Skip to content

Where RQ2 sits against the 2026 attacks

RQ2 asks what a federated adapter update leaks about the client that produced it. Three lines of prior work bound what is already known, and none of them asks RQ2's question.

The strongest 2026 attack is exact-membership, and it assumes the easy threat model. ProjRes (arXiv:2604.21197, April 2026), read in full: an honest-but-curious server observing per-client gradients, with neither secure aggregation nor differential privacy assumed. It reports AUC 1.000 on CoLA and SST across BERT-Base, GPT2-Large, Llama3-8B and Qwen2.5-14B, and LoRA leaks at AUC 1.000 for batch sizes up to 16 and 0.957 at 512. Two things limit how far it reaches into this study:

  • It degrades on long inputs. AUC falls to 0.807 (BERT-Base) and 0.819 (GPT2-Large) on IMDB, and the authors attribute it to sequence length. A code-review refinement with its context is long, so the headline "near 100%" should not be expected on this corpus.
  • It names RQ2's question as out of scope. Quoting its limitations: "ProjRes operates as a data-level MIA, identifying membership only when a sample exactly matches one in the training set ... this overlooks the semantic generalization ability of LLMs." Inferring a property of the data, rather than the presence of one sample, is the part it does not do.

Secure aggregation is not a safe harbour, so RQ2 cannot lean on it. Gradient disaggregation (arXiv:2106.06089) recovers individual updates from aggregates using how often each client participated across rounds. Kerkouche, Ács and Fritz (arXiv:2303.03908, WPES at CCS 2023), read in full, infer client-specific properties from aggregated updates alone, passively, through the linearity of aggregation over rounds whose client composition varies. Their method, PROLIN, is evaluated on MNIST, CIFAR-10 and Fashion-MNIST with a LeNet, and the only properties studied are membership and misbehaviour (gradient-inversion and gradient-ascent poisoning). Data source is not studied. Its F1 falls as clients grow, from 50 to 200 in their CIFAR-10 runs.

The more useful line is in their future work: PROLIN "is not limited to membership inference and misbehaving detection, it can disaggregate the linear features of any supervised detector model." That hands RQ2 its attack for the secure-aggregation threat model rather than leaving it to be invented: a source-identity detector, trained the way the separability probe is, plugged into PROLIN's disaggregation. Neither the property nor the domain has been tried.

What none of them target: where a client's data came from. Every attack above infers something about individual samples or client behaviour. RQ2's property is the client's source -- which organization, or which project -- and this corpus is what makes that question testable, with two organizations, 345 projects and a time-split design.

And tonight's evidence changes what the question should be. The separability probe found two projects inside one organization as distinguishable as two organizations, and review latency differs between projects under one roof by a quarter of its whole range. If source leaks, it most likely leaks at the project, not the organization. So RQ2 is sharper framed as two altitudes than one: does an adapter update reveal its organization, does it reveal its project, and which boundary does a privacy policy drawn around organizations actually protect.

The design this implies. Two threat models, because the literature has shown the second is not a defence: a server seeing per-client updates, and a server seeing only aggregates across rounds of varying composition, attacked through the linearity that 2303.03908 exploits. And the long-input regime is where the contribution is sharpest, since that is exactly where the exact-membership state of the art is weakest.