DAGER: Exact Gradient Inversion for Large Language Models
This addresses privacy risks in federated learning for large language models, enabling exact data reconstruction where prior methods were limited, though it is incremental in improving attack efficiency and scalability.
The authors tackled the problem of gradient inversion attacks in federated learning for text data, proposing DAGER to exactly recover whole batches of input text from gradients, achieving recovery of batches up to size 128 with ROUGE-1/2 scores over 0.99 and 20x speed improvements.
Federated learning works by aggregating locally computed gradients from multiple clients, thus enabling collaborative training without sharing private client data. However, prior work has shown that the data can actually be recovered by the server using so-called gradient inversion attacks. While these attacks perform well when applied on images, they are limited in the text domain and only permit approximate reconstruction of small batches and short input sequences. In this work, we propose DAGER, the first algorithm to recover whole batches of input text exactly. DAGER leverages the low-rank structure of self-attention layer gradients and the discrete nature of token embeddings to efficiently check if a given token sequence is part of the client data. We use this check to exactly recover full batches in the honest-but-curious setting without any prior on the data for both encoder- and decoder-based architectures using exhaustive heuristic search and a greedy approach, respectively. We provide an efficient GPU implementation of DAGER and show experimentally that it recovers full batches of size up to 128 on large language models (LLMs), beating prior attacks in speed (20x at same batch size), scalability (10x larger batches), and reconstruction quality (ROUGE-1/2 > 0.99).