A recent study shows that the popular LoRA‑based parameter‑efficient fine‑tuning (PEFT) does not, on its own, stop the leakage of personal data in federated learning (FL). When a server sees the low‑rank updates that clients send, it can rebuild the original pictures with high quality. The authors propose adding trainable positional embeddings to the Vision Transformer blocks during client training. These embeddings act as spatial anchors, directing the reconstruction algorithm to the correct image layout and helping the generative prior stay on realistic images. On the CIFAR‑10 benchmark, this spatial anchoring improves peak signal‑to‑noise ratio (PSNR) by 10.14 dB and structural similarity (SSIM) by 0.45 compared with the baseline generative inversion attack‑based attack framework (GIAS). Similar gains are seen on higher‑resolution CelebA and CARS datasets. While differential‑privacy noise can still reduce leakage, it hurts normal task performance and does not guard against all modern attacks.

The key take‑away is that LoRA alone is not a privacy safeguard. By equipping the model with learnable positional cues, attackers can recover private images with sharper details. This highlights the need for stronger defenses, such as careful gradient perturbation, robust clipping, or architectural changes that limit spatial leakage.

The study also notes that the gains from spatial anchoring persist at larger batch sizes and under FedAvg aggregation, underscoring that the issue is not tied to a particular training schedule.

Overall, the work stresses that parameter‑efficient fine‑tuning should not be mistaken for privacy protection and that adding spatial anchors can unintentionally increase privacy risk.