From Efficiency to Leakage: Privacy Backdoors in Federated Language Model Fine-Tuning

The researchers propose NeuroImprint, a privacy backdoor attack against parameter-efficient fine-tuning (PEFT) in federated learning, in which a malicious parameter server can quietly turn the adapter into a backdoor that implicitly memorizes client training samples without degrading model utility. The attack assigns a dedicated memory neuron to each training sample and constrains each neuron to be updated at most once along the local fine-tuning trajectory, to mitigate cross-sample conflicts and cross-step mixing caused by large local batches and stateful optimizers such as Adam/AdamW; after fine-tuning completes, these isolated per-sample updates can be inverted in closed form to recover text embeddings, which are then deterministically mapped back to token sequences. The authors implemented and evaluated the attack on four language models—BERT, GPT-2, Qwen2, and Llama3.2—and four datasets from different domains, and the results show that 59% to 79% of fine-tuning samples can be reconstructed with high semantic fidelity.