Pith. sign in

REVIEW 2 major objections 4 minor 70 references

Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning

T0 review · 2 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a malicious server can reconstruct a user's local fine-tuning images from adapter gradients alone, by crafting the pretrained ViT and adapter parameters before training.

desk verdict The blocking claim in Eq. (22) fails after bias cancellation, so the central recovery formula recovers a mixture rather than a single patch; the paper as written doesn't support its headline result, though the problem is real and the attempt is worth a serious look. read the letter →

arxiv 2506.04453 v1 pith:A4AIH64U submitted 2025-06-04 eess.IV cs.CRcs.CVcs.LG

Hasin Us Sami , Swapneel Sen , Amit K. Roy-Chowdhury , Srikanth V. Krishnamurthy , Basak Guler This is my paper
classification eess.IVcs.CRcs.CVcs.LG
keywords gradientinversionattackparameter-efficientfine-tuningadaptermodulesfederatedlearningvisiontransformerprivacyleakagemaliciousserverPEFTLeak
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether the popular practice of sharing only adapter gradients in federated learning protects user data, and argues it does not. It proposes an attack where the server poisons the frozen vision transformer and the adapter weights it distributes, so that the small gradients users send back contain enough information to rebuild their local image patches. The attack, called PEFTLeak, recovers 110 of 128 patches from a batch of 32 CIFAR-100 images, with comparable reconstruction on CIFAR-10, TinyImageNet, and ImageNet. If the paper is right, PEFT should not be treated as a built-in defense against gradient inversion under a malicious server.

What carries the argument

The engine of the attack is the recovery identity in Eq. (24): for two consecutive neurons j and j+1 in an adapter's down-projection, (∂L/∂w_j − ∂L/∂w_{j+1}) divided by (∂L/∂b_j − ∂L/∂b_{j+1}) equals the embedding y^(t,m). The identity holds when the target patch's pre-activation falls in the interval between the two neurons' bias thresholds, so it passes neuron j and is blocked at j+1. To make this happen, the server sets the weight of each neuron to the position-encoding vector E_pos^(t) and its bias to −(E_pos^(t))^T E_pos^(t) − c_j, with c_j quantiles of the estimated patch-statistic distribution; the frozen MSA, MLP, and LayerNorm blocks are simultaneously rewritten as identity maps so the embeddings arrive undistorted. This converts each neuron into a one-bin selector for a single image patch.

What would settle it

Run the attack exactly as specified (ViT-B/16, D=768, sigma=10, batch 32) and, for each neuron in the adapter down-projection, count how many patches across all positions and images give a positive pre-activation before the activation function; if the average count exceeds 1 by a wide margin, Eq. (24) does not hold and the recovered patches are mixtures.

Watch

Extended reading notes

Core claim

The paper's central claim is that a gradient inversion attack is viable for adapter-based PEFT, contrary to the belief that the reduced observable space blocks reconstruction. The server crafts the pretrained model so that LayerNorm, self-attention, and MLP blocks act as near-identity maps, letting patch embeddings reach the adapter unchanged. In the adapter's down-projection, each neuron's weight is set to a known position-encoding vector and its bias is chosen from quantiles of a Gaussian estimated from public data; this makes each neuron pass exactly one target patch through the activation. Taking the ratio of differences of weight and bias gradients of consecutive neurons (Eq. 24) then yields the target embedding, and subtracting the position encoding and applying the pseudoinverse projection recovers the raw patch. Because one adapter has only r neurons, the attack distributes recovery across many adapter layers, and for small r it collects new patches in successive training rounds.

Load-bearing premise

The recovery formula assumes that, for every neuron, exactly one image patch produces a positive pre-activation while all other patches are blocked by the designed biases; if non-target patches also activate the neuron, the gradient ratio averages many embeddings rather than recovering one.

Editorial extensions

If this is right

  • Lowering the adapter bottleneck dimension r slows the attack but does not stop it; with r=8, the full image is recovered from gradients across five training rounds.
  • Large batches still leak: PEFTLeak recovers 72.6% of patches at batch size 128 on CIFAR-100.
  • The attack transfers across model scales and patch sizes: ViT-L/16 recovers images in fewer rounds, and ViT-B/32 recovers a lower-resolution version when the patch dimension exceeds the embedding dimension.
  • Adding Gaussian noise, pruning, or stochastic quantization to the gradient degrades reconstruction but does not eliminate it.
  • Since a standard optimization-based inversion baseline fails under PEFT, the demonstrated leakage comes from the poisoned design rather than from generic gradient matching.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the attack is correct, the adapter's down-projection gradients should be treated as a sensitive channel: even r=8 leaks over rounds, so parameter count alone is not a useful privacy metric.
  • The same position-encoding-as-linear-probe design could be adapted to other PEFT methods that expose low-rank linear maps, such as LoRA, where the factor gradients might leak patch-level information in an analogous way.
  • The attack presupposes full server control of both the pretrained backbone and the adapter initialization; a trustworthy, publicly verified backbone would close this specific route and is a natural defense direction.
  • A concrete check on the paper's mechanism is to count, for each neuron, how many non-target patches produce positive pre-activations under the stated parameters; if that count is often greater than one, the Eq. (24) recovery is a mixture rather than a single patch, and the reported fidelity needs re-interpretation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes PEFTLeak, a gradient inversion attack against adapter-based parameter-efficient fine-tuning (PEFT) in federated learning. A malicious server crafts the frozen ViT backbone so that LayerNorm, MSA, and MLP layers act as identity mappings, and designs the adapter down-projection weights and biases so that each neuron's pre-activation is positive only for a single image patch whose statistic falls in a designated interval. Using the gradients of the adapter weights and biases, the server recovers the private patch embedding via the ratio of gradient differences, Eq. (24). Experiments on CIFAR-10/100, TinyImageNet, and ImageNet report high patch recovery rates, e.g., 85.9% for a batch of 32 CIFAR-100 images, and robustness analyses. The paper claims the first successful gradient inversion attack on PEFT.

Significance. If the mechanism is correct, the result is significant: it demonstrates that adapter-based PEFT in federated learning is vulnerable to gradient inversion by a malicious server, despite the limited number of shared adapter parameters. The paper builds on established poisoning-based inversion literature and extends it from full fine-tuning to PEFT, with a clear threat model and extensive experiments. The analytical construction for making the frozen layers transparent is detailed, and the paper includes multiple ablations and comparisons with optimization-based baselines. However, the central recovery mechanism is not fully specified and, as written, contains a critical gap in the up-projection design that invalidates the claimed use of many neurons.

major comments (2)
  1. [Section 4.3, 'Adapter Layer'; Algorithm 1 line 13] The described up-projection design makes the adapter gradients vanish for all but one neuron. Setting all up-projection weights to zero (and then one scalar weight to ~1e-6) yields dL/dw_j = (dL/dh)^T W_up[:,j] Act'(z_j) y, which is nonzero only for the first down-projection neuron. Consequently, ∂L/∂w_j and ∂L/∂b_j are zero for j=2,...,r, and Eq. (24) cannot be used for the many neuron pairs needed to recover the 110 patches in Fig. 4. Algorithm 1 line 13 even sets all up-projection weights to zero without the exception, which would make every adapter gradient zero. Please specify the exact up-projection matrix (e.g., W_up = ε 1_D 1_r^T or another full-rank form), show the resulting nonzero gradients for all r neurons, and update the pseudocode accordingly.
  2. [Section 4.3, Eqs. (21)-(24)] The gradient-difference quotient in Eq. (24) requires that any patch that activates both neuron j and neuron j+1 contributes the same scalar coefficient to both gradients, so that its contribution cancels in the difference. The paper does not state the up-projection structure needed for this property. With a generic small nonzero up-projection, the backpropagated coefficients ε(dL/dh)_j differ across neurons, so Eq. (24) recovers a weighted mixture of embeddings rather than a single y^(t,m). Please prove the cancellation or design weights such as constant columns W_up = ε 1_D 1_r^T that make the coefficients equal for all active neurons, and state this explicitly.
minor comments (4)
  1. [Section 4.3, Eq. (22)] The statement that non-target patches are blocked 'which follows from (12)' is imprecise. After substituting b_j from (19), v_j^(n,m) = (E_t)^T x_map^(n,m) + (E_t)^T (E_n − E_t) − c_j; the strong negativity actually comes from the subtracted diagonal term (E_t)^T E_t, which is large and dominates the cross term. The conclusion is correct, but the intermediate expression should be shown.
  2. [Algorithm 1] Line 13 sets all up-projection weights and biases to zero, which contradicts the exception described in Section 4.3 and would produce zero adapter gradients; the pseudocode must match the corrected design.
  3. [Section 4.4, Eq. (26)] The notation 'e^(n,m) ≜ (1 + 1)y^(n,m)' is unnecessarily confusing; write e^(n,m) = 2y^(n,m) instead.
  4. [Algorithm 1, line 16] The gradient notation '∂Li wA' is missing the partial symbol; it should read ∂L_i/∂w_A.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PEFTLeak's reconstruction is a self-contained attack derivation, and the flagged Eq. (22) concern is a correctness issue, not a circularity issue.

full rationale

The paper's derivation is not circular. The recovery step in Eq. (24) divides a difference of weight gradients by the corresponding bias gradients to obtain the target embedding y^(t,m). The attacker-chosen weights are set to the position-encoding vector E_pos^(t) and the biases are set from the inverse CDF of a Gaussian estimated from public data (Eqs. (18)–(19)); neither the weights, biases, nor interval boundaries are fitted to the victim's private patches. The victim's embedding y^(t,m) is the output of the formula, not an input to it, so the claim that gradients leak the embedding is a genuine derived consequence of the poisoned-model construction rather than a definitional restatement. The Gaussian patch-statistic prior is obtained from public data following prior external work [17,18], not from the target data, and the paper's own authors are not responsible for the load-bearing inversion framework; their self-citation [66] is only used for the unrelated claim that adapters are used in federated learning. The possible flaw identified in the blocking argument around Eq. (22) is a mathematical correctness concern about whether non-target patches are truly filtered after the bias cancels the diagonal position-encoding term; that is not a circularity pattern because the derivation does not assume its own conclusion. The attack is also benchmarked against an optimization-based baseline and against varying batch sizes, bottleneck dimensions, and architectures, so the empirical claims are externally evaluated rather than forced by construction. Overall, no load-bearing self-citation, fitted-input-renamed-as-prediction, or self-definitional reduction is present, and the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the assumption that position-encoding cross terms are negligible after bias cancellation, which is false for the stated construction. The other free parameters are design choices to make the backbone an identity mapping and calibrate the activation intervals; they are fitted to public data, not to private data.

free parameters (5)
  • position encoding scale sigma = 10
    Chosen by hand in Section 4.1 to make position encodings dominate the patch embeddings so LayerNorm and attention act as identity. The attack's blocking behavior and attention identity depend on this scale.
  • MLP bias magnitude gamma = 10^4
    Chosen in Section 4.5 to push GELU into its linear regime, ensuring the MLP acts as identity.
  • input embedding scale E = 0.5 I_D
    Chosen in Section 4.1 so that the mean and variance of the mapped patch embeddings are negligible relative to position encodings.
  • interval boundaries c_j = quantiles of N(0, sigma_pub^2)
    Computed in Eq. (18) from a Gaussian distribution estimated on a public dataset. These values set the neuron biases and determine which patches activate each neuron.
  • up-projection first weight = about 1e-6
    Small non-zero weight in the up-projection to avoid zero gradients while producing near-zero output (Section 4.3).
assumptions (5)
  • domain assumption The distribution of (E_pos^t)^T x_map for private data is approximately Gaussian and can be estimated from a public dataset.
    Used in Section 4.3 to set the interval boundaries c_j. If the private data distribution differs, the intervals are miscalibrated and recovery fails.
  • ad hoc to paper The cross terms (E_pos^t)^T E_pos^n are negligible after bias cancellation (Eqs. 12 and 22).
    Invoked to claim non-target patches are blocked. This is false for independent Gaussian position encodings of dimension D=768 with sigma=10; the cross terms have std about 2770, which is not negligible compared to the interval widths.
  • domain assumption A malicious server can modify both the pretrained backbone and the global adapter parameters without detection.
    Threat model stated in Section 3. This is standard in active attack literature, but it is a strong assumption about user trust.
  • domain assumption The victim uses the model as provided, without verifying its integrity.
    The attack depends on the victim downloading and fine-tuning the poisoned parameters.
  • standard math The attention matrix becomes identity because position encodings are large and independent (Eq. 12).
    This is a reasonable approximation for high-dimensional random vectors, though not exact.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning." pith.science (2026). https://pith.science/paper/A4AIH64U

@misc{pith2026250604453,
  author       = {Pith},
  title        = {Pith review of: Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A4AIH64U}},
  note         = {Machine review of arXiv:2506.04453}
}
read the original abstract

Federated learning (FL) allows multiple data-owners to collaboratively train machine learning models by exchanging local gradients, while keeping their private data on-device. To simultaneously enhance privacy and training efficiency, recently parameter-efficient fine-tuning (PEFT) of large-scale pretrained models has gained substantial attention in FL. While keeping a pretrained (backbone) model frozen, each user fine-tunes only a few lightweight modules to be used in conjunction, to fit specific downstream applications. Accordingly, only the gradients with respect to these lightweight modules are shared with the server. In this work, we investigate how the privacy of the fine-tuning data of the users can be compromised via a malicious design of the pretrained model and trainable adapter modules. We demonstrate gradient inversion attacks on a popular PEFT mechanism, the adapter, which allow an attacker to reconstruct local data samples of a target user, using only the accessible adapter gradients. Via extensive experiments, we demonstrate that a large batch of fine-tuning images can be retrieved with high fidelity. Our attack highlights the need for privacy-preserving mechanisms for PEFT, while opening up several future directions. Our code is available at https://github.com/info-ucr/PEFTLeak.

Figures

Figures reproduced from arXiv: 2506.04453 by the authors.

Figure 1
Figure 1. A small scale setup of PEFT based FL with [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. ViT encoder with adapter modules. ViT encoder with stacked LayerNorm, MSA, MLP layers and residual connections. An adapter module is inserted after each MSA/MLP layer, con￾sisting of two feed-forward blocks and a non-linearity in-between. 3. Problem Formulation We consider a typical centralized FL framework with U users. Training is controlled by a server -often an organi￾zation with abundant resources- who performs… view at source ↗
Figure 3
Figure 3. Image recovery from multiple adapters. A small-scale example with two adapters, each consisting of 3 neurons in the down-projection layer. The attacker aims to recover 4 images in the batch, where each image is divided into 4 patches. The biases for the two adapters are designed to recover patches from the sec￾ond position. The plot represents the distribution of patch statis￾tics, (E (t) pos) Tx (t,m) map for t = 2… view at source ↗
Figures from the paper (21 more)
Figure 4
Figure 4. Figure 4: CIFAR-100 (recovered images for a batch of [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: TinyImageNet (recovered images for a batch of [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 8
Figure 8. Figure 8: Recovered images with attack from [20] (CIFAR-100). mentioned earlier, each user sends the adapter gradients to the server in each training round, while the pretrained model is kept frozen. The server sends the aggregated adapter pa￾rameters in each training round back…
Figure 6
Figure 6. Figure 6: Percentage of patches recovered with varying batch size, [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Patches recovered over multiple rounds ( [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 9
Figure 9. Figure 9: CIFAR-10 (recovered images for a batch of [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Comparison with optimization-based benchmark from [ [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: Comparison with optimization-based benchmark from [ [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]
Figure 12
Figure 12. Figure 12: Percentage of patches recovered with varying batch size, bottleneck dimension, and number of adapter layers used within a [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: Percentage of patches recovered with varying batch size, bottleneck dimension, and number of adapter layers used within a [PITH_FULL_IMAGE:figures/full_fig_p014_13.png]
Figure 14
Figure 14. Figure 14: Recovered images from different model architectures. [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]
Figure 15
Figure 15. Figure 15: Recovered patches from the first position using multiple adapter layers (CIFAR-10). [PITH_FULL_IMAGE:figures/full_fig_p015_15.png]
Figure 16
Figure 16. Figure 16: Recovered patches from the first position using multiple adapter layers (CIFAR-100). [PITH_FULL_IMAGE:figures/full_fig_p015_16.png]
Figure 17
Figure 17. Figure 17: Recovered patches from the first position using multiple adapter layers (TinyImageNet). None of the patches are recovered [PITH_FULL_IMAGE:figures/full_fig_p016_17.png]
Figure 18
Figure 18. Figure 18: Impact of bottleneck dimension r on patch reconstruction (CIFAR-10). (a) r = 8 (b) r = 64 [PITH_FULL_IMAGE:figures/full_fig_p016_18.png]
Figure 19
Figure 19. Figure 19: Impact of bottleneck dimension r on patch reconstruction (CIFAR-100). (a) r = 8 (b) r = 64 [PITH_FULL_IMAGE:figures/full_fig_p016_19.png]
Figure 20
Figure 20. Figure 20: Impact of bottleneck dimension r on patch reconstruction (TinyImageNet) [PITH_FULL_IMAGE:figures/full_fig_p016_20.png]
Figure 21
Figure 21. Figure 21: Performance against mitigation strategies (CIFAR-100, batch size [PITH_FULL_IMAGE:figures/full_fig_p017_21.png]
Figure 22
Figure 22. Figure 22: Recovered images for FedAvg with 5 local training rounds (CIFAR-100). (a) Original images (b) Recovered (PEFTLeak) [PITH_FULL_IMAGE:figures/full_fig_p017_22.png]
Figure 23
Figure 23. Figure 23: Recovered images for a batch of size 64 (CIFAR-100). (a) Ground-truth (b) Recovered [PITH_FULL_IMAGE:figures/full_fig_p017_23.png]
Figure 24
Figure 24. Figure 24: Recovered images (ImageNet) [PITH_FULL_IMAGE:figures/full_fig_p017_24.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

70 extracted references · 70 canonical work pages

  1. [1]

    Goodfellow, H

    Mart ´ın Abadi, Andy Chu, Ian J. Goodfellow, H. B. McMa- han, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. Proceedings of the ACM SIGSAC Conference on Computer and Communications Se- curity, 2016. 15

    work page 2016

  2. [2]

    John Abascal, Stanley Wu, Alina Oprea, and Jonathan R. Ullman. Tmi! finetuned models leak private information from their pretraining data. Proc. Priv. Enhancing Technol., 2024(3):202–223, 2024. 2

    work page 2024

  3. [3]

    QSGD: communication-efficient SGD via gradient quantization and encoding

    Dan Alistarh, Demjan Grubic, Jerry Li, Ryota Tomioka, and Milan V ojnovic. QSGD: communication-efficient SGD via gradient quantization and encoding. In Advances in Neu- ral Information Processing Systems (Neurips), pages 1709– 1720, 2017. 15

    work page 2017

  4. [4]

    The con- vergence of sparsified gradient methods

    Dan Alistarh, Torsten Hoefler, Mikael Johansson, Nikola Konstantinov, Sarit Khirirat, and C ´edric Renggli. The con- vergence of sparsified gradient methods. InAdvances in Neu- ral Information Processing Systems (Neurips), pages 5977– 5987, 2018. 15

    work page 2018

  5. [5]

    When the curious abandon honesty: Federated learning is not private

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Paper- not. When the curious abandon honesty: Federated learning is not private. In 8th IEEE European Symposium on Security and Privacy, EuroS&P, pages 175–199, 2023. 2

    work page 2023

  6. [6]

    Tinytl: Reduce memory, not parameters for efficient on-device learning

    Han Cai, Chuang Gan, Ligeng Zhu, and Song Han. Tinytl: Reduce memory, not parameters for efficient on-device learning. In Neural Information Processing Systems , 2020. 2

    work page 2020

  7. [7]

    Brown, Dawn Song, ´Ulfar Erlingsson, Alina Oprea, and Colin Raffel

    Nicholas Carlini, Florian Tram `er, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Song, ´Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large lan- guage models. In 30th USENIX Security Symposium, pages 2633–2650, 2021. 2

    work page 2021

  8. [8]

    Adaptformer: Adapting vision transformers for scalable visual recogni- tion

    Shoufa Chen, Chongjian Ge, Zhan Tong, Jiangliu Wang, Yibing Song, Jue Wang, and Ping Luo. Adaptformer: Adapting vision transformers for scalable visual recogni- tion. In Advances in Neural Information Processing Systems (Neurips), 2022. 1, 2, 4, 5

    work page 2022

Show all 70 references
  1. [9]

    The janus interface: How fine-tuning in large language models amplifies the privacy risks

    Xiaoyi Chen, Siyuan Tang, Rui Zhu, Shijun Yan, Lei Jin, Zihao Wang, Liya Su, XiaoFeng Wang, and Haixu Tang. The janus interface: How fine-tuning in large language models amplifies the privacy risks. Arxiv, 2023. 2

    2023

  2. [10]

    Fowl, Micah Gold- blum, and Tom Goldstein

    Hong-Min Chu, Jonas Geiping, Liam H. Fowl, Micah Gold- blum, and Tom Goldstein. Panning for gold in federated learning: Targeted text extraction under arbitrarily large- scale aggregation. In The Eleventh International Conference on Learning Representations, ICLR, 2023. 2, 3

    2023

  3. [11]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In IEEE Conference on Computer Vision and Pat- tern Recognition, pages 248–255, 2009. 8

    2009

  4. [12]

    Effi- cient adaptation of large vision transformer via adapter re- composing

    Wei Dong, Dawei Yan, Zhijun Lin, and Peng Wang. Effi- cient adaptation of large vision transformer via adapter re- composing. In Advances in Neural Information Processing Systems (Neurips), 2023. 1, 2

    2023

  5. [13]

    Low-rank rescaled vision transformer fine-tuning: A residual design approach

    Wei Dong, Xing Zhang, Bihui Chen, Dawei Yan, Zhijun Lin, Qingsen Yan, Peng Wang, and Yang Yang. Low-rank rescaled vision transformer fine-tuning: A residual design approach. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, pages 16101–16110. IEEE,

  6. [14]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition ...

    2021

  7. [15]

    GIFD: A generative gradient inversion method with fea- ture domain optimization

    Hao Fang, Bin Chen, Xuan Wang, Zhi Wang, and Shu-Tao Xia. GIFD: A generative gradient inversion method with fea- ture domain optimization. In IEEE/CVF International Con- ference on Computer Vision, ICCV 2023, Paris, France, Oc- tober 1-6, 2023, pages 4944–4953. IEEE, 2023. 2

    2023

  8. [16]

    Privacy backdoors: Stealing data with corrupted pretrained models

    Shanglun Feng and Florian Tram `er. Privacy backdoors: Stealing data with corrupted pretrained models. In Forty- first International Conference on Machine Learning, ICML ,

  9. [17]

    Fowl, Jonas Geiping, Wojciech Czaja, Micah Gold- blum, and Tom Goldstein

    Liam H. Fowl, Jonas Geiping, Wojciech Czaja, Micah Gold- blum, and Tom Goldstein. Robbing the fed: Directly obtain- ing private data in federated learning with modified models. In The Tenth International Conference on Learning Repre- sentations, ICLR, 2022. 1, 4, 5, 6, 15

    2022

  10. [18]

    Fowl, Jonas Geiping, Steven Reich, Yuxin Wen, Wojciech Czaja, Micah Goldblum, and Tom Goldstein

    Liam H. Fowl, Jonas Geiping, Steven Reich, Yuxin Wen, Wojciech Czaja, Micah Goldblum, and Tom Goldstein. De- cepticons: Corrupted transformers breach privacy in feder- ated learning for language models. In The Eleventh Interna- tional Conference on Learning Representations, IC...

    2023

  11. [19]

    Practical membership inference attacks against fine-tuned large language models via self- prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical membership inference attacks against fine-tuned large language models via self- prompt calibration. Arxiv, 2023. 2

    2023

  12. [20]

    Inverting gradients - how easy is it to break privacy in federated learning? In Advances in Neural Infor- mation Processing Systems (NeurIPS), 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dr ¨oge, and Michael Moeller. Inverting gradients - how easy is it to break privacy in federated learning? In Advances in Neural Infor- mation Processing Systems (NeurIPS), 2020. 1, 2, 8, 12, 13

    2020

  13. [21]

    Gradvit: Gradi- ent inversion of vision transformers

    Ali Hatamizadeh, Hongxu Yin, Holger Roth, Wenqi Li, Jan Kautz, Daguang Xu, and Pavlo Molchanov. Gradvit: Gradi- ent inversion of vision transformers. In IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, CVPR , pages 10011–10020. IEEE, 2022. 1, 2

    2022

  14. [22]

    Gaussian error linear units (gelus)

    Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv, 2016. 3

    2016

  15. [23]

    Parameter-efficient transfer learning for NLP

    Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin de Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter-efficient transfer learning for NLP. In Proceedings of the 36th International Conference on Machine Learning, ICML, pages 2...

    2019

  16. [24]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. In The Tenth International Conference on Learning Represen- tations, ICLR, 2022. 1, 2

    2022

  17. [25]

    Evaluating gradient inversion attacks and de- fenses in federated learning

    Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and de- fenses in federated learning. In Advances in Neural Informa- tion Processing Systems (Neurips), pages 7232–7241, 2021. 1

    2021

  18. [26]

    Gradient inversion with generative image prior

    Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradient inversion with generative image prior. In Advances in Neural Information Processing Systems (NeurIPS), pages 29898–29908, 2021. 1, 2

    2021

  19. [27]

    Belongie, Bharath Hariharan, and Ser-Nam Lim

    Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge J. Belongie, Bharath Hariharan, and Ser-Nam Lim. Vi- sual prompt tuning. In European Conference on Computer Vision ECCV, pages 709–727, 2022. 2

    2022

  20. [28]

    Edward Suh, Moinuddin K

    Sanjay Kariyappa, Chuan Guo, Kiwan Maeng, Wenjie Xiong, G. Edward Suh, Moinuddin K. Qureshi, and Hsien- Hsin S. Lee. Cocktail party attack: Breaking aggregation- based privacy in federated learning using independent com- ponent analysis. In International Conference on Machine ...

    2023

  21. [29]

    Client-customized adaptation for parameter-efficient federated learning

    Yeachan Kim, Junho Kim, Wing-Lam Mok, Jun-Hyung Park, and SangKeun Lee. Client-customized adaptation for parameter-efficient federated learning. In Findings of the As- sociation for Computational Linguistics: ACL , pages 1159– 1172, 2023. 1, 2

    2023

  22. [30]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009. 2, 7

    2009

  23. [31]

    Tiny imagenet visual recognition challenge

    Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. 2015. 2, 7

    2015

  24. [32]

    The power of scale for parameter-efficient prompt tuning

    Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. In Proceed- ings of the 2021 Conference on Empirical Methods in Natu- ral Language Processing, EMNLP, pages 3045–3059, 2021. 2

    2021

  25. [33]

    Prefix-tuning: Optimizing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, ACL/IJCNLP , pages...

    2021

  26. [34]

    Au- diting privacy defenses in federated learning via generative gradient leakage

    Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Au- diting privacy defenses in federated learning via generative gradient leakage. In IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, CVPR , pages 10122–10132. IEEE, 2022. 2

    2022

  27. [35]

    Deep gradient compression: Reducing the communication bandwidth for distributed training

    Yujun Lin, Song Han, Huizi Mao, Yu Wang, and Bill Dally. Deep gradient compression: Reducing the communication bandwidth for distributed training. In 6th International Con- ference on Learning Representations, ICLR, 2018. 15

    2018

  28. [36]

    Pre- curious: How innocent pre-trained language models turn into privacy traps

    Ruixuan Liu, Tianhao Wang, Yang Cao, and Li Xiong. Pre- curious: How innocent pre-trained language models turn into privacy traps. In Proceedings of the on ACM SIGSAC Con- ference on Computer and Communications Security, CCS , pages 3511–3524, 2024. 1, 2

    2024

  29. [37]

    APRIL: finding the achilles’ heel on privacy for vision transformers

    Jiahao Lu, Xi Sheryl Zhang, Tianli Zhao, Xiangyu He, and Jian Cheng. APRIL: finding the achilles’ heel on privacy for vision transformers. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, pages 10041–10050. IEEE, 2022. 1, 2

    2022

  30. [38]

    Analyzing leak- age of personally identifiable information in language mod- els

    Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella B ´eguelin. Analyzing leak- age of personally identifiable information in language mod- els. In 44th IEEE Symposium on Security and Privacy, SP , pages 346–363. IEEE, 2023. 2

    2023

  31. [39]

    Re- ducing communication overhead in federated learning for pre-trained language models using parameter-efficient fine- tuning

    Shubham Malaviya, Manish Shukla, and Sachin Lodha. Re- ducing communication overhead in federated learning for pre-trained language models using parameter-efficient fine- tuning. In Proceedings of The 2nd Conference on Lifelong Learning Agents, pages 456–469, 2023. 1

    2023

  32. [40]

    Mini but mighty: Finetuning vits with mini adapters

    Imad Eddine Marouf, Enzo Tartaglione, and St ´ephane Lath- uili`ere. Mini but mighty: Finetuning vits with mini adapters. In IEEE/CVF Winter Conference on Applications of Com- puter Vision, WACV, pages 1721–1730. IEEE, 2024. 1, 2, 3, 4

    2024

  33. [41]

    Communication- efficient learning of deep networks from decentralized data

    H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. In Int. Conf. on Artificial Int. and Stat. (AISTATS), 2017. 1

    2017

  34. [42]

    Shokri, and Amir Houmansadr

    Milad Nasr, R. Shokri, and Amir Houmansadr. Comprehen- sive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. IEEE Symposium on Security and Privacy (SP) , pages 739–753, 2019. 1, 2

    2019

  35. [43]

    John Nguyen, Jianyu Wang, Kshitiz Malik, Maziar Sanjabi, and Michael G. Rabbat. Where to begin? on the impact of pre-training and initialization in federated learning. In The Eleventh International Conference on Learning Representa- tions, ICLR, 2023. 1

    2023

  36. [44]

    Truc D. T. Nguyen, Phung Lai, Khang Tran, NhatHai Phan, and My T. Thai. Active membership inference attack un- der local differential privacy in federated learning. In Inter- national Conference on Artificial Intelligence and Statistics, pages 5714–5730, 2023. 1

    2023

  37. [45]

    Eluding secure aggregation in federated learning via model inconsistency

    Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. Eluding secure aggregation in federated learning via model inconsistency. In Conference on Computer and Communica- tions Security, CCS, pages 2429–2443. ACM, 2022. 4

    2022

  38. [46]

    Adapterhub: A framework for adapting transformers

    Jonas Pfeiffer, Andreas R ¨uckl´e, Clifton Poth, Aishwarya Ka- math, Ivan Vulic, Sebastian Ruder, Kyunghyun Cho, and Iryna Gurevych. Adapterhub: A framework for adapting transformers. In Proceedings of the 2020 Conference on Em- pirical Methods in Natural Language Processing E...

    2020

  39. [47]

    Liangqiong Qu, Yuyin Zhou, Paul Pu Liang, Yingda Xia, Feifei Wang, Li Fei-Fei, Ehsan Adeli, and Daniel L. Rubin. Rethinking architecture design for tackling data heterogene- ity in federated learning. IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pag...

    2022

  40. [48]

    Dropout is NOT all you need to prevent gradient leakage

    Daniel Scheliga, Patrick Maeder, and Marco Seeland. Dropout is NOT all you need to prevent gradient leakage. In Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI, pages 9733–9741, 2023. 2

    2023

  41. [49]

    Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov

    R. Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. 2017 IEEE Symposium on Security and Privacy (SP), pages 3–18, 2016. 1, 2

    2017

  42. [50]

    Aliaksandra Shysheya, John Bronskill, Massimiliano Patac- chiola, Sebastian Nowozin, and Richard E. Turner. Fit: Pa- rameter efficient few-shot transfer learning for personalized and federated image classification. In The Eleventh Interna- tional Conference on Learning Represe...

    2023

  43. [51]

    Systematic evaluation of pri- vacy risks of machine learning models

    Liwei Song and Prateek Mittal. Systematic evaluation of pri- vacy risks of machine learning models. In 30th USENIX Se- curity Symposium, pages 2615–2632. USENIX Association,

  44. [52]

    Im- proving lora in privacy-preserving federated learning

    Youbang Sun, Zitao Li, Yaliang Li, and Bolin Ding. Im- proving lora in privacy-preserving federated learning. InThe Twelfth International Conference on Learning Representa- tions, ICLR, 2024. 1

    2024

  45. [53]

    VL- ADAPTER: parameter-efficient transfer learning for vision- and-language tasks

    Yi-Lin Sung, Jaemin Cho, and Mohit Bansal. VL- ADAPTER: parameter-efficient transfer learning for vision- and-language tasks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR , pages 5217–5227,

  46. [54]

    Manipulating transfer learning for property inference

    Yulong Tian, Fnu Suya, Anshuman Suri, Fengyuan Xu, and David Evans. Manipulating transfer learning for property inference. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, pages 15975–15984. IEEE,

  47. [55]

    Vu, Truc D

    Minh N. Vu, Truc D. T. Nguyen, Tre’ R. Jeter, and My T. Thai. Analysis of privacy leakage in federated large lan- guage models. In International Conference on Artificial In- telligence and Statistics, pages 1423–1431. PMLR, 2024. 1, 2

    2024

  48. [56]

    Sheikh, and Eero P

    Zhou Wang, Alan Conrad Bovik, Hamid R. Sheikh, and Eero P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Im- age Processing, 13:600–612, 2004. 7

    2004

  49. [57]

    Pretrained models for multilingual federated learning

    Orion Weller, Marc Marone, Vladimir Braverman, Dawn Lawrie, and Benjamin Van Durme. Pretrained models for multilingual federated learning. In Proceedings of the 2022 Conference of the North American Chapter of the Associa- tion for Computational Linguistics, pages 1413–1421, 2022. 1

    2022

  50. [58]

    Batched low-rank adap- tation of foundation models

    Yeming Wen and Swarat Chaudhuri. Batched low-rank adap- tation of foundation models. In The Twelfth International Conference on Learning Representations, ICLR, 2024. 2

    2024

  51. [59]

    Fishing for user data in large-batch fed- erated learning via gradient magnification

    Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in large-batch fed- erated learning via gradient magnification. In International Conference on Machine Learning, ICML , pages 23668– 23684, 2022. 1

    2022

  52. [60]

    Privacy back- doors: Enhancing membership inference through poisoning pre-trained models

    Yuxin Wen, Leo Marchyok, Sanghyun Hong, Jonas Geip- ing, Tom Goldstein, and Nicholas Carlini. Privacy back- doors: Enhancing membership inference through poisoning pre-trained models. In Annual Conference on Neural Infor- mation Processing Systems (Neurips), 2024. 1, 2

    2024

  53. [61]

    Perada: Parameter-efficient federated learning personalization with generalization guarantees

    Chulin Xie, De-An Huang, Wenda Chu, Daguang Xu, Chaowei Xiao, Bo Li, and Anima Anandkumar. Perada: Parameter-efficient federated learning personalization with generalization guarantees. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR , pages 23838–23848...

    2024

  54. [62]

    Efficient low-rank backprop- agation for vision transformer adaptation

    Yuedong Yang, Hung-Yueh Chiang, Guihong Li, Diana Mar- culescu, and Radu Marculescu. Efficient low-rank backprop- agation for vision transformer adaptation. In Advances in Neural Information Processing Systems (NeurIPS), 2023. 2

    2023

  55. [63]

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov. See through gradients: Image batch recovery via gradinversion. In IEEE/CVF Conf. on Computer Vision and Pattern Recognition, 2021. 1, 2

    2021

  56. [64]

    How does a deep learning model architecture impact its privacy? A comprehensive study of privacy attacks on cnns and transformers

    Guangsheng Zhang, Bo Liu, Huan Tian, Tianqing Zhu, Ming Ding, and Wanlei Zhou. How does a deep learning model architecture impact its privacy? A comprehensive study of privacy attacks on cnns and transformers. In 33rd USENIX Security Symposium, USENIX, 2024. 1, 2

    2024

  57. [65]

    Efros, Eli Shecht- man, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In 2018 IEEE Confer- ence on Computer Vision and Pattern Recognition, CVPR , pages 586–595, 2018. 7, 15

    2018

  58. [66]

    Roy-Chowdhury, Ananda Theertha Suresh, and Samet Oymak

    Xuechen Zhang, Mingchen Li, Xiangyu Chang, Jiasi Chen, Amit K. Roy-Chowdhury, Ananda Theertha Suresh, and Samet Oymak. Fedyolo: Augmenting federated learning with pretrained transformers. Arxiv, 2023. 1, 2, 3

    2023

  59. [67]

    Fedpetuning: When fed- erated learning meets the parameter-efficient tuning methods of pre-trained language models

    Zhuo Zhang, Yuanhang Yang, Yong Dai, Qifan Wang, Yue Yu, Lizhen Qu, and Zenglin Xu. Fedpetuning: When fed- erated learning meets the parameter-efficient tuning methods of pre-trained language models. In Findings of the Associa- tion for Computational Linguistics: ACL, pages 9963–9977,

  60. [68]

    J. Zhao, A. Sharma, A. Elkordy, Y . H. Ezzeldin, S. Aves- timehr, and S. Bagchi. Loki: Large-scale data reconstruction attack against federated learning through model manipula- tion. In 2024 IEEE Symposium on Security and Privacy (SP),

    2024

  61. [69]

    Zhao, Ahmed Roushdy Elkordy, Atul Sharma, Yahya H

    Joshua C. Zhao, Ahmed Roushdy Elkordy, Atul Sharma, Yahya H. Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. The resource problem of using linear layer leak- age attack in federated learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR , pages 3974...

    2023

  62. [70]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Advances in Neural Information Processing Systems (NeurIPS), 2019. 1, 2, 12 Appendix A. Ethical Considerations Our work points to potential privacy threats that may occur when parameter-efficient fine-tunin...

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.