The paper proposes using lossy compression as a security signal in federated learning by defining a "compression footprint"—a low‑dimensional set of statistics derived from the compressor’s output. It introduces CRAFT, a server‑side aggregation method that leverages these footprints to distinguish honest from malicious updates without extra client metadata or knowledge of attacker numbers. Experiments on six attacks and datasets show CRAFT often outperforms existing robust aggregation baselines, demonstrating that compression can simultaneously reduce communication and enhance security.
By Sachi Shome, William Eiers
arXiv:2603. 12977v3 Announce Type: replace Abstract: Foundation models are commonly deployed as frozen feature extractors with a small trainable head to adapt to private, user-generated data in federated settings.
By Yijun Quan, Wentai Wu, Giovanni Montana
The paper introduces LLM‑Attack Suite, a unified framework for evaluating privacy risks in split and distributed large language models. It records attacker choices—such as message types, model weights, datasets, and recovery metrics—to enable consistent comparison and extension of privacy evaluations. Experiments on GPT‑2 demonstrate that providing gradients during training significantly boosts token and document recovery rates, illustrating how attacker access levels influence privacy outcomes.
By Georgios Politis, Evangelos Pappas
arXiv:2606. 02563v1 Announce Type: new Abstract: Heterogeneous Differential Privacy (HDP) in Federated Learning (FL) allows clients to select individual privacy budgets ($\varepsilon_i$) according to institutional policies and data sensitivity.
By Farhin Farhad Riya, Olivera Kotevska, Jinyuan Stella Sun
The paper introduces LLM‑Attacker, a unified framework for evaluating privacy risks in split and distributed large language models. It records attacker choices—such as message types, model weights, datasets, and recovery metrics—to enable consistent comparison and extension of privacy evaluations. Experiments on GPT‑2 show that providing training gradients boosts token recovery from 94.20% to 97.38% and exact‑document recovery from 13.71% to 37.77%, illustrating the framework’s ability to quantify how changes in attacker access affect privacy outcomes.
By Georgios Politis, Evangelos Pappas
arXiv:2409. 01062v4 Announce Type: replace Abstract: Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private training data from machine learning models.
By Viet-Hung Tran, Ngoc-Bao Nguyen, Son T. Mai, Hans Vandierendonck, Ira Assent, Alex Kot, Ngai-Man Cheung