How malicious servers exploit PEFT adapters to steal your training data

Federated Learning promises to train AI models without exposing raw user data. But what if the server—even the one running the central aggregation—could quietly reconstruct your sensitive information from the adapters it receives? Recent research from Shi et al. (2026) reveals a novel attack vector that turns parameter-efficient fine-tuning (PEFT) adapters into data leakage pipelines.

This attack, dubbed NeuroImprint, manipulates the adapter weights during training so that the central server can later extract full training samples by simply inspecting the adapter’s parameters. The reconstructed data retains high semantic fidelity, making it a serious threat to privacy-preserving AI workflows.

The hidden risk in PEFT adapters

PEFT adapters—especially Low-Rank Adaptation (LoRA) modules—are designed to reduce computational overhead by freezing most of a large language model’s weights and training only a small set of additional parameters. While this approach preserves data privacy in theory, the NeuroImprint attack exploits structural patterns that emerge when an attacker poisons the training process.

Contrary to expectations, a malicious server can reconstruct between 59% and 79% of original training samples from the adapter alone, depending on the model and optimizer used. The attack has been demonstrated across popular architectures including BERT, GPT-2, Qwen2, and Llama 3.2.

Introducing NeuroImprint Detector: your auditing shield

To combat this threat, a new open-source tool called NeuroImprint Detector provides a forensic pipeline for auditing PEFT adapters before they are deployed. Developed by an independent researcher, the framework analyzes adapter weights to detect hidden backdoors and, if found, reconstructs the memorized samples.

The detection process follows a structured workflow:

• Detection Phase: Identifies structural anomalies in adapter weights such as identical rows in weight matrices, quantized bias intervals, and RaLU patterns (rank-1 matrices).
• Estimation Phase: Reconstructs the original backdoor weights using statistical methods like median aggregation and IQR filtering, even without access to initial training weights.
• Inversion Phase: Performs closed-form gradient inversion to recover embeddings that approximate the original training data.
• Tokenization Phase: Converts recovered embeddings into human-readable text using local or Hugging Face tokenizers.
• Reporting Phase: Outputs a JSON report detailing which data was extracted, enabling security teams to take corrective action.

Getting started with NeuroImprint Detector

The tool supports multiple deployment modes depending on your infrastructure and privacy requirements.

Installation:

pip install neuroimprint-detector

Basic audit (detection only):

neuroimprint-audit --path /path/to/adapter

Full forensic reconstruction (with online tokenizer):

neuroimprint-audit --path /adapter \
  --reconstruct \
  --tokenizer-id Qwen/Qwen2-0.5B \
  --output report.json

Offline reconstruction (air-gapped environment):

neuroimprint-audit --path /adapter \
  --reconstruct \
  --tokenizer-id /path/to/local/tokenizer \
  --output report.json

Programmatic usage (Python API):

from neuroimprint_detector import NeuroImprintDetector

detector = NeuroImprintDetector()
result = detector.analyze({'W2': adapter_W2, 'b2': adapter_b2})

print(f"Verdict: {result.verdict.value}")  # "backdoored"
print(f"Confidence: {result.confidence:.2f}")  # e.g., 0.90
print(f"Estimated samples: {result.estimated_samples}")  # e.g., 200

Attack effectiveness across models

The NeuroImprint attack leverages the optimizer’s behavior to maximize data leakage. The following table summarizes reconstruction rates and semantic similarity across models and optimizers:

| Model | Optimizer | Reconstruction Rate | Semantic Similarity | |-----------------|-----------|---------------------|---------------------| | BERT | SGD | 77.4% | 0.994 | | BERT | AdamW | 74.6% | 0.767 | | GPT-2 | SGD | 66.5% | 0.990 | | Qwen2-1.5B | SGD | 71.4% | 0.997 | | Llama3-3B | SGD | 75.0% | 0.997 |

SGD-based training tends to yield exact reconstructions, while AdamW introduces momentum that slightly reduces fidelity but still recovers usable data.

Technical stack and reliability

NeuroImprint Detector is built on a modular architecture designed for accuracy and flexibility:

• Detector: Scans weight matrices for anomalies like duplicate rows and quantized bias patterns.
• Estimator: Reconstructs original backdoor weights using statistical inference.
• Inverter: Uses closed-form gradient inversion tailored to SGD or AdamW dynamics.
• Tokenizer: Supports both Hugging Face Hub tokenizers and local offline models.
• Loader: Handles adapter loading from disk or Hugging Face Hub, extracting candidate weights.
• Synthetics: Includes tools to generate clean and backdoored adapters for testing.
• CLI & Python API: Provides both command-line and programmatic interfaces.

The project maintains a robust testing suite with 43 passing tests, covering unit and integration scenarios across Python 3.10 and 3.11 environments.

Why this matters for AI privacy

Federated Learning was positioned as a privacy-preserving alternative to centralized data collection. However, the NeuroImprint attack exposes a critical flaw: if the central server can manipulate or inspect adapters, privacy is not guaranteed.

By integrating NeuroImprint Detector into CI/CD pipelines, AI teams can validate every PEFT adapter before deployment, ensuring that no backdoors are present. This small but vital step restores trust in federated training workflows and protects sensitive data from unintended exposure.

The future of secure AI training may depend on tools like this one—where efficiency and privacy go hand in hand.