DRAGD: Federated Unlearning & Drag-Based Editing

• DRAGD is an ambiguous term referring both to a federated unlearning attack that reconstructs deleted data from gradient differences and to drag-based image editing techniques that manipulate content via control points.
• In federated unlearning, DRAGD reconstructs forgotten data by first recovering the remaining dataset from post-unlearning gradients and then optimizing the forgotten data to match pre-unlearning gradients.
• Drag-based image editing using DRAGD employs alternating drag and denoising steps, utilizes geometric constraints, and leverages automated soft mask generation to ensure fidelity and precise manipulation.

Searching arXiv for the exact term and closely related usages to ground the article. “DRAGD” is an ambiguous acronym in recent arXiv literature. In the most literal sense, it denotes the federated-unlearning attack “DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences” (Ju et al., 13 Jul 2025). However, the same character string also appears in other subfields as a shorthand for “drag-based image editing” or as an informal variant of methods whose canonical names are DRAG or DRAGO rather than DRAGD. In the federated-learning context, DRAGD refers specifically to a data reconstruction attack that exploits gradient discrepancies before and after unlearning to recover deleted data (Ju et al., 13 Jul 2025). In the image-editing literature, “DRAGD” is used descriptively for drag-based image editing rather than as a unique algorithm, with concrete realizations including GoodDrag (Zhang et al., 2024), DirectDrag (Liao et al., 3 Dec 2025), FlowDrag (Koo et al., 11 Jul 2025), and 3D methods such as ARAP-GS (Han et al., 17 Apr 2025) and DYG (Qu et al., 30 Jan 2025). This ambiguity makes contextual disambiguation essential.

1. Terminological scope and disambiguation

In the federated-unlearning literature, DRAGD is an official method name. The paper “DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences” defines DRAGD as an attack that reconstructs forgotten data from the difference between pre-unlearning and post-unlearning gradients (Ju et al., 13 Jul 2025). The paper also introduces DRAGDP, which augments DRAGD with publicly available prior data to improve reconstruction accuracy, particularly for complex datasets such as facial images (Ju et al., 13 Jul 2025).

In several other literatures, “DRAGD” is not a canonical acronym but a descriptive shorthand. In drag-based diffusion editing, the data explicitly state that “drag-based image editing (DRAGD)” aims to manipulate image content by moving a small set of user-specified handle points to target positions (Liao et al., 3 Dec 2025). The same descriptive use appears in discussions of GoodDrag (Zhang et al., 2024), FlowDrag (Koo et al., 11 Jul 2025), and ARAP-GS (Han et al., 17 Apr 2025). By contrast, some similarly spelled methods are not DRAGD at all. “Debate-Augmented RAG” is DRAG, not DRAGD (Hu et al., 24 May 2025). “Knowledge Retention for Continual Model-Based Reinforcement Learning” introduces DRAGO rather than DRAGD (Sun et al., 6 Mar 2025). “Divergence-based Adaptive Aggregation” is DRAG, not DRAGD (Zhu et al., 2023).

This suggests that DRAGD functions less as a stable, field-wide acronym than as a context-dependent label shared by at least two distinct research lineages: federated unlearning attacks and drag-based editing.

2. DRAGD in federated unlearning

In federated learning, DRAGD targets federated unlearning, where a system is expected to remove the influence of a client’s data from a trained model. The central observation is that unlearning changes the gradients available to the server, and these changes can leak information about the removed data (Ju et al., 13 Jul 2025). The attacker is the server, modeled as honest-but-curious, with access to the model parameters, the pre-unlearning gradients, and the post-unlearning gradients (Ju et al., 13 Jul 2025).

The core quantities are the pre-unlearning gradient $g_{\mathrm{pre}}$ and the post-unlearning gradient $g_{\mathrm{post}}$. DRAGD defines a gradient difference

$\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$

Under a fixed reference model, this difference decomposes into a term proportional to the forgotten data gradient and a nuisance term induced by normalization over the remaining data (Ju et al., 13 Jul 2025). The method therefore does not simply invert $\Delta g$ directly. Instead, it first reconstructs the remaining data from $g_{\mathrm{post}}$, then holds that reconstruction fixed and optimizes the forgotten data so that the combined synthetic batch matches $g_{\mathrm{pre}}$ (Ju et al., 13 Jul 2025).

This two-step structure is the defining feature of DRAGD. Step I reconstructs the remaining dataset $D_r$ from the post-unlearning gradients at $\theta_{\mathrm{post}}$ through a gradient-matching objective. Step II reconstructs the forgotten dataset $D_f$ at $\theta_{\mathrm{pre}}$ while freezing the reconstruction of $g_{\mathrm{post}}$0 (Ju et al., 13 Jul 2025). The paper emphasizes that fixing this reconstructed “Part” is critical; ablations show large degradation when it is allowed to move during the second phase (Ju et al., 13 Jul 2025).

The reconstruction objectives are given explicitly. For the remaining dataset,

$g_{\mathrm{post}}$1

and for the forgotten dataset,

$g_{\mathrm{post}}$2

The update rules optimize $g_{\mathrm{post}}$3 and then $g_{\mathrm{post}}$4 by gradient descent, with $g_{\mathrm{post}}$5 enforced in the second phase (Ju et al., 13 Jul 2025).

A public-prior variant, DRAGDP, changes the initialization of the forgotten batch. Instead of random initialization, $g_{\mathrm{post}}$6 is initialized from a public dataset $g_{\mathrm{post}}$7, which sharply narrows the search space on structured domains such as faces (Ju et al., 13 Jul 2025). This suggests that DRAGDP is not a different inversion principle but a prior-enhanced instantiation of the same two-stage attack.

3. Empirical performance of federated-unlearning DRAGD

The reported experiments cover MNIST, CIFAR-10, and LFW, with LeNet used for MNIST and LFW and ResNet-18 or ConvNet-64 used for CIFAR-10 (Ju et al., 13 Jul 2025). The federated-learning setup uses $g_{\mathrm{post}}$8 clients with a Non-IID partition via Dirichlet$g_{\mathrm{post}}$9 (Ju et al., 13 Jul 2025). The attack is run for 300 iterations per phase, with learning rate $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$0 for MNIST and LFW and $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$1 for CIFAR-10 (Ju et al., 13 Jul 2025).

The principal metrics are MSE, PSNR, and SSIM (Ju et al., 13 Jul 2025). On MNIST with LeNet, DRAGD improves substantially over DLG, while DRAGDP improves further, reaching MSE $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$2, PSNR $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$3, and SSIM $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$4 (Ju et al., 13 Jul 2025). On LFW with LeNet, DRAGDP likewise greatly outperforms DRAGD and DLG, obtaining MSE $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$5, PSNR $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$6, and SSIM $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$7 (Ju et al., 13 Jul 2025). On CIFAR-10, DRAGD also outperforms inversion baselines such as IG, though the gains are smaller and depend on the backbone (Ju et al., 13 Jul 2025).

The most striking ablation concerns freezing the reconstructed remaining set. On MNIST, DRAGD improves from MSE $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$8 to $\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.$9, PSNR from $\Delta g$0 to $\Delta g$1, and SSIM from $\Delta g$2 to $\Delta g$3 when the “Part” reconstruction is fixed during the second stage (Ju et al., 13 Jul 2025). This is one of the clearest empirical indicators of the mechanism by which DRAGD gains over standard gradient inversion.

The paper frames these results as evidence of a privacy vulnerability specific to federated unlearning: comparative information between the pre-unlearning and post-unlearning states can make deleted data more recoverable than a single gradient snapshot would suggest (Ju et al., 13 Jul 2025). A plausible implication is that federated unlearning can create a new attack surface even when federated learning already appears privacy-aware at the protocol level.

4. DRAGD as drag-based image editing

In image generation and editing, “DRAGD” is used as a task label rather than as a unique model name. The problem is to manipulate image content by moving a small set of handle points to target positions while preserving semantic fidelity and minimizing unintended changes (Liao et al., 3 Dec 2025). GoodDrag presents this as drag editing with diffusion models, where an input image is inverted to a latent and then updated using motion supervision and denoising (Zhang et al., 2024). DirectDrag describes the same general problem as “drag-based image editing (DRAGD)” and defines it through handle points $\Delta g$4 and target positions $\Delta g$5 (Liao et al., 3 Dec 2025).

A recurring difficulty in this literature is the trade-off between fidelity and control. Manual masks are often used to localize edits, but they are burdensome and error-prone; textual prompts can help preserve semantics, but they are imprecise and can reduce point alignment when omitted (Liao et al., 3 Dec 2025). This has motivated several increasingly specialized formulations.

GoodDrag proposes an Alternating Drag-and-Denoising (AlDD) schedule that interleaves drag updates and denoising, rather than concentrating all drag operations at a single diffusion step (Zhang et al., 2024). Its information-preserving motion supervision aligns current features with the original handle-point features rather than with the previous-step features, reducing drift (Zhang et al., 2024). DirectDrag pushes the setting further by removing both manual masks and prompts. It does so with Auto Soft Mask Generation (ASM), which infers a soft editable region from handle-to-target trajectories, and Readout-Guided Feature Alignment (RGFA), which uses intermediate diffusion activations and a learned readout head as a prompt-free appearance prior (Liao et al., 3 Dec 2025).

The mathematical structure of these systems is diffusion-centric. DirectDrag uses the triplet loss

$\Delta g$6

to train the readout, and at inference applies

$\Delta g$7

to preserve appearance during editing (Liao et al., 3 Dec 2025). It also incorporates motion supervision and patch-level drag alignment losses (Liao et al., 3 Dec 2025). GoodDrag similarly defines an AlDD motion-supervision loss in the latent space and alternates this with DDIM denoising (Zhang et al., 2024).

The benchmarks and metrics for this line of work are also specialized. GoodDrag introduces Drag100 and the Dragging Accuracy Index (DAI), where lower is better, together with Gemini Score for perceptual quality (Zhang et al., 2024). DirectDrag reports DragBench metrics such as Image Fidelity $\Delta g$8, CLIP similarity, and Mean Distance, showing strong fidelity among manual mask-free methods (Liao et al., 3 Dec 2025). FlowDrag later adds a 3D-aware formulation and a new ground-truth benchmark, VFD (VidFrameDrag), to evaluate how well edits match intended transformations (Koo et al., 11 Jul 2025).

5. Extensions into 3D drag-based editing

The “DRAGD” task interpretation extends naturally into 3D scene editing. ARAP-GS introduces drag-driven editing for 3D Gaussian Splatting by deforming Gaussian centers with an As-Rigid-As-Possible (ARAP) objective and then refining appearance with a diffusion-based super-resolution prior (Han et al., 17 Apr 2025). The ARAP energy is

$\Delta g$9

and position updates solve a constrained linear system under handle-point boundary conditions (Han et al., 17 Apr 2025). The method uses a representative subset of Gaussians, interpolation to the rest, and mask-guided fine-tuning with StableSR (Han et al., 17 Apr 2025).

DYG (“Drag Your Gaussian”) adapts drag-based editing to 3D Gaussian Splatting through score distillation rather than ARAP. It uses a triplane scaffold to predict per-Gaussian position offsets and a Drag-SDS loss that distills a drag-conditioned 2D latent diffusion model into the 3D representation (Qu et al., 30 Jan 2025). The composite noise target is

$g_{\mathrm{post}}$0

and the total Drag-SDS objective combines latent-space, image-space, and LoRA terms (Qu et al., 30 Jan 2025). This suggests that “DRAGD” in the editing literature has broadened from a 2D point-manipulation task into a family of geometry-aware control methods spanning 2D diffusion, 3D Gaussian Splatting, and mesh-guided editing.

FlowDrag provides another extension by constructing a 3D mesh from a single image, deforming it with SR-ARAP, projecting the deformations into a dense 2D vector flow field, and injecting that flow into a diffusion UNet (Koo et al., 11 Jul 2025). Its deformation objective augments ARAP with rotation smoothing and inter-step smoothness (Koo et al., 11 Jul 2025). A plausible implication is that the drag-editing literature is converging on the use of explicit geometric priors to correct the geometric inconsistency of purely 2D, local-feature-based drag objectives.

6. Related but distinct DRAG/DRAGO methods

Several arXiv papers contain “DRAG”-like names but are not DRAGD. This distinction matters because the acronym collision can lead to incorrect attribution.

In retrieval-augmented generation, “Debate-Augmented RAG” is DRAG, not DRAGD (Hu et al., 24 May 2025). It addresses “Hallucination on Hallucination” in RAG by introducing multi-agent debate in both retrieval and generation, with asymmetric information roles in the response stage (Hu et al., 24 May 2025). Its core stages are retrieval debate,

$g_{\mathrm{post}}$1

and response debate,

$g_{\mathrm{post}}$2

not drag-based editing or gradient inversion (Hu et al., 24 May 2025).

In continual model-based reinforcement learning, the method is DRAGO, “Dynamics-leaRning while RegAinG MemOries,” not DRAGD (Sun et al., 6 Mar 2025). DRAGO combines Synthetic Experience Rehearsal and Regaining Memories Through Exploration to preserve world-model dynamics across tasks (Sun et al., 6 Mar 2025). Its dynamics update uses

$g_{\mathrm{post}}$3

and is conceptually unrelated to either drag-based editing or federated unlearning (Sun et al., 6 Mar 2025).

In federated learning on non-IID data, DRAG is “Divergence-based Adaptive Aggregation” (Zhu et al., 2023). It measures the cosine-based degree of divergence between local and reference updates,

$g_{\mathrm{post}}$4

and adaptively drags local updates toward a server reference direction (Zhu et al., 2023). Despite the verbal resemblance, this “dragging” is an aggregation rule in optimization geometry rather than a point-manipulation or reconstruction attack framework.

These examples show that the surface string “DRAGD” cannot be interpreted reliably without domain context.

7. Limitations, controversies, and broader significance

The most immediate controversy surrounding DRAGD arises in federated unlearning. Unlearning is often presented as a privacy-enhancing capability, yet DRAGD shows that the transition from pre-unlearning to post-unlearning can itself leak the removed data (Ju et al., 13 Jul 2025). The paper therefore motivates defenses such as additive DP noise, secure aggregation, masking or obfuscation of unlearning updates, and adaptive noise injection (Ju et al., 13 Jul 2025). This suggests that unlearning protocols must be evaluated not only for deletion fidelity but also for leakage induced by the deletion mechanism.

In drag-based editing, limitations are of a different kind. GoodDrag still struggles with extreme deformations and difficult textures (Zhang et al., 2024). DirectDrag can under-drag when appearance preservation is too strong, and large geometric warps remain challenging (Liao et al., 3 Dec 2025). FlowDrag depends on mesh quality and remains vulnerable to errors in monocular 3D reconstruction (Koo et al., 11 Jul 2025). ARAP-GS preserves topology and therefore cannot handle edits that require tearing or hole creation (Han et al., 17 Apr 2025). DYG inherits failure modes from its 2D drag-conditioned diffusion prior and depends on good mask and control-point placement (Qu et al., 30 Jan 2025).

Across both major meanings of DRAGD, a common theme is the use of structured discrepancies as informative signals. In federated unlearning, the informative discrepancy is the change in gradients before and after deletion (Ju et al., 13 Jul 2025). In drag-based editing, the informative discrepancy is the spatial mismatch between handle points and targets, mediated by masks, features, or geometry priors (Zhang et al., 2024, Liao et al., 3 Dec 2025, Koo et al., 11 Jul 2025). The underlying technical principle differs, but both research directions transform a difference signal into a constrained optimization problem.

The term “DRAGD” therefore denotes not one unified theory but a cluster of context-specific meanings. Its most formal current use is the federated-unlearning attack of Luo et al. (Ju et al., 13 Jul 2025). Its broader descriptive use refers to drag-based image editing and its 3D generalizations (Zhang et al., 2024, Liao et al., 3 Dec 2025, Koo et al., 11 Jul 2025, Han et al., 17 Apr 2025, Qu et al., 30 Jan 2025). Any rigorous treatment of the term must distinguish these lineages rather than collapsing them under a single definition.