The paper investigates privacy and integrity risks in federated fine‑tuning of a pretrained MobileNetV4 model on Quick, Draw! data. It shows that a single client update can reveal private labels, that label‑count recovery degrades with more clients, and that backdoor and label‑flipping attacks can succeed under FedAvg but are mitigated by FLTrust. The study also demonstrates a live poisoning session using Indigma’s FedMaestro orchestrator.
By Vasileios Perifanis, Nikolaos Pavlidis
arXiv:2607. 27940v1 Announce Type: new Abstract: Federated fine-tuning of large language models (LLMs) enables collaborative training without exposing raw data.
By Cheng Wei (Honor Device Co., Ltd., Shenzhen, China)
arXiv:2602. 11510v3 Announce Type: replace Abstract: Multi-agent Large Language Model (LLM) systems create privacy risks that current output-only benchmarks cannot measure.
By Faouzi El Yagoubi, Godwin Badu-Marfo, Ranwa Al Mallah
HE‑OFT is a cryptographically secure one‑shot federated fine‑tuning protocol that protects privacy by exchanging only one encrypted contribution and never revealing the trained model. Each client fine‑tunes a low‑rank adapter and a classifier head on a frozen public backbone, keeps the adapter, and uploads an encrypted head displacement that the server combines using multiparty CKKS without decryption. On four text classification tasks and one vision task, HE‑OFT achieves 61–79 % accuracy, retaining 85–96 % of the accuracy of a disclosed model, while a test‑time query takes 443.1–1713.1 s on one core or 56.1–255.1 s on a GPU, with level restoration reducing traffic from 1.6 GiB to 13.5 MiB.
By Halil \.Ibrahim Kanpak, Sinem Sav, Alptekin K\"up\c{c}\"u
arXiv:2606. 17110v1 Announce Type: cross Abstract: Large Language Models are increasingly trained on proprietary or sensitive data, from private healthcare and financial records to user conversations containing secrets.
By Md Abdullah Al Mamun, Ngoc Phu Doan, Pedram Zaree, Ihsen Alouani, Nael Abu-Ghazaleh
Federated fine-tuning of large language models (LLMs) enables collaborative training without exposing raw data. However, a recent attack, NeuroImprint [1] (arXiv:2606.
The paper introduces LLM‑Attacker, a unified framework for evaluating privacy risks in split and distributed large language models. It records attacker choices—such as message types, model weights, datasets, and recovery metrics—to enable consistent comparison and extension of privacy evaluations. Experiments on GPT‑2 show that providing training gradients boosts token recovery from 94.20% to 97.38% and exact‑document recovery from 13.71% to 37.77%, illustrating the framework’s ability to quantify how changes in attacker access affect privacy outcomes.
By Georgios Politis, Evangelos Pappas
arXiv:2606. 14210v1 Announce Type: cross Abstract: Large language models (LLMs) are increasingly deployed in privacy-sensitive domains, where users must balance the risk of data exposure through external APIs against the high computational cost of local deployment.
By Zixuan Gu, Xiaojun Ye, Yang Liu
arXiv:2609.22818v1 Announce Type: cross
Abstract: Memory-poisoning defenses for LLM agents are typically evaluated by their ability to prevent attacks. However, the traffic they process is rarely adv...
By Pritom Bhowmik
The paper introduces LLM‑Attack Suite, a unified framework for evaluating privacy risks in split and distributed large language models. It records attacker choices—such as message types, model weights, datasets, and recovery metrics—to enable consistent comparison and extension of privacy evaluations. Experiments on GPT‑2 demonstrate that providing gradients during training significantly boosts token and document recovery rates, illustrating how attacker access levels influence privacy outcomes.
By Georgios Politis, Evangelos Pappas
The paper introduces PAC‑Private Autoregressive Generation, a method that calibrates noise based on ensemble disagreement across overlapping ‘worlds’ of a private corpus, thereby extending PAC privacy from classification to text generation. By training adapters on a frozen public model and using posterior‑weighted disagreement to add noise only when predictions vary, the approach achieves strong privacy guarantees while preserving most of the fine‑tuning benefit. Experiments on WikiText‑103 with GPT‑2‑small show 74 % of the fine‑tuning gain retained with a per‑token budget of 2⁻³², and membership‑inference success bounded to 51.08 % after one million tokens, outperforming PMixED under matched conditions.
By Mina Mirzadehsarcheshmeh, Amir Keyvan Khandani
The paper introduces ADLER, a decoding protocol that limits private-context LLM assistance over Web APIs to only public views and the final answer, preventing leakage of private content through message transcripts. A client-side leakage ledger tracks how much the answer reveals relative to a public reference process, ensuring that no configuration exposes hidden secrets. Experiments on GSM8K math problems show that ADLER can significantly improve accuracy compared to zero-leakage baselines while keeping disclosure within a controlled budget.
By Liang Yuan, Xiaohu Du, Ruikun Luo, Jinze Wang, Mashud Rana, Kaibin Wang, Jiangwen Zhou, Bo Li, Xiaoyu Xia