Small AI updates can still reveal private images

What leaves the device?

Federated learning lets clients train a shared model without sending their original training data to a central server. Instead, they transmit gradients—signals describing how model parameters should change—or updates accumulated over several training steps. Those signals can nevertheless reveal information about the images that produced them.

A study by Ritik K. Badiya and colleagues at the Indian Institute of Science investigates that risk in vision transformers using low-rank adaptation, or LoRA. Their paper is available as a November 2026 arXiv preprint; its landing page reports acceptance at WACV 2027.

LoRA makes fine-tuning cheaper by training small added matrices while leaving most pretrained weights fixed. Fewer changing parameters mean less information reaches the server. But the researchers ask a more specific question: does that information reduction prevent image reconstruction, or merely make it harder?

Why matching an update is not enough

A gradient-inversion attack searches for an image that would produce an update resembling the client's observed update. The difficulty is that several different images can produce very similar signals. A close gradient match therefore need not identify the original photograph.

Vision transformers process images as patches. Positional embeddings tell the model where those patches belong. When those embeddings remain frozen during fine-tuning, their gradients are unavailable to the attacker. Combined with LoRA's reduced information, this can leave reconstructions with scrambled patches or distorted content.

The team combines two ways of narrowing the possibilities. First, a pretrained image generator supplies plausible candidate images instead of unrestricted pixel noise. Second, additional trainable positional embeddings expose spatial clues through their gradients. The attacker adjusts the generator's input and parameters to match the observed updates.

The server chooses the architecture

This second ingredient is an important condition, not an incidental detail. The server supplies a modified transformer architecture before client training begins, adding positional embeddings at later transformer blocks and making positional embeddings trainable. The attack then uses the resulting positional gradients alongside LoRA and classification-layer gradients.

The authors describe an honest-but-curious server: it follows the specified local training procedure but tries to infer private data from updates. Nevertheless, it controls the architecture that clients accept. These experiments are not simply passive interception of updates from an unchanged, conventional LoRA model.

The reconstruction also assumes image labels are available. A generator trained on public imagery supplies prior knowledge; the paper describes its training data as similar to, but non-overlapping with, the targets. These assumptions matter when interpreting the results.

How much better were the reconstructions?

The main controlled comparison uses an ImageNet-pretrained ViT-Small, one client training step and one image per batch. Results average over ten users, with three independent reconstructions per sample.

On CIFAR-10's 32-by-32-pixel images, adding spatial anchoring to the generative attack GIAS raised peak signal-to-noise ratio, or PSNR, from 15.77 to 25.91 decibels. Structural similarity rose from 0.34 to 0.79, while LPIPS, a perceptual-distance measure where lower is better, fell from 0.120 to 0.022. These measure reconstruction similarity, not the probability of identifying someone.

For single-image experiments on 128-by-128 CelebA faces and 64-by-64 Stanford CARS images, PSNR improved by 7.83 and approximately 11.74 decibels, respectively.

Larger batches made reconstruction harder. Multiple local training steps also reduced the striking fidelity seen in the simplest setting: spatial anchoring improved GIAS by roughly 2.1–2.8 decibels in the tested multi-step configurations, but did not make it the best method on every metric. The headline CIFAR-10 comparison also used uniform initialization of both LoRA matrices; a supplementary test found lower scores with standard initialization and almost no benefit with LoRA-One initialization.

What protection did the experiments show?

A supplementary secure-aggregation experiment combined updates from four clients before reconstruction. Spatial anchoring still improved GIAS, particularly with one image per client. This demonstrates leakage from the aggregate in that small setup—not a failure of the cryptographic masking that hides individual updates.

Gradient clipping alone left substantial leakage. Stronger Gaussian perturbations sharply degraded both attacks, while experiments across federated training rounds showed reduced prediction accuracy as perturbations increased. Those results illustrate a privacy–utility trade-off, but do not establish a formal differential-privacy guarantee.

The central finding is conditional but useful: communicating fewer parameters does not itself establish privacy. What those parameters reveal—especially spatial information—also matters. The study demonstrates reconstruction under specified architectures, datasets and attacker knowledge, not universal recovery of images from every federated LoRA deployment.