# Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers — arXiv cs.AI [Canonical reading](https://escapemeridian.com/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346) The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 6, 2026 (2026-11-06). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T05:47:37.039Z. First observed: 2026-11-09T05:03:44.496Z. Retrieved: 2026-11-10T05:46:36.013Z. - [Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers](https://arxiv.org/abs/2611.09652) ## Limits The abstract reports reconstruction-quality metrics on CIFAR-10, CelebA, and CARS, and mentions higher batch sizes and FedAvg settings; it does not establish how the method performs beyond these reported evaluations. The abstract describes image reconstruction results but does not report whether reconstructed images enable particular real-world harms. ## Open question How well does spatial anchoring reconstruct private images beyond the datasets and settings reported in the abstract? ## Source-stated The authors argue that LoRA-based PEFT does not by itself prevent private data leakage in federated learning. > These results indicate that LoRA-based PEFT does not, by itself, prevent data leakage in FL - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source-stated The authors attribute limits on reconstruction quality to reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. > quality of reconstruction is limited by two coupled ambiguities: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source-stated Adding spatial anchoring to GIAS improves reported image-quality metrics on CIFAR-10 and PSNR on CelebA and CARS. > Adding our proposed spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098 on CIFAR-10, as well as PSNR gains of 7.83 and 11.74 dB on high-resolution CelebA and CARS datasets, respectively - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source-stated The authors report that the image-quality gains persist at higher batch sizes and in FedAvg settings. > Such gains in reconstructed image quality metrics are also maintained at higher batch sizes and in FedAvg settings. - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source and contributor context Badiya, Ritik K., Manna, Siladittya, Sinha, Ashmit, Yashwanth, M, Chakraborty, Anirban · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Embedding vector A list of numbers that represents a piece of text, an image or another item so software can compare meanings. - [Definition reference](https://developers.google.com/machine-learning/glossary#embedding-vector) ## Fine-tuning Further training of an existing model to adapt it to a particular task or use. - [Definition reference](https://developers.google.com/machine-learning/glossary#fine-tuning) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: f41ab3c6-caf2-41f4-8dd6-be4261e27f92. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T05:47:37.039Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 4f49d8a53dab2fedcbb3d7f81230a7cda1c73d713c01c288a1ecfa7084f184c4. Source text hash: cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb. ## Revision and source-check history ### Version 1 — 2026-11-10T05:47:37.039Z The paper’s authors argue that LoRA-based PEFT does not, by itself, prevent private data leakage in federated learning. They identify two obstacles to reconstructing images from client updates: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. Their proposed spatially anchored generative inversion framework adds server-prescribed trainable positional embeddings during client fine-tuning; the resulting positional gradients provide spatial cues, while a generative prior helps keep reconstructions realistic. On CIFAR-10, the authors report that adding spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098. They also report PSNR gains on CelebA and CARS, and say the image-quality gains persist at higher batch sizes and in FedAvg settings. The result matters because, in the settings they report, a server’s access to individual client updates can expose information about private images despite LoRA-based PEFT. The abstract reports reconstruction-quality metrics, not whether reconstructed images enable particular real-world harms. ## Original source arXiv cs.AI · Article Original source date: Nov 6, 2026 (2026-11-06). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T05:47:37.039Z. First observed: 2026-11-09T05:03:44.496Z. Retrieved: 2026-11-10T05:46:36.013Z. - [Breaking the Privacy Promise: Gradient Inversion Attacks on Federated Low-Rank Adapted Vision Transformers](https://arxiv.org/abs/2611.09652) ## Limits The abstract reports reconstruction-quality metrics on CIFAR-10, CelebA, and CARS, and mentions higher batch sizes and FedAvg settings; it does not establish how the method performs beyond these reported evaluations. The abstract describes image reconstruction results but does not report whether reconstructed images enable particular real-world harms. ## Open question How well does spatial anchoring reconstruct private images beyond the datasets and settings reported in the abstract? ## Source-stated The authors argue that LoRA-based PEFT does not by itself prevent private data leakage in federated learning. > These results indicate that LoRA-based PEFT does not, by itself, prevent data leakage in FL - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source-stated The authors attribute limits on reconstruction quality to reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. > quality of reconstruction is limited by two coupled ambiguities: reduced information in LoRA gradients and missing spatial cues from frozen positional embeddings. - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source-stated Adding spatial anchoring to GIAS improves reported image-quality metrics on CIFAR-10 and PSNR on CelebA and CARS. > Adding our proposed spatial anchoring to GIAS improves PSNR by 10.14 dB, SSIM by 0.45, and LPIPS by 0.098 on CIFAR-10, as well as PSNR gains of 7.83 and 11.74 dB on high-resolution CelebA and CARS datasets, respectively - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source-stated The authors report that the image-quality gains persist at higher batch sizes and in FedAvg settings. > Such gains in reconstructed image quality metrics are also maintained at higher batch sizes and in FedAvg settings. - [Supporting source](https://arxiv.org/abs/2611.09652) ## Source and contributor context Badiya, Ritik K., Manna, Siladittya, Sinha, Ashmit, Yashwanth, M, Chakraborty, Anirban · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Embedding vector A list of numbers that represents a piece of text, an image or another item so software can compare meanings. - [Definition reference](https://developers.google.com/machine-learning/glossary#embedding-vector) ## Fine-tuning Further training of an existing model to adapt it to a particular task or use. - [Definition reference](https://developers.google.com/machine-learning/glossary#fine-tuning) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: f41ab3c6-caf2-41f4-8dd6-be4261e27f92. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T05:47:37.039Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 4f49d8a53dab2fedcbb3d7f81230a7cda1c73d713c01c288a1ecfa7084f184c4. Source text hash: cb7194c00d683a4b5d7f45a787cfa8aed825423df816264ea7b8ac90fba48ebb. ### uncertain — 2026-11-10T05:47:37.039Z — anthropic/claude-opus-5.5 Publication: f41ab3c6-caf2-41f4-8dd6-be4261e27f92 attribution — pass: The reading consistently attributes the argument, method and results to the paper's authors on arXiv. It does not present their reported gains as independently verified. > Authors:Ritik K. Badiya, Siladittya Manna, Ashmit Sinha, M Yashwanth, Anirban Chakraborty summary — uncertain: The reading is faithful but not understandable on its own for a general reader. Central terms go unexplained: federated learning, LoRA/PEFT, gradients, gradient inversion, positional embeddings, GIAS, PSNR/SSIM/LPIPS and FedAvg. A non-specialist cannot tell that the attack reconstructs a client's private training images from the updates it sends to a server. Smallest repair: add one plain-language framing sentence, and use term tooltips for LoRA, PEFT, PSNR and the other terms. The reported CIFAR-10 gains also omit the source's FedSGD condition. > in the FedSGD setting date — pass: originalPublished is 2026-11-06, which matches the arXiv v1 submission date. The later feed date was not used. > \[Submitted on 6 Nov 2026\] support — uncertain: The listed claims are source-stated. However, the significance sentence says the server's access to individual client updates can expose private image information despite LoRA-based PEFT. That drops a key condition. The source's attack works because the server itself prescribes extra trainable positional embeddings for clients to train. In other words, the server actively alters client training, which is more than passive access to updates. The source concludes that carefully incorporated embeddings help expose data. Smallest repair: state that the server injects these embeddings. > incorporates server-prescribed trainable positional embeddings into ViT blocks during fine-tuning at clients media — pass: The selected media is the verified direct link to the original arXiv abstract page, which is the actual source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/6f2dc3468afa3e0c36af406f85dc95c051d802676af9bea3ae9df40c2d4f26cc/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/breaking-the-privacy-promise-gradient-inversion-attacks-on-6f2dc346.json)