DAGER: Exact gradient inversion attacks against large language models
DAGER: Exact Gradient Inversion for Large Language Models
Translation in progress — untranslated text is omitted.
Researchers from ETH Zurich and INSAIT propose DAGER, a gradient inversion attack against federated learning; the authors state it is the first algorithm that can exactly recover an entire batch of input text from shared gradients under the honest-but-curious setting. The method exploits the low-rank structure of self-attention layer gradients and the discreteness of token embeddings: it first recovers the token set at each position via a gradient column-space test, then reconstructs the full sequence using greedy reconstruction for decoders and heuristic search for encoders, without any data prior. Experiments show that DAGER achieves reconstruction quality with ROUGE-1/2 above 0.99 on GPT-2, LLaMa-2 and BERT, among which LLaMa-2 7B still achieves near-perfect reconstruction at batch size 128, is 20 times faster than prior attacks such as TAG and LAMP at the same batch size, and applies to FedAvg, LoRA fine-tuning and quantized models.
The paper shows that gradients shared in federated learning can be exactly recovered into an entire batch of training text; teams fine-tuning large models with federated learning can use this to re-examine their privacy assumptions.