FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs

Syed Irfan Ali Meerza; Feiyi Wang; Jian Liu

cs.CRApr 7, 2026

FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs

Authors: Syed Irfan Ali Meerza, Feiyi Wang, Jian Liu

Organizations: University of Tennessee, Knoxville, TN, USA · Oak Ridge National Laboratory, Oak Ridge, USA · University of Georgia, Athens, GA, USA

Abstract

Given the growing reliance on private data in training Large Language Models (LLMs), Federated Learning (FL) combined with Parameter-Efficient Fine-Tuning (PEFT) has garnered significant attention for enhancing privacy and efficiency. Despite FL's privacy benefits, prior studies have shown that private data can still be extracted from shared gradients. However, these studies, mainly on full-parameter model training, are limited to reconstructing small batches, short input sequences, and specific model architectures, such as encoder-based or decoder-based models. The reconstruction quality becomes even worse when dealing with gradients from PEFT methods. To fully understand the practical attack surface of federated LLMs, this paper proposes FedSpy-LLM, a scalable and generalizable data reconstruction attack designed to reconstruct training data with larger batch sizes and longer sequences while generalizing across diverse model architectures, even when PEFT methods are deployed for training. At the core of FedSpy-LLM is a novel gradient decomposition strategy that exploits the rank deficiency and subspace structure of gradients, enabling efficient token extraction while preserving key signal components at scale. This approach further mitigates the reconstruction challenges introduced by PEFT's substantial null space, ensuring robustness across encoder-based, decoder-based, and encoder-decoder model architectures. Additionally, by iteratively aligning each token's partial-sequence gradient with the full-sequence gradient, FedSpy-LLM ensures accurate token ordering in reconstructed sequences.

Figures & tables

Attack	Year	Attack Method	Target Models 1	Max Batch Size	PEFT	Effectiveness Against 2			Time Complexity
Attack	Year	Attack Method	Target Models 1	Max Batch Size	PEFT	Encoder-based	Decoder-based	Encoder-Decoder	Time Complexity
DLG [ 1 ]	2019	Optimization	Encoder-based	1	$\times$	High	Medium	Low	$\mathcal{O}(B\cdot P\cdot d^{2})$
TAG [ 2 ]	2021	Optimization	Encoder-based	1	$\times$	High	Medium	Low	$\mathcal{O}(B\cdot P\cdot d^{2})$
LAMP [ 3 ]	2022	Optimization	Encoder-based	4	$\times$	High	Medium	Low	$\mathcal{O}(B\cdot P\cdot d^{2})$
BGP [ 4 ]	2022	Optimization + Search	Encoder-based	8	$\times$	High	N/A 3	Low	$\mathcal{O}(B\cdot d^{3})$
FILM [ 5 ]	2022	Search	Decoder-based	128	$\times$	Low	High	Medium	$\mathcal{O}(B\cdot\|V\|\cdot d)$

TABLE I: Comparison of state-of-the-art data reconstruction attacks on LLMs.

Fig. 1: Overview of FedSpy-LLM . FedSpy-LLM enables an adversary to reconstruct client training data by initializing a dummy input and iteratively updating it to match the client’s gradient. To reduce the search space, the server projects candidate tokens onto the gradient’s column space and recovers the correct sequence by comparing individual token gradients iteratively.

Dataset

Method

b

= 1

b

= 2

b

= 4

b

= 8

R-1

R-2

R-L

R-1

R-2

R-L

R-1

R-2

R-L

R-1

R-2

R-L

CoLA

DLG

58.6 ±1.2

7.6 ±0.4

45.5 ±1.1

36.2 ±1.3

2.5 ±0.3

30.9 ±1.2

34.8 ±1.5

1.3 ±0.2

31.4 ±1.4

16.1 ±1.0

0.7 ±0.1

7.6 ±0.9

TAG

78.1 ±1.0

10.0 ±0.5

52.7 ±1.1

44.9 ±1.2

4.5 ±0.4

36.2 ±1.0

34.9 ±1.3

1.5 ±0.2

30.8 ±1.1

32.8 ±1.2

1.5 ±0.2

29.9 ±1.0

LAMP

83.9 ±0.9

45.5 ±1.1

72.4 ±1.0

56.4 ±1.0

21.4 ±0.9

49.1 ±0.9

39.8 ±1.1

6.2 ±0.5

35.6 ±1.0

35.8 ±1.1

4.9 ±0.4

33.9 ±0.9

APRIL

83.8 ±0.8

45.3 ±1.0

72.1 ±0.9

56.2 ±0.9

21.5 ±0.8

48.9 ±0.8

40.6 ±1.0

7.6 ±0.6

39.5 ±1.0

36.6 ±1.0

5.0 ±0.4

33.8 ±0.8

FILM

84.0 ±0.9

44.6 ±1.0

71.8 ±1.0

56.6 ±1.0

18.9 ±0.8

49.2 ±0.9

43.2 ±1.1

11.1 ±0.7

39.6 ±1.1

37.1 ±1.0

5.7 ±0.5

34.2 ±0.9

TABLE II: Comparison of sequence reconstruction from gradients between FedSpy-LLM and other baseline algorithms on various batch sizes and datasets with BERT Base target model. R-1, R-2, and R-L denote the ROUGE-1, ROUGE-2, and ROUGE-L scores, respectively. All results are reported as mean

\pm

standard deviation over 10 independent runs.

Model	Dataset	Method	$b$ = 16			$b$ = 32			$b$ = 64			$b$ = 128
Model	Dataset	Method	R-1	R-2	R-L	R-1	R-2	R-L	R-1	R-2	R-L	R-1	R-2	R-L
GPT-2	CoLA	DAGER	100	100	63.7	91.2	87.6	56.1	86.3	71.6	43.2	24.2	11.3	10.5
	CoLA	FedSpy-LLM	93.2	76.6	63.7	63.6	42.1	29.5	47.7	42.8	6.9	33.3	28.5	15.9
	Rotten Tomatoes	DAGER	92.2	65.1	44.1	75.3	34.1	32.2	0.0	0.0	0.0	0.0	0.0	0.0
	Rotten Tomatoes	FedSpy-LLM	87.0	73.4	50.6	65.8	61.3	28.5	36.5	29.1	19.4	27.8	11.9	3.2
	MIMIC-III	DAGER	71.2	34.1	22.2	41.2	10.1	5.2	1.9	0.0	0.0	0.0	0.0	0.0

TABLE III: Comparison of sequence reconstruction from gradients between FedSpy-LLM and DAGER on larger batch sizes with different datasets and various model architectures. R-1, R-2, and R-L denote the ROUGE-1, ROUGE-2, ROUGE-L scores respectively.

Model	Method	w/o PEFT		SLoRA		FedAdapter
Model	Method	R-1	R-2	R-1	R-2	R-1	R-2
BERT Base	DLG	35.3	1.4	11.2	1.2	9.8	0.0
	TAG	35.3	1.6	12.5	1.3	11.3	1.7
	LAMP	40.4	6.4	15.1	7.2	8.8	2.6
	APRIL	41.2	7.8	17.3	8.1	17.8	5.7
	FILM	43.9	11.4	21.3	9.8	12.9	3.6

TABLE IV: Comparison of sequence reconstruction from gradients between FedSpy-LLM and other baseline algorithms under two different PEFT methods with

b

= 4 on CoLA dataset.

Dataset	Method	Sequence	Entity-F1 ( $\uparrow$ )
Rotten Tomatoes	Reference	some actors have so much charisma that you’d be happy to listen to them reading the phone book. hugh grant and sandra bullock are two such likable actors	-
	TAG	like happy so listen the the are so listen.. sandra grant actors like so ism you you	0.20
	LAMP	happy char sandra have such bull the to listen char sandra is hu happy them be phone the grant grant	0.27
	FILM	grant and sandra phone to be happy to char happy phone actors actors have so much	0.31
	BGP	be. the actors phone and the actors phone be . them so some d. to have such much charism. listen . sandra bullock.	0.32
	DAGER	some actors have so charisma much that you be’d happy them listen the phone book grant hugh and sandra bull are such actors likable	0.55

TABLE V: Text reconstruction comparison with

b

= 4. Yellow marks tokens recovered correctly, green shows correct n-grams.

Dataset	Model	Before Sequence Calibration			After Sequence Calibration
Dataset	Model	R-1	R-2	R-L	R-1	R-2	R-L
Rotten Tomatoes	BERT Base	76.9	8.3	22.0	76.9	63.2	59.1
	GPT-2	91.2	17.9	11.5	91.2	86.8	71.8
	Llama-2 (7B)	93.2	26.8	19.0	93.2	88.4	83.1
CoLA	BERT Base	91.6	13.4	12.2	91.6	90.1	86.9
	GPT-2	94.3	21.2	24.5	94.3	91.2	90.2

TABLE VI: Comparison of the reconstructed sequence before and after Sequence Order Calibration with

b

= 4.

Method	Additive Noise			Gradient Clipping			DP
	$\sigma=10^{-5}$			$\epsilon=0.3$			$\sigma=10^{-5}$ , $\epsilon=0.3$
	R-1	R-2	R-L	R-1	R-2	R-L	R-1	R-2	R-L
DLG	13.4	2.6	0.4	10.7	0.0	0.3	9.4	0.0	0.3
TAG	22.3	6.2	0.7	17.8	3.0	0.6	15.6	1.3	0.5
LAMP	19.7	6.0	1.8	15.8	2.8	1.4	13.8	1.2	1.3
APRIL	22.6	11.2	1.9	18.1	3.6	1.5	15.8	1.9	1.3

TABLE VII: Comparison of different baselines against privacy defenses, with BERT Base

(b=4)

on the Rotten Tomatoes dataset.

Model	$b$ = 1		$b$ = 8		$b$ = 32		$b$ = 64
Model	R-1	R-2	R-1	R-2	R-1	R-2	R-1	R-2
Llama-2 (7B)	99.3	99.1	93.6	89.2	65.6	48.1	51.7	45.8
Llama-2 (13B)	100.0	100.0	95.9	91.3	71.1	64.7	55.2	47.1
Llama-3.1 (8B)	98.5	95.2	94.2	90.1	66.7	49.3	52.3	46.7
Llama-3.1 (70B)	100.0	100.0	98.2	97.3	87.2	84.1	69.1	63.2

TABLE VIII: Effect of different model sizes on the performance of FedSpy-LLM . Experiment with different sizes of Llama-2 and 3.1 models trained on CoLA dataset.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 2: Impact of sequence length on the reconstruction efficiency.

Dataset	Model	L2		L1 + L2		Weighted Layer-wise Cosine Similarity
Dataset	Model	R-1	R-2	R-1	R-2	R-1	R-2
Rotten Tomatoes	BERT Base	68.9	50.4	71.5	57.8	76.9	63.2
	GPT-2	67.5	50.1	70.2	55.5	91.2	86.8
	Llama-2 (7B)	63.8	45.7	66.7	52.1	93.2	88.4
CoLA	BERT Base	66.9	50.5	69.5	59.2	91.6	90.1
	GPT-2	58.4	38.1	60.8	44.6	94.3	91.2

Appendix

TABLE IX: Comparison of the reconstructed sequence using different loss functions with

b

= 4.

Dataset	Model	Method	w/o PEFT		SLoRA		FedAdapter
Dataset	Model	Method	R-1	R-2	R-1	R-2	R-1	R-2
Rotten Tomatoes	BERT Base	LAMP	24.6	2.3	8.2	0.0	2.4	0.0
		DAGER	64.2	42.8	37.2	24.5	32.1	22.9
		FedSpy-LLM	76.9	63.2	61.5	50.5	46.1	38.5
	GPT-2	LAMP	6.3	1.2	0.0	0.0	0.0	0.0
		DAGER	97.2	91.2	58.3	44.7	43.7	31.1

Appendix

TABLE X: Comparison of sequence reconstruction from gradients between FedSpy-LLM and other baseline algorithms under two different PEFT methods with

b

= 4 on different datasets.

Model	$b$ = 1		$b$ = 8		$b$ = 32		$b$ = 64
Model	R-1	R-2	R-1	R-2	R-1	R-2	R-1	R-2
GPT-2 (Small)	100.0	100.0	94.1	90.8	91.2	87.6	86.3	71.6
GPT-2 (Medium)	100.0	100.0	93.7	90.1	85.3	81.1	77.9	67.6
GPT-2 (Large)	100.0	100.0	91.2	87.2	75.8	61.9	58.7	45.7

Appendix

TABLE XI: Effect of different model sizes on the performance of FedSpy-LLM . Experiment with different sizes of GPT-2 models trained on the CoLA dataset.

Gradient Inversion Attacks

Gradient inversion attacks infer private training examples or labels from gradients shared during distributed model training.

See all 20 papers

Apr 23, 2026

Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach

Federated Large Language Models (FedLLMs) enable multiple parties to collaboratively fine-tune LLMs without sharing raw data, addressing challenges of limited resources and privacy concerns. Despite data localization, shared gradients can still expose sensitive information through membership inference attacks (MIAs). However, FedLLMs' unique properties, i.e. massive parameter scales, rapid convergence, and sparse, non-orthogonal gradients, render existing MIAs ineffective. To address this gap, we propose ProjRes, the first projection residuals-based passive MIA tailored for FedLLMs. ProjRes leverages hidden embedding vectors as sample representations and analyzes their projection residuals on the gradient subspace to uncover the intrinsic link between gradients and inputs. It requires no shadow models, auxiliary classifiers, or historical updates, ensuring efficiency and robustness. Experiments on four benchmarks and four LLMs show that ProjRes achieves near 100% accuracy, outperforming prior methods by up to 75.75%, and remains effective even under strong differential privacy defenses. Our findings reveal a previously overlooked privacy vulnerability in FedLLMs and call for a re-examination of their security assumptions. Our code and data are available at link.

Guilin Deng, Silong Chen, Yuchuan Luo +6

Colleague of Computer Science and Technology, National University of Defense Technology, Changsha, China · City University of Hong Kong, Hong Kong, China · Shenzhen University, Shenzhen, China

Membership Inference Attacks Privacy Leakage in Language Models Federated Learning

Ask PDF

Mar 17, 2026

SOMP: Scalable Gradient Inversion for Large Language Models via Subspace-Guided Orthogonal Matching Pursuit

Gradient inversion attacks reveal that private training text can be reconstructed from shared gradients, posing a privacy risk to large language models (LLMs). While prior methods perform well in small-batch settings, scaling to larger batch sizes and longer sequences remains challenging due to severe signal mixing, high computational cost, and degraded fidelity. We present SOMP (Subspace-Guided Orthogonal Matching Pursuit), a scalable gradient inversion framework that casts text recovery from aggregated gradients as a sparse signal recovery problem. Our key insight is that aggregated transformer gradients retain exploitable head-wise geometric structure together with sample-level sparsity. SOMP leverages these properties to progressively narrow the search space and disentangle mixed signals without exhaustive search. Experiments across multiple LLM families, model scales, and five languages show that SOMP consistently outperforms prior methods in the aggregated-gradient regime.For long sequences at batch size B=16, SOMP achieves substantially higher reconstruction fidelity than strong baselines, while remaining computationally competitive. Even under extreme aggregation (up to B=128), SOMP still recovers meaningful text, suggesting that privacy leakage can persist in regimes where prior attacks become much less effective.

Yibo Li, Qiongxiu Li

Politecnico di Milano / Italy · Aalborg University

Gradient Inversion Attacks Privacy Leakage in Language Models LLM Security Inverse Problems

Ask PDF

Aug 2, 2026

MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning

Parameter-efficient fine-tuning (PEFT), such as low-rank adaptation (LoRA), has recently been adopted in federated learning to reduce communication and computation costs. In this setup, users download a pretrained model from the server prior to fine-tuning, and then fine-tune lightweight LoRA modules locally while keeping the pretrained model frozen, sharing only the gradients of the fine-tuning parameters with the server. Despite its growing popularity, robustness of federated fine-tuning against an adversarial server remains underexplored, where the server maliciously tampers with the training protocol to breach the privacy of users' data. In this work, we investigate gradient inversion attacks on LoRA fine-tuning. We propose an analytical attack that enables a malicious server to recover private user data by leveraging a poisoned pretrained model and fine-tuning parameters. Our design embeds fine-tuning data within the shared gradients, to allow the server to analytically reconstruct user data. Unlike prior works, our attack is applicable to both language and vision tasks, does not rely on computationally expensive (adversarial) pretraining with public datasets or require the number of training tokens to be less than the rank of LoRA modules. Experimental results on both language and vision tasks demonstrate high-fidelity data recovery across multiple baselines, revealing several critical vulnerabilities.

Hasin Us Sami, Swapneel Sen, Basak Guler

University of California, Riverside, CA

Gradient Inversion Attacks Privacy Leakage in Language Models Federated Fine-Tuning Parameter-Efficient Fine-Tuning

Ask PDF

Abstract

Gradient Inversion Attacks

Explore similar work

Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach

SOMP: Scalable Gradient Inversion for Large Language Models via Subspace-Guided Orthogonal Matching Pursuit

MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning