Federated learning works by aggregating locally computed gradients from
multiple clients, thus enabling collaborative training without sharing private
client data. However, prior work has shown that the data can actually be
recovered by the server using so-called gradient inversion attacks. While these
attacks perform well when applied on images, they are limited in the text
domain and only permit approximate reconstruction of small batches and short
input sequences. In this work, we propose DAGER, the first algorithm to recover
whole batches of input text exactly. DAGER leverages the low-rank structure of
self-attention layer gradients and the discrete nature of token embeddings to
efficiently check if a given token sequence is part of the client data. We use
this check to exactly recover full batches in the honest-but-curious setting
without any prior on the data for both encoder- and decoder-based architectures
using exhaustive heuristic search and a greedy approach, respectively. We
provide an efficient GPU implementation of DAGER and show experimentally that
it recovers full batches of size up to 128 on large language models (LLMs),
beating prior attacks in speed (20x at same batch size), scalability (10x
larger batches), and reconstruction quality (ROUGE-1/2 > 0.99).

DAGER 是一种用于恢复文本数据批的算法，通过利用 self-attention 层的梯度的低秩结构和标记嵌入的离散性质，以精确的方式恢复整个批次的输入文本数据，用于编码器和解码器架构，并在实验中表现出超过 0.99 的 ROUGE-1/2，速度比之前的攻击快了 20 倍，并且在可扩展性上可以处理 10 倍以上的批大小。