{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/analysis-of-privacy-leakage-in-federated","title":"Analysis of Privacy Leakage in Federated Large Language Models","arxiv_id":"2403.04784","date":"2024-03-02","proceeding":null,"authors":["Minh N. Vu","Truc Nguyen","Tre' R. Jeter","My T. Thai"],"abstract":"With the rapid adoption of Federated Learning (FL) as the training and tuning protocol for applications utilizing Large Language Models (LLMs), recent research highlights the need for significant modifications to FL to accommodate the large-scale of LLMs. While substantial adjustments to the protocol have been introduced as a response, comprehensive privacy analysis for the adapted FL protocol is currently lacking. To address this gap, our work delves into an extensive examination of the privacy analysis of FL when used for training LLMs, both from theoretical and practical perspectives. In particular, we design two active membership inference attacks with guaranteed theoretical success rates to assess the privacy leakages of various adapted FL configurations. Our theoretical findings are translated into practical attacks, revealing substantial privacy vulnerabilities in popular LLMs, including BERT, RoBERTa, DistilBERT, and OpenAI's GPTs, across multiple real-world language datasets. Additionally, we conduct thorough experiments to evaluate the privacy leakage of these models when data is protected by state-of-the-art differential privacy (DP) mechanisms.","url_abs":"https://arxiv.org/abs/2403.04784v1","url_pdf":"https://arxiv.org/pdf/2403.04784v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"analysis-of-privacy-leakage-in-federated","repo_url":"https://github.com/vunhatminh/fl_attacks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"}],"methods":[{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"attention-dropout","method_name":"Attention Dropout"},{"method_slug":"bert","method_name":"BERT"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"distilbert","method_name":"DistilBERT"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"linear-warmup-with-linear-decay","method_name":"Linear Warmup With Linear Decay"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"roberta","method_name":"RoBERTa"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"weight-decay","method_name":"Weight Decay"},{"method_slug":"wordpiece","method_name":"WordPiece"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2403.04784","atlas_url":"https://app.syntology.ai/?focus=2403.04784","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2403.04784"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/vunhatminh/fl_attacks","reach":{"status":"ok"}}],"summary":{"ran":3,"ran_fixture":1,"unverified":2},"by_repo_kind":{"official":{"samples":6,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"d5ef0ed197a35460","entry":"find_tresh","repo":"vunhatminh/fl_attacks","repo_kind":"official","path":"LLMs/ldpfunctions.py","file_url":"https://github.com/vunhatminh/fl_attacks/blob/HEAD/LLMs/ldpfunctions.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d5ef0ed197a35460"}},{"code_sha256_prefix":"96292912449b1dfa","entry":"tpr_tnr","repo":"vunhatminh/fl_attacks","repo_kind":"official","path":"API/api-att-ldp-twitter.py","file_url":"https://github.com/vunhatminh/fl_attacks/blob/HEAD/API/api-att-ldp-twitter.py","link_basis":"plan_row","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"96292912449b1dfa"}},{"code_sha256_prefix":"34703e7134d4bb3d","entry":"unpacking_apply_along_axis","repo":"vunhatminh/fl_attacks","repo_kind":"official","path":"API/api-att-ldp-imdb.py","file_url":"https://github.com/vunhatminh/fl_attacks/blob/HEAD/API/api-att-ldp-imdb.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"34703e7134d4bb3d"}},{"code_sha256_prefix":"b1c8f308e7062fcf","entry":"unpacking_apply_along_axis","repo":"vunhatminh/fl_attacks","repo_kind":"official","path":"API/api-att-ldp-twitter.py","file_url":"https://github.com/vunhatminh/fl_attacks/blob/HEAD/API/api-att-ldp-twitter.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b1c8f308e7062fcf"}},{"code_sha256_prefix":"cee11ee01c589ac5","entry":"LH_Client_Fast","repo":"vunhatminh/fl_attacks","repo_kind":"official","path":"LLMs/ldpfunctions.py","file_url":"https://github.com/vunhatminh/fl_attacks/blob/HEAD/LLMs/ldpfunctions.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cee11ee01c589ac5"}},{"code_sha256_prefix":"73b18550fdf42bdb","entry":"tokenize","repo":"vunhatminh/fl_attacks","repo_kind":"official","path":"LLMs/layers_attn_ldp.py","file_url":"https://github.com/vunhatminh/fl_attacks/blob/HEAD/LLMs/layers_attn_ldp.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"73b18550fdf42bdb"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}