FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs

Syed Irfan Ali Meerza; Feiyi Wang; Jian Liu

cs.CRApr 7, 2026

FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs

Authors: Syed Irfan Ali Meerza, Feiyi Wang, Jian Liu

Organizations: University of Tennessee, Knoxville, TN, USA · Oak Ridge National Laboratory, Oak Ridge, USA · University of Georgia, Athens, GA, USA

Abstract

Given the growing reliance on private data in training Large Language Models (LLMs), Federated Learning (FL) combined with Parameter-Efficient Fine-Tuning (PEFT) has garnered significant attention for enhancing privacy and efficiency. Despite FL's privacy benefits, prior studies have shown that private data can still be extracted from shared gradients. However, these studies, mainly on full-parameter model training, are limited to reconstructing small batches, short input sequences, and specific model architectures, such as encoder-based or decoder-based models. The reconstruction quality becomes even worse when dealing with gradients from PEFT methods. To fully understand the practical attack surface of federated LLMs, this paper proposes FedSpy-LLM, a scalable and generalizable data reconstruction attack designed to reconstruct training data with larger batch sizes and longer sequences while generalizing across diverse model architectures, even when PEFT methods are deployed for training. At the core of FedSpy-LLM is a novel gradient decomposition strategy that exploits the rank deficiency and subspace structure of gradients, enabling efficient token extraction while preserving key signal components at scale. This approach further mitigates the reconstruction challenges introduced by PEFT's substantial null space, ensuring robustness across encoder-based, decoder-based, and encoder-decoder model architectures. Additionally, by iteratively aligning each token's partial-sequence gradient with the full-sequence gradient, FedSpy-LLM ensures accurate token ordering in reconstructed sequences.

Figures & tables

Attack	Year	Attack Method	Target Models 1	Max Batch Size	PEFT	Effectiveness Against 2			Time Complexity
Attack	Year	Attack Method	Target Models 1	Max Batch Size	PEFT	Encoder-based	Decoder-based	Encoder-Decoder	Time Complexity
DLG [ 1 ]	2019	Optimization	Encoder-based	1	$\times$	High	Medium	Low	$\mathcal{O}(B\cdot P\cdot d^{2})$
TAG [ 2 ]	2021	Optimization	Encoder-based	1	$\times$	High	Medium	Low	$\mathcal{O}(B\cdot P\cdot d^{2})$
LAMP [ 3 ]	2022	Optimization	Encoder-based	4	$\times$	High	Medium	Low	$\mathcal{O}(B\cdot P\cdot d^{2})$
BGP [ 4 ]	2022	Optimization + Search	Encoder-based	8	$\times$	High	N/A 3	Low	$\mathcal{O}(B\cdot d^{3})$
FILM [ 5 ]	2022	Search	Decoder-based	128	$\times$	Low	High	Medium	$\mathcal{O}(B\cdot\|V\|\cdot d)$

TABLE I: Comparison of state-of-the-art data reconstruction attacks on LLMs.

Fig. 1: Overview of FedSpy-LLM . FedSpy-LLM enables an adversary to reconstruct client training data by initializing a dummy input and iteratively updating it to match the client’s gradient. To reduce the search space, the server projects candidate tokens onto the gradient’s column space and recovers the correct sequence by comparing individual token gradients iteratively.

Dataset

Method

b

= 1

b

= 2

b

= 4

b

= 8

R-1

R-2

R-L

R-1

R-2

R-L

R-1

R-2

R-L

R-1

R-2

R-L

CoLA

DLG

58.6 ±1.2

7.6 ±0.4

45.5 ±1.1

36.2 ±1.3

2.5 ±0.3

30.9 ±1.2

34.8 ±1.5

1.3 ±0.2

31.4 ±1.4

16.1 ±1.0

0.7 ±0.1

7.6 ±0.9

TAG

78.1 ±1.0

10.0 ±0.5

52.7 ±1.1

44.9 ±1.2

4.5 ±0.4

36.2 ±1.0

34.9 ±1.3

1.5 ±0.2

30.8 ±1.1

32.8 ±1.2

1.5 ±0.2

29.9 ±1.0

LAMP

83.9 ±0.9

45.5 ±1.1

72.4 ±1.0

56.4 ±1.0

21.4 ±0.9

49.1 ±0.9

39.8 ±1.1

6.2 ±0.5

35.6 ±1.0

35.8 ±1.1

4.9 ±0.4

33.9 ±0.9

APRIL

83.8 ±0.8

45.3 ±1.0

72.1 ±0.9

56.2 ±0.9

21.5 ±0.8

48.9 ±0.8

40.6 ±1.0

7.6 ±0.6

39.5 ±1.0

36.6 ±1.0

5.0 ±0.4

33.8 ±0.8

FILM

84.0 ±0.9

44.6 ±1.0

71.8 ±1.0

56.6 ±1.0

18.9 ±0.8

49.2 ±0.9

43.2 ±1.1

11.1 ±0.7

39.6 ±1.1

37.1 ±1.0

5.7 ±0.5

34.2 ±0.9

TABLE II: Comparison of sequence reconstruction from gradients between FedSpy-LLM and other baseline algorithms on various batch sizes and datasets with BERT Base target model. R-1, R-2, and R-L denote the ROUGE-1, ROUGE-2, and ROUGE-L scores, respectively. All results are reported as mean

\pm

standard deviation over 10 independent runs.

Model	Dataset	Method	$b$ = 16			$b$ = 32			$b$ = 64			$b$ = 128
Model	Dataset	Method	R-1	R-2	R-L	R-1	R-2	R-L	R-1	R-2	R-L	R-1	R-2	R-L
GPT-2	CoLA	DAGER	100	100	63.7	91.2	87.6	56.1	86.3	71.6	43.2	24.2	11.3	10.5
	CoLA	FedSpy-LLM	93.2	76.6	63.7	63.6	42.1	29.5	47.7	42.8	6.9	33.3	28.5	15.9
	Rotten Tomatoes	DAGER	92.2	65.1	44.1	75.3	34.1	32.2	0.0	0.0	0.0	0.0	0.0	0.0
	Rotten Tomatoes	FedSpy-LLM	87.0	73.4	50.6	65.8	61.3	28.5	36.5	29.1	19.4	27.8	11.9	3.2
	MIMIC-III	DAGER	71.2	34.1	22.2	41.2	10.1	5.2	1.9	0.0	0.0	0.0	0.0	0.0

TABLE III: Comparison of sequence reconstruction from gradients between FedSpy-LLM and DAGER on larger batch sizes with different datasets and various model architectures. R-1, R-2, and R-L denote the ROUGE-1, ROUGE-2, ROUGE-L scores respectively.

Model	Method	w/o PEFT		SLoRA		FedAdapter
Model	Method	R-1	R-2	R-1	R-2	R-1	R-2
BERT Base	DLG	35.3	1.4	11.2	1.2	9.8	0.0
	TAG	35.3	1.6	12.5	1.3	11.3	1.7
	LAMP	40.4	6.4	15.1	7.2	8.8	2.6
	APRIL	41.2	7.8	17.3	8.1	17.8	5.7
	FILM	43.9	11.4	21.3	9.8	12.9	3.6

TABLE IV: Comparison of sequence reconstruction from gradients between FedSpy-LLM and other baseline algorithms under two different PEFT methods with

b

= 4 on CoLA dataset.

Dataset	Method	Sequence	Entity-F1 ( $\uparrow$ )
Rotten Tomatoes	Reference	some actors have so much charisma that you’d be happy to listen to them reading the phone book. hugh grant and sandra bullock are two such likable actors	-
	TAG	like happy so listen the the are so listen.. sandra grant actors like so ism you you	0.20
	LAMP	happy char sandra have such bull the to listen char sandra is hu happy them be phone the grant grant	0.27
	FILM	grant and sandra phone to be happy to char happy phone actors actors have so much	0.31
	BGP	be. the actors phone and the actors phone be . them so some d. to have such much charism. listen . sandra bullock.	0.32
	DAGER	some actors have so charisma much that you be’d happy them listen the phone book grant hugh and sandra bull are such actors likable	0.55

TABLE V: Text reconstruction comparison with

b

= 4. Yellow marks tokens recovered correctly, green shows correct n-grams.

Dataset	Model	Before Sequence Calibration			After Sequence Calibration
Dataset	Model	R-1	R-2	R-L	R-1	R-2	R-L
Rotten Tomatoes	BERT Base	76.9	8.3	22.0	76.9	63.2	59.1
	GPT-2	91.2	17.9	11.5	91.2	86.8	71.8
	Llama-2 (7B)	93.2	26.8	19.0	93.2	88.4	83.1
CoLA	BERT Base	91.6	13.4	12.2	91.6	90.1	86.9
	GPT-2	94.3	21.2	24.5	94.3	91.2	90.2

TABLE VI: Comparison of the reconstructed sequence before and after Sequence Order Calibration with

b

= 4.

Method	Additive Noise			Gradient Clipping			DP
	$\sigma=10^{-5}$			$\epsilon=0.3$			$\sigma=10^{-5}$ , $\epsilon=0.3$
	R-1	R-2	R-L	R-1	R-2	R-L	R-1	R-2	R-L
DLG	13.4	2.6	0.4	10.7	0.0	0.3	9.4	0.0	0.3
TAG	22.3	6.2	0.7	17.8	3.0	0.6	15.6	1.3	0.5
LAMP	19.7	6.0	1.8	15.8	2.8	1.4	13.8	1.2	1.3
APRIL	22.6	11.2	1.9	18.1	3.6	1.5	15.8	1.9	1.3

TABLE VII: Comparison of different baselines against privacy defenses, with BERT Base

(b=4)

on the Rotten Tomatoes dataset.

Model	$b$ = 1		$b$ = 8		$b$ = 32		$b$ = 64
Model	R-1	R-2	R-1	R-2	R-1	R-2	R-1	R-2
Llama-2 (7B)	99.3	99.1	93.6	89.2	65.6	48.1	51.7	45.8
Llama-2 (13B)	100.0	100.0	95.9	91.3	71.1	64.7	55.2	47.1
Llama-3.1 (8B)	98.5	95.2	94.2	90.1	66.7	49.3	52.3	46.7
Llama-3.1 (70B)	100.0	100.0	98.2	97.3	87.2	84.1	69.1	63.2

TABLE VIII: Effect of different model sizes on the performance of FedSpy-LLM . Experiment with different sizes of Llama-2 and 3.1 models trained on CoLA dataset.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 2: Impact of sequence length on the reconstruction efficiency.

Dataset	Model	L2		L1 + L2		Weighted Layer-wise Cosine Similarity
Dataset	Model	R-1	R-2	R-1	R-2	R-1	R-2
Rotten Tomatoes	BERT Base	68.9	50.4	71.5	57.8	76.9	63.2
	GPT-2	67.5	50.1	70.2	55.5	91.2	86.8
	Llama-2 (7B)	63.8	45.7	66.7	52.1	93.2	88.4
CoLA	BERT Base	66.9	50.5	69.5	59.2	91.6	90.1
	GPT-2	58.4	38.1	60.8	44.6	94.3	91.2

Appendix

TABLE IX: Comparison of the reconstructed sequence using different loss functions with

b

= 4.

Dataset	Model	Method	w/o PEFT		SLoRA		FedAdapter
Dataset	Model	Method	R-1	R-2	R-1	R-2	R-1	R-2
Rotten Tomatoes	BERT Base	LAMP	24.6	2.3	8.2	0.0	2.4	0.0
		DAGER	64.2	42.8	37.2	24.5	32.1	22.9
		FedSpy-LLM	76.9	63.2	61.5	50.5	46.1	38.5
	GPT-2	LAMP	6.3	1.2	0.0	0.0	0.0	0.0
		DAGER	97.2	91.2	58.3	44.7	43.7	31.1

Appendix

TABLE X: Comparison of sequence reconstruction from gradients between FedSpy-LLM and other baseline algorithms under two different PEFT methods with

b

= 4 on different datasets.

Model	$b$ = 1		$b$ = 8		$b$ = 32		$b$ = 64
Model	R-1	R-2	R-1	R-2	R-1	R-2	R-1	R-2
GPT-2 (Small)	100.0	100.0	94.1	90.8	91.2	87.6	86.3	71.6
GPT-2 (Medium)	100.0	100.0	93.7	90.1	85.3	81.1	77.9	67.6
GPT-2 (Large)	100.0	100.0	91.2	87.2	75.8	61.9	58.7	45.7

Appendix

TABLE XI: Effect of different model sizes on the performance of FedSpy-LLM . Experiment with different sizes of GPT-2 models trained on the CoLA dataset.

Gradient Inversion Attacks

Gradient inversion attacks infer private training examples or labels from gradients shared during distributed model training.

See all 20 papers

Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach
Apr 23, 2026Guilin Deng, Silong Chen, Yuchuan Luo +6Membership Inference Attacks Privacy Leakage in Language Models
Colleague of Computer Science and Technology, National University of Defense Technology, Changsha, China · City University of Hong Kong, Hong Kong, China · Shenzhen University, Shenzhen, China
SOMP: Scalable Gradient Inversion for Large Language Models via Subspace-Guided Orthogonal Matching Pursuit
Mar 17, 2026Yibo Li, Qiongxiu LiGradient Inversion Attacks Privacy Leakage in Language Models
Politecnico di Milano / Italy · Aalborg University
MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning
Aug 2, 2026Hasin Us Sami, Swapneel Sen, Basak GulerGradient Inversion Attacks Privacy Leakage in Language Models
University of California, Riverside, CA

Apr 23, 2026J/K move · Enter open · S save

Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach

Guilin Deng, Silong Chen, Yuchuan Luo, Yi Liu+5

Colleague of Computer Science and Technology, National University of Defense Technology, Changsha, China · City University of Hong Kong, Hong Kong, China · Shenzhen University, Shenzhen, China

Membership Inference Attacks Privacy Leakage in Language Models Federated Learning

Open paper AskPDF arXiv

Federated Large Language Models (FedLLMs) enable multiple parties to collaboratively fine-tune LLMs without sharing raw data, addressing challenges of limited resources and privacy concerns. Despite data localization, shared gradients can still expose sensitive information through membership inference attacks (MIAs). However, FedLLMs' unique properties, i.e. massive parameter scales, rapid convergence, and sparse, non-orthogonal gradients, render existing MIAs ineffective. To address this gap, we propose ProjRes, the first projection residuals-based passive MIA tailored for FedLLMs. ProjRes leverages hidden embedding vectors as sample representations and analyzes their projection residuals on the gradient subspace to uncover the intrinsic link between gradients and inputs. It requires no shadow models, auxiliary classifiers, or historical updates, ensuring efficiency and robustness. Experiments on four benchmarks and four LLMs show that ProjRes achieves near 100% accuracy, outperforming prior methods by up to 75.75%, and remains effective even under strong differential privacy defenses. Our findings reveal a previously overlooked privacy vulnerability in FedLLMs and call for a re-examination of their security assumptions. Our code and data are available at link.

Abstract

Gradient Inversion Attacks

Explore similar work

Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach

SOMP: Scalable Gradient Inversion for Large Language Models via Subspace-Guided Orthogonal Matching Pursuit

MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning