{"id":"b043b8f3-2e4a-4176-ac12-cb841ec7c446","arxiv_id":"2507.21198","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A hybrid continuous-discrete optimization attack, Grab, recovers up to 92.9% of private training text from gradients in federated learning of masked language models under practical settings.","lead":"Researchers show that a new attack, Grab, can recover up to 92.9% of private text data from gradients shared during federated learning of language models, even when common defenses like frozen embeddings and dropout are active. The result matters because it suggests federated fine-tuning of language models leaks training text more severely than previously believed.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Baseline comparison uses different iteration budgets; the claimed up-to-28.9% and 48.5% margins may be compute artifacts rather than algorithmic gains.","rationale":"The reader's conditional verdict is appropriate. The paper makes a strong empirical case that Grab is effective in absolute terms, with high recovery rates even under frozen embeddings and activated dropout. The dropout-mask-learning component, which the reader identifies as the weakest assumption, is at least partially isolated by the Grab-vs-Grab* ablation in Table 3, showing a clear performance contribution. However, the quantitative comparison against baselines is less secure: the paper explicitly runs baselines at their default iteration counts while Grab receives 10,000 steps, and the only equal-compute trial mentioned is not reported. This is a concrete, checkable flaw that directly affects the headline improvement numbers. The 'practical settings' claim is also somewhat overstated, since the comparative practical numbers in Section 5.3 still assume known labels and known sequence lengths; only the later ablation (Section 5.4.3) relaxes these. I do not think this rises to rejection: the method appears novel and the relaxed-assumption results are promising, but the paper should either report the standardized trial or present the headline comparisons with matched compute and clearly state which numbers come with the assumptions. My concern differs from the reader's formal weakest_assumption, hence 'partial,' but the overall conditional verdict is unchanged.","tokens_in":25535,"tokens_out":4784,"duration_ms":51692,"concrete_test":"Rerun DLG, TAG, LAMP-cos, and LAMP-L2+L1 with exactly 10,000 continuous optimization steps (and an equivalent number of discrete steps where applicable) on the same benchmark and practical settings used in Figures 2 and 3, keeping all other hyperparameters at their defaults. Compare ROUGE-1/2/L against Grab's reported scores. If the baselines reach Grab's level within standard deviation, the claimed improvements are compute artifacts and the comparative claims should be revised; if Grab still leads, the claim stands.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central comparative claim in the abstract (Grab outperforms the best baseline by up to 28.9% recovery rate in benchmark settings and 48.5% in practical settings) rests on an unequal-compute comparison. Section 5.1 states Grab uses n_h=5, n_c=2,000, giving 10,000 continuous optimization steps and 25 discrete steps, while DLG, TAG, and LAMP run at their default 2,000–2,500 continuous steps. The paper mentions a trial that standardized all approaches to 10,000 steps and claims Grab still improved, but it does not report the numbers; instead it retains the default budgets, arguing that the baselines 'early fall into a local optimum.' That assertion is unverified. If the baselines would continue to improve when given 10,000 steps, the reported margins shrink or vanish, and the claim of superiority cannot be attributed to Grab's hybrid optimization or dropout-mask learning. This is load-bearing because the abstract's headline improvements are comparative, and the paper's own methodology text exposes an untested confound.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies gradient inversion attacks against masked language models in federated learning and proposes Grab, a hybrid optimization attack. Grab alternates continuous optimization (with a learned dummy dropout mask) and discrete optimization (beam search over tokens), and is evaluated on three datasets with BERT and RoBERTa models in benchmark and practical settings. The authors report up to 92.9% ROUGE recovery and improvements over LAMP, DLG, and TAG of up to 28.9% in benchmark settings and 48.5% in practical settings, plus robustness to gradient noise and gradient pruning. Code is released.","tokens_in":25897,"tokens_out":5305,"duration_ms":57317,"significance":"If the results hold, the paper makes a strong contribution: it demonstrates that gradient inversion can recover substantial text from gradient updates in realistic federated-learning configurations with frozen embeddings and activated dropout, correcting the prevailing view that the discrete nature of tokens makes such attacks impractical against language models. The evaluation is unusually broad, covering multiple datasets, batch sizes up to 128, several BERT and RoBERTa sizes, varying dropout rates, relaxed label and sequence-length assumptions, and two defense families. The release of code and the clear algorithm descriptions support reproducibility. The attack is evaluated against ground-truth data rather than derived from it, and hyperparameter tuning on the same evaluation datasets is standard practice for attack papers, so I do not see a circularity problem. The main caveats are the compute-budget confound in the baseline comparison and the gap between the threat model and the conditions under which the headline numbers are produced; both are addressable in revision.","major_comments":[{"comment":"The comparative evaluation gives Grab n_h=5 and n_c=2,000, totaling 10,000 continuous optimization steps plus 25 discrete steps, while DLG, TAG, and LAMP run at their default budgets of 2,000-2,500 continuous steps. The text mentions a trial that standardizes all approaches to 10,000 steps and asserts that baselines 'early fall into a local optimum,' but the results of that trial are not reported. Because the abstract's headline margins (up to 28.9% and 48.5%) are comparative, this unequal-compute setup is load-bearing: without the standardized-trial numbers or equal-compute learning curves, the claimed superiority cannot be attributed to Grab's hybrid optimization or dropout-mask learning rather than to the larger compute budget. Please report the standardized trial as a table or figure, including baseline recovery rates at intermediate step counts, or rerun all baselines at 10,000 steps and use those results for the comparisons.","section":"Section 5.1 and Figures 2-3"},{"comment":"The main comparative experiments in Sections 5.2 and 5.3 adopt the known-label and known-sequence-length assumptions, as stated in Section 5.1, while the threat model in Section 4.1 explicitly does not grant the adversary such knowledge. This directly limits the headline claims: the 'up to 92.9%' recovery rate and the 'up to 48.5%' practical improvement are not achieved under the paper's own practical threat model. The ablation in Section 5.4.3 indicates that Grab tolerates relaxing these assumptions, but those results are not part of the headline comparison and are presented only later. Please either move the assumption-free results into the main evaluation or qualify the abstract and introductory claims to state clearly that the headline numbers use known labels and known sequence lengths.","section":"Sections 5.1-5.3 and Section 4.1"},{"comment":"The dropout-mask update is the component credited with 'resolving activated dropout,' but the paper does not check whether the learned continuous mask actually tracks the victim's random binary dropout mask, or whether it merely provides extra degrees of freedom that overfit the recovery loss. Because the mask is optimized on the same recovery objective as the dummy inputs, the Grab-versus-Grab* comparisons in Figure 3 and Table 3 do not uniquely support the proposed mechanism. Please add a diagnostic such as the correlation between the learned mask and the true mask, or an upper-bound ablation that feeds the true mask to the attacker, and report the sensitivity of the attack to the Bernoulli initialization of the mask.","section":"Section 4.3, Algorithm 2 line 6"}],"minor_comments":[{"comment":"The heading 'Droupout Mask Learning' should read 'Dropout Mask Learning'.","section":"Section 3.4"},{"comment":"In the concluding section, 'gradient decent' should be 'gradient descent'.","section":"Section 6"},{"comment":"The entries 'Grab 1' through 'Grab 4' are only explained in footnotes below the table; please define them in the table caption for readability.","section":"Table 5"},{"comment":"The meaning of 'Grab*' is given only in the body text; please define it in the figure caption.","section":"Figure 3"},{"comment":"The described configuration for BERT_tiny (6 layers, 12 heads, 67 million parameters) does not match the common TinyBERT checkpoint; please clarify the exact model variant used.","section":"Section 5.4.1"},{"comment":"The ROUGE calculation uses a maximum over recovered sequences for each reference sequence, which is more lenient than LAMP's original index-based matching; since all approaches are scored this way the comparison is fair, but this choice is important enough to state explicitly in the main evaluation section.","section":"Appendix B.3"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is the strongest LAMP-line attack on masked LMs I've seen for realistic settings. It adds dropout-mask learning to continuous optimization and uses beam search plus padding tokens to handle unknown sequence lengths. The combination is new for MLMs, and the evaluation is unusually broad: three datasets, BERT/RoBERTa sizes, batch sizes to 128, relaxed assumptions, defenses. Code is public. The 92.9% recovery and large gains over LAMP under activated dropout and frozen embeddings are plausible and worth taking seriously.\n\nWhere it gets soft is not the attack mechanics but the comparative numbers. The abstract's 28.9% and 48.5% margins compare Grab at 10,000 continuous steps against baselines at their default 2,000-2,500. The paper says a standardized trial at 10,000 still showed Grab ahead, but it doesn't report those numbers. That is a fixable reporting gap, but it is load-bearing because the headline is comparative. I would want the equal-compute table in the main text before trusting the specific margins. The qualitative claim — Grab works where LAMP doesn't — appears solid regardless, because the practical-setting results are stark and consistent across batch sizes.\n\nThe 'known labels and sequence lengths' issue is less serious than the abstract implies. When those assumptions are relaxed in the ablation, Grab still recovers most data, so the practical threat narrative holds. I would still report the headline numbers under the relaxed protocol, since that is the threat model they claim. The dropout-mask learning lacks theoretical grounding and it is hard to decompose its contribution from beam search, but for attack papers empirical demonstration is the normal bar, and the ablation with Grab* versus Grab isolates it reasonably.\n\nCitation pattern is fine; it builds on LAMP and Scheliga et al. and says so. The FL equivalence claim is backed by an experiment. No circularity: hyperparameters are tuned on the same datasets, standard for this literature and not disqualifying.\n\nThis deserves a serious referee. My recommendation: send it to review with a request that the equal-compute trial be reported, the margins be presented under relaxed assumptions, and the 'baselines early fall into a local optimum' claim be supported by learning curves or replaced with actual standardized numbers. A revision along those lines would make the paper's central claim trustworthy.","headline":"Grab is a credible extension of gradient inversion to practical masked-LM settings, but the headline margins need equal-compute evidence before the claim is taken at face value.","tokens_in":26259,"tokens_out":2071,"would_cite":true,"duration_ms":23477,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Gradient inversion can recover up to 92.9% of private text data during federated fine-tuning of masked language models, even when embeddings are frozen and dropout is active.","keywords":["gradient inversion","federated learning","language models","privacy attack","dropout mask learning","beam search","text recovery","BERT"],"falsifier":"Run Grab against a victim whose dropout mask is re-sampled on every forward pass during the gradient computation (the standard training regime), and compare the recovery rate with and without dropout mask learning; if the gap is negligible or recovery collapses, the claim that mask learning offsets dropout-induced noise in practical training is falsified. A complementary check: freeze the learned mask after optimization and verify that it matches the victim's realized mask statistics for the same input.","tokens_in":25352,"feed_emoji":"🔓","tokens_out":6242,"duration_ms":58784,"temperature":0.7,"pith_summary":"The paper tries to establish that gradient inversion attacks—long considered ineffective against language models because text is discrete—are a practical privacy threat in federated fine-tuning of masked language models. Its attack, Grab, alternates continuous optimization that recovers tokens through gradient matching with discrete beam search that reorders them, adding a learned dropout mask so the attack works when dropout is active. The paper reports recovering up to 92.9% of private training text, beating the best prior attack by up to 28.9% in benchmark settings and 48.5% in practical settings with frozen embeddings, activated dropout, and unknown sequence lengths. If correct, this means sharing gradients in federated language-model training leaks substantial training text under realistic defenses.","feed_headline":"One attack recovers up to 92.9% of private training text","feed_subtitle":"Grab reconstructs text from federated-learning gradients even when embeddings are frozen and dropout is on.","key_machinery":"The central mechanism is the hybrid optimization loop of Algorithm 1: a continuous step and a discrete step alternate over several rounds. In the continuous step, gradient descent minimizes a combined $L_2+L_1$ recovery loss over dummy embeddings, dummy labels, and a per-layer dropout mask (clamped to $[0,1]$), which is meant to compensate for the randomness of the victim's activated dropout. In the discrete step, beam search reorders the recovered tokens by substituting each position with candidates from the token set, keeping the $n_b$ lowest-loss beams, while including the padding token to signal the end of shorter sequences. The output of one step seeds the other in the next round, and the best result from either is returned.","core_discovery":"Grab is a gradient inversion attack that recovers private text from the shared gradients of a federated fine-tuning round without assuming known labels or exact sequence lengths. The attack alternates a continuous optimization, which matches dummy gradients to the victim's gradients while jointly updating dummy embeddings, dummy labels, and a clamped continuous dropout mask, with a discrete optimization that uses beam search to reorder the tokens recovered by the continuous step, using the padding token so sequence lengths can float. The paper claims up to 92.9% ROUGE recovery on the BERT base model, with consistent superiority over DLG, TAG, and LAMP across three datasets and batch sizes up to 32, and reports that the attack remains effective at batch sizes up to 128 and against gradient-noise and gradient-pruning defenses.","pith_inferences":["Beyond the paper: if these recovery rates persist for other masked language models, gradient inversion should be treated as a baseline privacy threat in any federated fine-tuning service that exposes raw gradients, and defenses should assume text can be reconstructed even without label or length knowledge.","A testable extension: recording the optimized dropout mask across iterations and comparing it with the victim's actual mask statistics would isolate whether mask learning genuinely tracks the victim's dropout, or whether the beam search alone drives the gains.","The padding-token length discovery trick suggests inversion can be adapted to other structured discrete data (code, SQL, graphs), where an 'end' token could play the same role as padding in finding variable-length sequences.","The paper's stronger results on BERT than RoBERTa hint that the discrete prior interacts with model architecture; probing this difference could tell whether a better reordering prior would close the gap."],"forward_implications":["Federated fine-tuning of masked language models leaks training text through shared gradients even with frozen embedding layers, activated dropout, and no known labels or sequence lengths.","Freezing embeddings and activating dropout—individually recommended lightweight defenses—do not stop Grab; both together are the practical setting where the attack still outperforms baselines.","The attack's effectiveness degrades as batch size grows but remains substantial (about 40% ROUGE-1 at batch size 128), so larger batches reduce but do not eliminate the risk.","Gradient noise and gradient pruning defenses reduce recovery but only become effective at noise or pruning levels that destroy model utility measured by MCC."],"supporting_citations":[{"why":"Supplies the base attack framework, the baseline LAMP that Grab extends, and the benchmark setup and hyperparameters.","marker":"[4]"},{"why":"Introduces dropout mask learning that Grab adapts to language models to counter activated dropout.","marker":"[43]"},{"why":"Establishes the gradient inversion paradigm and provides the DLG baseline plus gradient noise and pruning defenses.","marker":"[55]"},{"why":"Provides the TAG baseline that shows direct continuous token recovery and the L1 gradient-distance term.","marker":"[8]"},{"why":"Defines BERT, the masked language model family used as the attack victim.","marker":"[9]"},{"why":"Is the textbook source of the beam search used for token reordering.","marker":"[42]"}],"fun_headline_variants":["Grab attack recovers up to 92.9% of private text from gradients","New attack steals up to 92.9% of training text from FL gradients","Gradient inversion resurfaces: up to 92.9% text recovery","Practical FL leak: Grab recovers up to 92.9% of private text"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack depends on the assumption that a single continuous dummy dropout mask, learned by gradient descent and clamped to $[0,1]$, can effectively stand in for the victim's randomly sampled per-forward-pass dropout masks, so that gradient matching still recovers tokens; the paper offers no guarantee that this holds when dropout masks are re-sampled every step.","fun_headline_variants_meta":{"raw":{"variants":["Grab attack recovers up to 92.9% of private text from gradients","New attack steals up to 92.9% of training text from FL gradients","Gradient inversion resurfaces: up to 92.9% text recovery","Practical FL leak: Grab recovers up to 92.9% of private text"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001398,"raw_usage":{"total_tokens":5634,"prompt_tokens":905,"completion_tokens":4729,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":521,"completion_tokens_details":{"reasoning_tokens":4641}},"tokens_in":521,"tokens_out":4729,"duration_ms":30434,"temperature":1.0,"reasoning_tokens":4641,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:41:33.261298+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Grab against a victim whose dropout mask is re-sampled on every forward pass during the gradient computation (the standard training regime), and compare the recovery rate with and without dropout mask learning; if the gap is negligible or recovery collapses, the claim that mask learning offsets dropout-induced noise in practical training is falsified. A complementary check: freeze the learned mask after optimization and verify that it matches the victim's realized mask statistics for the same input.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the base attack framework, the baseline LAMP that Grab extends, and the benchmark setup and hyperparameters."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces dropout mask learning that Grab adapts to language models to counter activated dropout."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes the gradient inversion paradigm and provides the DLG baseline plus gradient noise and pruning defenses."},{"cited_title":"2010.Artificial intelligence a modern approach","cited_arxiv_id":null,"evidence_quote":"Is the textbook source of the beam search used for token reordering."}],"review_version":2}