning.","excerpt":"These results indicate that LoRA-based PEFT does not, by itself, prevent data leakage in FL","support":"source-stated"},{"text":"The authors attribute limits on reconstruction quality to reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","excerpt":"quality of reconstruction is limited by two coupled ambiguities: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings.","support":"source-stated"},{"text":"Adding spatial anchoring to GIAS improves reported image-quality metrics on CIFAR-10 and PSNR on CelebA and CARS.","excerpt":"Adding our proposed spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098 on CIFAR-10, as well as PSNR gains of 7.83 and 11.74 dB on high-resolution CelebA and CARS datasets, respectively","support":"source-stated"},{"text":"The authors report that the image-quality gains persist at higher batch sizes and in FedAvg settings.","excerpt":"Such gains in reconstructed image quality metrics are also maintained at higher batch sizes and in FedAvg settings.","support":"source-stated"}],"limitations":["The abstract reports reconstruction-quality metrics on CIFAR-10, CelebA, and CARS, and mentions higher batch sizes and FedAvg settings; it does not establish how the method performs beyond these reported evaluations.","The abstract describes image reconstruction results but does not report whether reconstructed images enable particular real-world harms."],"mediaId":"b2c165d5bbe6eaa3de365dca5e5ac42ddfb76e363b1dd6abab0797577683041a","correctionReason":null,"id":"6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc","publicationId":"f41ab3c6-caf2-41f4-8dd6-be4261e27f92","version":1,"sourceUrl":"https://arxiv.org/abs/2611.09652","sourceTitle":"Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-09T05:03:44.496Z","createdAt":"2026-11-10T05:47:37.039Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"b2c165d5bbe6eaa3de365dca5e5ac42ddfb76e363b1dd6abab0797577683041a","kind":"article","url":"https://arxiv.org/abs/2611.09652","sourceUrl":"https://arxiv.org/abs/2611.09652","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-10T05:46:36.484Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.09652","checkedAt":"2026-11-10T06:50:09.142Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"b2c165d5bbe6eaa3de365dca5e5ac42ddfb76e363b1dd6abab0797577683041a","confidence":0.8500000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"aa362778a21136248623208c2c42df0b50a936c1551734c54d20a79b072e6ff3","decidedAt":"2026-11-10T05:46:39.542Z"},"provenance":{"textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observationId":"4f49d8a53dab2fedcbb3d7f81230a7cda1c73d713c01c288a1ecfa7084f184c4","retrievedAt":"2026-11-10T05:46:36.013Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"898e539e-0a62-4439-86f4-b6496b9c86d5"},"reviewer":{"model":"gpt-6-luna","runId":"12735540-7d03-4745-8f3e-067286e5c980"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-10T05:47:37.039Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Badiya, Ritik K.","url":null,"kind":"unknown"},{"name":"Manna, Siladittya","url":null,"kind":"unknown"},{"name":"Sinha, Ashmit","url":null,"kind":"unknown"},{"name":"Yashwanth, M","url":null,"kind":"unknown"},{"name":"Chakraborty, Anirban","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Badiya, Ritik K.","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Badiya, Ritik K.","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Manna, Siladittya","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Manna, Siladittya","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Sinha, Ashmit","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Sinha, Ashmit","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Yashwanth, M","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yashwanth, M","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}},{"actor":{"name":"Chakraborty, Anirban","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chakraborty, Anirban","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.09652","locator":"head/meta[name=author|citation_author]"},"assertionId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T06:50:09.142Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","sourceUrl":"https://arxiv.org/abs/2611.09652","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.09652","snapshotId":"9d938b83c2933281b1e810fae598e60bbc92e520d134615128497ca58bab41f7","contentSha256":"300043a700483b71bf347abe9bbcfeb6a2a2b3fcd54e628a65ce4e5f5ce6c78c","textHash":"cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb","observedAt":"2026-11-10T06:50:09.142Z","basis":"publisher-page-metadata","sourceLinks":47,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc/source"}}}],"audits":[{"publicationId":"f41ab3c6-caf2-41f4-8dd6-be4261e27f92","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading consistently attributes the argument, method and results to the paper's authors on arXiv. It does not present their reported gains as independently verified.","excerpt":"Authors:Ritik K. Badiya, Siladittya Manna, Ashmit Sinha, M Yashwanth, Anirban Chakraborty"},{"dimension":"summary","status":"uncertain","explanation":"The reading is faithful but not understandable on its own for a general reader. Central terms go unexplained: federated learning, LoRA/PEFT, gradients, gradient inversion, positional embeddings, GIAS, PSNR/SSIM/LPIPS and FedAvg. A non-specialist cannot tell that the attack reconstructs a client's private training images from the updates it sends to a server. Smallest repair: add one plain-language framing sentence, and use term tooltips for LoRA, PEFT, PSNR and the other terms. The reported CIFAR-10 gains also omit the source's FedSGD condition.","excerpt":"in the FedSGD setting"},{"dimension":"date","status":"pass","explanation":"originalPublished is 2026-11-06, which matches the arXiv v1 submission date. The later feed date was not used.","excerpt":"[Submitted on 6 Nov 2026]"},{"dimension":"support","status":"uncertain","explanation":"The listed claims are source-stated. However, the significance sentence says the server's access to individual client updates can expose private image information despite LoRA-based PEFT. That drops a key condition. The source's attack works because the server itself prescribes extra trainable positional embeddings for clients to train. In other words, the server actively alters client training, which is more than passive access to updates. The source concludes that carefully incorporated embeddings help expose data. Smallest repair: state that the server injects these embeddings.","excerpt":"incorporates server-prescribed trainable positional embeddings into ViT blocks during fine-tuning at clients"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original arXiv abstract page, which is the actual source.","excerpt":null}],"createdAt":"2026-11-10T05:47:37.039Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}