From Efficiency to Leakage -- Privacy Backdoor in Federated Language Model Fine-Tuning

2026-06-18

AI Summary

This work addresses the vulnerability of parameter-efficient fine-tuning (PEFT) methods in federated language model training to privacy attacks, where a malicious server can extract clients’ private training data. The authors propose NeuroImprint, the first attack capable of sample-level privacy theft during PEFT. By implanting a backdoor into the adapter module and leveraging a single-update constraint combined with neuron isolation, the method binds each training sample’s gradient update to dedicated neurons, thereby circumventing optimizer-induced mixing and batch interference. This enables closed-form inversion to reconstruct the original input text. Experiments across BERT, GPT-2, Qwen2, and Llama3.2 demonstrate that NeuroImprint successfully recovers 59%–79% of fine-tuned samples with high semantic fidelity on four benchmark datasets.

Abstract

Federated learning (FL) enables multiple parties to collaboratively fine-tune language models for domain-specific tasks without sharing raw data. Since full model fine-tuning is often prohibitively expensive for FL clients, parameter-efficient fine-tuning (PEFT) has become the de facto approach in practice, freezing the base model and training only a small set of adapters. In this paper, we show that a malicious parameter server can stealthily corrupt a PEFT adapter into a privacy backdoor that implicitly memorizes the client's training samples as isolated per-sample parameter updates stored in separate neurons, without degrading model utility. Concretely, our attack, NeuroImprint, assigns a dedicated memorization neuron to each training sample and constrains that each neuron is updated at most once along the local fine-tuning trajectory. This design mitigates both cross-sample collisions and cross-step mixing introduced by large local batches and stateful optimizers (e.g., Adam/AdamW) in language-model fine-tuning. After fine-tuning, the resulting isolated per-sample updates can be analytically inverted in closed form to recover text embeddings, which are then deterministically mapped back to token sequences. To understand the generality of our method, we implemented NeuroImprint on multiple language models (BERT, GPT-2, Qwen2, and Llama3.2) and evaluated it across four fine-tuning datasets spanning diverse domains. The results demonstrate that our attack can reconstruct 59% to 79% of all finetuning samples with high semantic fidelity.

Problem

• Federated Learning
• Privacy Backdoor
• Parameter-Efficient Fine-Tuning
• Language Models
• Data Leakage

Innovation

• privacy backdoor
• parameter-efficient fine-tuning
• federated learning
• NeuroImprint
• sample reconstruction