Gradient Mirage confuses split-learning label recovery

Problem

The paper investigates label leakage in split learning for large language model fine‑tuning, where the server observes the gradient at the split interface and can recover private next‑token labels by solving a gradient‑matching inverse problem. This Gradient Matching Attack in Split Learning (GMA‑SL) is particularly effective because interface gradients retain batch‑separable, token‑level structure and the attacker needs only to optimise dummy labels against a known trunk representation under a semi‑white‑box assumption. The vulnerability undermines label‑shielded split learning and threatens privacy in multi‑party and on‑device training.

Approach

Gradient Mirage is a defence that deliberately decouples what the model learns from what the exposed gradient reveals, converting the attacker’s task into a misspecified inverse problem. It injects three kinds of inconsistency into the released gradient while preserving learning utility: Selective Autoregressive Supervision (SAS) makes the exposed gradient derive from a masked surrogate loss rather than the full‑label objective; Scale Blinding multiplies token contributions by randomized positive coefficients drawn, by default, from Uniform[1500,2000] (mean 1750, relative variation 1/7) to obscure magnitude patterns; and Directional Privatization perturbs gradient direction using the von Mises–Fisher (vMF) mechanism, which provides a directional metric differential privacy guarantee while preserving gradient norm. To retain optimisation performance, the method uses Dual‑Track Backpropagation so the Top segment still trains on the full‑label loss, and Bottom‑Gradient Recovery to rescale gradients before bottom‑segment updates. Experiments use Llama‑2‑7B, Llama‑3‑8B and DeepSeek‑LLM‑7B on CodeAlpaca, GSM8K and PIQA and evaluate reconstruction via ROUGE‑L F1 and METEOR and fine‑tuning utility via perplexity.

Key Findings

• Gradient Mirage substantially reduces label reconstruction quality compared with representative baselines while maintaining comparable fine‑tuning performance, achieving a superior privacy‑utility trade‑off.
• Each defence component contributes: SAS and Directional Privatization disrupt positional and directional cues, and Scale Blinding is critical for magnitude‑sensitive objectives (removing it raised ROUGE‑L F1 from 0.35 to 0.71 in a reported ablation).
• vMF directional perturbation admits a provable lower bound on amplitude signal‑to‑noise ratio (ASNR≥1/2) and satisfies directional metric differential privacy; this preserves gradient magnitude and supports stable training.
• Common alternatives perform poorly or destabilise training: gradient pruning becomes unstable at high pruning rates, gradient dropout requires careful noise tuning, and a sequence‑level Gaussian DP mechanism severely degrades utility and can remain vulnerable even at large privacy budgets.
• Scale‑aware adaptive attacks that jointly estimate a nuisance scale reduce but do not remove the defence benefit; choosing mean scale around 1750 with moderate token variation was found to balance privacy and utility.

Limitations

The defence is evaluated for autoregressive next‑token fine‑tuning and under a semi‑white‑box server threat model; its effectiveness for other training paradigms, multimodal or vision models, and reinforcement learning remains untested. Implementing SAS and the vMF sampler adds complexity, and extreme scaling requires alternative training schedules (for example Trunk‑Frozen Training) to preserve stability.

Implications

From an offensive viewpoint, the paper clarifies that GMA‑SL exploits gradient–objective consistency, batch‑separable gradient structure and access to attention masks to reconstruct labels. Gradient Mirage demonstrates that manipulating objective, direction and scale of released gradients can thwart such reconstruction without fully removing the optimisation signal, meaning attackers must now solve a misspecified inverse problem or invest in stronger modelling of nuisance transformations such as token‑wise random scaling and directional noise.