Fully adaptive attack co-design

Characterize the security of AEGIS against a fully adaptive adversary that jointly co-designs the gradient-inversion attack and the transformer model rather than targeting the evaluated gradient channels.

Background

AEGIS evaluates adaptive attacks that retarget the MLP expansion gradient, MLP projection, LayerNorm parameters, and untied language-model heads. These tests cover several plausible fallback channels while retaining the paper’s fixed-model threat assumptions.

The authors explicitly state that an adversary capable of co-designing the attack and model remains outside the demonstrated guarantees. This leaves unresolved whether structural masking remains effective when the attacker can alter or jointly optimise the model and attack strategy.

References

A fully adaptive adversary that co-designs attack and model remains an open problem.

— AEGIS: Attention-Embedding Gradient Isolation Shield - Triple-Channel Gradient Masking for Privacy-Preserving Federated LLM Fine-Tuning  (2608.19534 - Tao et al., 20 Aug 2026) in Section 5.1, Remark “Threat model scope”

Full defeat of optimisation-based attacks would require an orthogonal mechanism such as DP-SGD noise or data sanitisation composable with AEGIS.

— AEGIS: Attention-Embedding Gradient Isolation Shield - Triple-Channel Gradient Masking for Privacy-Preserving Federated LLM Fine-Tuning  (2608.19534 - Tao et al., 20 Aug 2026) in Section 4.5, subsection “Optimisation-based attacks: GRAB”