---
title: 'DRAGD: Federated Unlearning & Drag-Based Editing'
url: https://www.emergentmind.com/topics/dragd
type: topic
---

# DRAGD: Federated Unlearning & Drag-Based Editing

Searching arXiv for the exact term and closely related usages to ground the article.
“DRAGD” is an ambiguous acronym in recent arXiv literature. In the most literal sense, it denotes the federated-unlearning attack “DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences” [2507.09602]. However, the same character string also appears in other subfields as a shorthand for “drag-based image editing” or as an informal variant of methods whose canonical names are DRAG or DRAGO rather than DRAGD. In the federated-learning context, DRAGD refers specifically to a data reconstruction attack that exploits gradient discrepancies before and after unlearning to recover deleted data [2507.09602]. In the image-editing literature, “DRAGD” is used descriptively for drag-based image editing rather than as a unique algorithm, with concrete realizations including GoodDrag [2404.07206], DirectDrag [2512.03981], FlowDrag [2507.08285], and 3D methods such as ARAP-GS [2504.12788] and DYG [2501.18672]. This ambiguity makes contextual disambiguation essential.

## 1. Terminological scope and disambiguation

In the federated-unlearning literature, DRAGD is an official method name. The paper “DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences” defines DRAGD as an attack that reconstructs forgotten data from the difference between pre-unlearning and post-unlearning gradients [2507.09602]. The paper also introduces DRAGDP, which augments DRAGD with publicly available prior data to improve reconstruction accuracy, particularly for complex datasets such as facial images [2507.09602].

In several other literatures, “DRAGD” is not a canonical acronym but a descriptive shorthand. In drag-based diffusion editing, the data explicitly state that “drag-based image editing (DRAGD)” aims to manipulate image content by moving a small set of user-specified handle points to target positions [2512.03981]. The same descriptive use appears in discussions of GoodDrag [2404.07206], FlowDrag [2507.08285], and ARAP-GS [2504.12788]. By contrast, some similarly spelled methods are not DRAGD at all. “Debate-Augmented RAG” is DRAG, not DRAGD [2505.18581]. “Knowledge Retention for Continual Model-Based Reinforcement Learning” introduces DRAGO rather than DRAGD [2503.04256]. “Divergence-based Adaptive Aggregation” is DRAG, not DRAGD [2309.01779].

This suggests that DRAGD functions less as a stable, field-wide acronym than as a context-dependent label shared by at least two distinct research lineages: federated unlearning attacks and drag-based editing.

## 2. DRAGD in federated unlearning

In federated learning, DRAGD targets federated unlearning, where a system is expected to remove the influence of a client’s data from a trained model. The central observation is that unlearning changes the gradients available to the server, and these changes can leak information about the removed data [2507.09602]. The attacker is the server, modeled as honest-but-curious, with access to the model parameters, the pre-unlearning gradients, and the post-unlearning gradients [2507.09602].

The core quantities are the pre-unlearning gradient $g_{\mathrm{pre}}$ and the post-unlearning gradient $g_{\mathrm{post}}$. DRAGD defines a gradient difference
$$
\Delta g := g_{\mathrm{pre}} - g_{\mathrm{post}}.
$$
Under a fixed reference model, this difference decomposes into a term proportional to the forgotten data gradient and a nuisance term induced by normalization over the remaining data [2507.09602]. The method therefore does not simply invert $\Delta g$ directly. Instead, it first reconstructs the remaining data from $g_{\mathrm{post}}$, then holds that reconstruction fixed and optimizes the forgotten data so that the combined synthetic batch matches $g_{\mathrm{pre}}$ [2507.09602].

This two-step structure is the defining feature of DRAGD. Step I reconstructs the remaining dataset $D_r$ from the post-unlearning gradients at $\theta_{\mathrm{post}}$ through a gradient-matching objective. Step II reconstructs the forgotten dataset $D_f$ at $\theta_{\mathrm{pre}}$ while freezing the reconstruction of $D_r$ [2507.09602]. The paper emphasizes that fixing this reconstructed “Part” is critical; ablations show large degradation when it is allowed to move during the second phase [2507.09602].

The reconstruction objectives are given explicitly. For the remaining dataset,
$$
J_r(N_r, Y_r) = \sum_l w_l \left\| \nabla_{\theta_l} L(f_{\theta_{\mathrm{post}}}; N_r, Y_r) - g_{\mathrm{post},l} \right\|_2,
$$
and for the forgotten dataset,
$$
J_f(N_f, Y_f) = \sum_l w_l \left\| \nabla_{\theta_l} L(f_{\theta_{\mathrm{pre}}}; N_r \cup N_f, Y_r \cup Y_f) - g_{\mathrm{pre},l} \right\|_2.
$$
The update rules optimize $N_r$ and then $N_f$ by gradient descent, with $\nabla_{N_r} J_f = 0$ enforced in the second phase [2507.09602].

A public-prior variant, DRAGDP, changes the initialization of the forgotten batch. Instead of random initialization, $N_f$ is initialized from a public dataset $D_{\mathrm{pub}}$, which sharply narrows the search space on structured domains such as faces [2507.09602]. This suggests that DRAGDP is not a different inversion principle but a prior-enhanced instantiation of the same two-stage attack.

## 3. Empirical performance of federated-unlearning DRAGD

The reported experiments cover MNIST, CIFAR-10, and LFW, with LeNet used for MNIST and LFW and ResNet-18 or ConvNet-64 used for CIFAR-10 [2507.09602]. The federated-learning setup uses $K = 10$ clients with a Non-IID partition via Dirichlet$(\alpha = 0.1)$ [2507.09602]. The attack is run for 300 iterations per phase, with learning rate $0.05$ for MNIST and LFW and $0.01$ for CIFAR-10 [2507.09602].

The principal metrics are MSE, PSNR, and SSIM [2507.09602]. On MNIST with LeNet, DRAGD improves substantially over DLG, while DRAGDP improves further, reaching MSE $0.029$, PSNR $24.86$, and SSIM $0.849$ [2507.09602]. On LFW with LeNet, DRAGDP likewise greatly outperforms DRAGD and DLG, obtaining MSE $0.011$, PSNR $21.40$, and SSIM $0.879$ [2507.09602]. On CIFAR-10, DRAGD also outperforms inversion baselines such as IG, though the gains are smaller and depend on the backbone [2507.09602].

The most striking ablation concerns freezing the reconstructed remaining set. On MNIST, DRAGD improves from MSE $0.144$ to $0.006$, PSNR from $14.42$ to $29.62$, and SSIM from $0.713$ to $0.975$ when the “Part” reconstruction is fixed during the second stage [2507.09602]. This is one of the clearest empirical indicators of the mechanism by which DRAGD gains over standard gradient inversion.

The paper frames these results as evidence of a privacy vulnerability specific to federated unlearning: comparative information between the pre-unlearning and post-unlearning states can make deleted data more recoverable than a single gradient snapshot would suggest [2507.09602]. A plausible implication is that federated unlearning can create a new attack surface even when federated learning already appears privacy-aware at the protocol level.

## 4. DRAGD as drag-based image editing

In image generation and editing, “DRAGD” is used as a task label rather than as a unique model name. The problem is to manipulate image content by moving a small set of handle points to target positions while preserving semantic fidelity and minimizing unintended changes [2512.03981]. GoodDrag presents this as drag editing with diffusion models, where an input image is inverted to a latent and then updated using motion supervision and denoising [2404.07206]. DirectDrag describes the same general problem as “drag-based image editing (DRAGD)” and defines it through handle points $p_i$ and target positions $t_i$ [2512.03981].

A recurring difficulty in this literature is the trade-off between fidelity and control. Manual masks are often used to localize edits, but they are burdensome and error-prone; textual prompts can help preserve semantics, but they are imprecise and can reduce point alignment when omitted [2512.03981]. This has motivated several increasingly specialized formulations.

GoodDrag proposes an Alternating Drag-and-Denoising (AlDD) schedule that interleaves drag updates and denoising, rather than concentrating all drag operations at a single diffusion step [2404.07206]. Its information-preserving motion supervision aligns current features with the original handle-point features rather than with the previous-step features, reducing drift [2404.07206]. DirectDrag pushes the setting further by removing both manual masks and prompts. It does so with Auto Soft Mask Generation (ASM), which infers a soft editable region from handle-to-target trajectories, and Readout-Guided Feature Alignment (RGFA), which uses intermediate diffusion activations and a learned readout head as a prompt-free appearance prior [2512.03981].

The mathematical structure of these systems is diffusion-centric. DirectDrag uses the triplet loss
$$
\mathcal{L}_{\mathrm{triplet}} = \max(0, D(F(I_a), F(I_p)) - D(F(I_a), F(I_n)) + \delta)
$$
to train the readout, and at inference applies
$$
\mathcal{L}_{\mathrm{rg}} = \|F(\bar z_t^k) - F(z_t^0)\|_2^2
$$
to preserve appearance during editing [2512.03981]. It also incorporates motion supervision and patch-level drag alignment losses [2512.03981]. GoodDrag similarly defines an AlDD motion-supervision loss in the latent space and alternates this with DDIM denoising [2404.07206].

The benchmarks and metrics for this line of work are also specialized. GoodDrag introduces Drag100 and the Dragging Accuracy Index (DAI), where lower is better, together with Gemini Score for perceptual quality [2404.07206]. DirectDrag reports DragBench metrics such as Image Fidelity $(1-\mathrm{LPIPS})$, CLIP similarity, and Mean Distance, showing strong fidelity among manual mask-free methods [2512.03981]. FlowDrag later adds a 3D-aware formulation and a new ground-truth benchmark, VFD (VidFrameDrag), to evaluate how well edits match intended transformations [2507.08285].

## 5. Extensions into 3D drag-based editing

The “DRAGD” task interpretation extends naturally into 3D scene editing. ARAP-GS introduces drag-driven editing for 3D Gaussian Splatting by deforming Gaussian centers with an As-Rigid-As-Possible (ARAP) objective and then refining appearance with a diffusion-based super-resolution prior [2504.12788]. The ARAP energy is
$$
E = \sum_{i=1}^{n} w_i \sum_{j \in \mathcal{N}(i)} w_{ij} \| (p'_i - p'_j) - R_i (p_i - p_j)\|^2,
$$
and position updates solve a constrained linear system under handle-point boundary conditions [2504.12788]. The method uses a representative subset of Gaussians, interpolation to the rest, and mask-guided fine-tuning with StableSR [2504.12788].

DYG (“Drag Your Gaussian”) adapts drag-based editing to 3D Gaussian Splatting through score distillation rather than ARAP. It uses a triplane scaffold to predict per-Gaussian position offsets and a Drag-SDS loss that distills a drag-conditioned 2D latent diffusion model into the 3D representation [2501.18672]. The composite noise target is
$$
\hat\epsilon = \epsilon_{\mathrm{tgt}} - \epsilon_{\mathrm{src}} + \epsilon,
$$
and the total Drag-SDS objective combines latent-space, image-space, and LoRA terms [2501.18672]. This suggests that “DRAGD” in the editing literature has broadened from a 2D point-manipulation task into a family of geometry-aware control methods spanning 2D diffusion, 3D Gaussian Splatting, and mesh-guided editing.

FlowDrag provides another extension by constructing a 3D mesh from a single image, deforming it with SR-ARAP, projecting the deformations into a dense 2D vector flow field, and injecting that flow into a diffusion UNet [2507.08285]. Its deformation objective augments ARAP with rotation smoothing and inter-step smoothness [2507.08285]. A plausible implication is that the drag-editing literature is converging on the use of explicit geometric priors to correct the geometric inconsistency of purely 2D, local-feature-based drag objectives.

## 6. Related but distinct DRAG/DRAGO methods

Several arXiv papers contain “DRAG”-like names but are not DRAGD. This distinction matters because the acronym collision can lead to incorrect attribution.

In retrieval-augmented generation, “Debate-Augmented RAG” is DRAG, not DRAGD [2505.18581]. It addresses “Hallucination on Hallucination” in RAG by introducing multi-agent debate in both retrieval and generation, with asymmetric information roles in the response stage [2505.18581]. Its core stages are retrieval debate,
$$
\hat Q, C_{\hat Q} = f_{\mathrm{RetDebate}}(x, \mathcal{R}),
$$
and response debate,
$$
\hat y = f_{\mathrm{ResDebate}}(x, C_{\hat Q}),
$$
not drag-based editing or gradient inversion [2505.18581].

In continual model-based reinforcement learning, the method is DRAGO, “Dynamics-leaRning while RegAinG MemOries,” not DRAGD [2503.04256]. DRAGO combines Synthetic Experience Rehearsal and Regaining Memories Through Exploration to preserve world-model dynamics across tasks [2503.04256]. Its dynamics update uses
$$
L_{\mathrm{dyn}}(\psi) = \mathbb{E}_{(s,a,s')\sim\mathcal{D}_i}\!\left[\|s' - T_i(s,a;\psi)\|^2\right] + \lambda \mathbb{E}_{(\hat s,\hat a)\sim p_G}\!\left[\|T_{\mathrm{old}}(\hat s,\hat a) - T_i(\hat s,\hat a;\psi)\|^2\right]
$$
and is conceptually unrelated to either drag-based editing or federated unlearning [2503.04256].

In federated learning on non-IID data, DRAG is “Divergence-based Adaptive Aggregation” [2309.01779]. It measures the cosine-based degree of divergence between local and reference updates,
$$
\lambda_m^t := c\Bigg(1-\frac{\langle \mathbf{g}_m^t,\mathbf{r}^t\rangle}{\|\mathbf{g}_m^t\|\,\|\mathbf{r}^t\|}\Bigg),
$$
and adaptively drags local updates toward a server reference direction [2309.01779]. Despite the verbal resemblance, this “dragging” is an aggregation rule in optimization geometry rather than a point-manipulation or reconstruction attack framework.

These examples show that the surface string “DRAGD” cannot be interpreted reliably without domain context.

## 7. Limitations, controversies, and broader significance

The most immediate controversy surrounding DRAGD arises in federated unlearning. Unlearning is often presented as a privacy-enhancing capability, yet DRAGD shows that the transition from pre-unlearning to post-unlearning can itself leak the removed data [2507.09602]. The paper therefore motivates defenses such as additive DP noise, secure aggregation, masking or obfuscation of unlearning updates, and adaptive noise injection [2507.09602]. This suggests that unlearning protocols must be evaluated not only for deletion fidelity but also for leakage induced by the deletion mechanism.

In drag-based editing, limitations are of a different kind. GoodDrag still struggles with extreme deformations and difficult textures [2404.07206]. DirectDrag can under-drag when appearance preservation is too strong, and large geometric warps remain challenging [2512.03981]. FlowDrag depends on mesh quality and remains vulnerable to errors in monocular 3D reconstruction [2507.08285]. ARAP-GS preserves topology and therefore cannot handle edits that require tearing or hole creation [2504.12788]. DYG inherits failure modes from its 2D drag-conditioned diffusion prior and depends on good mask and control-point placement [2501.18672].

Across both major meanings of DRAGD, a common theme is the use of structured discrepancies as informative signals. In federated unlearning, the informative discrepancy is the change in gradients before and after deletion [2507.09602]. In drag-based editing, the informative discrepancy is the spatial mismatch between handle points and targets, mediated by masks, features, or geometry priors [2404.07206; 2512.03981; 2507.08285]. The underlying technical principle differs, but both research directions transform a difference signal into a constrained optimization problem.

The term “DRAGD” therefore denotes not one unified theory but a cluster of context-specific meanings. Its most formal current use is the federated-unlearning attack of Luo et al. [2507.09602]. Its broader descriptive use refers to drag-based image editing and its 3D generalizations [2404.07206; 2512.03981; 2507.08285; 2504.12788; 2501.18672]. Any rigorous treatment of the term must distinguish these lineages rather than collapsing them under a single definition.

Source: https://www.emergentmind.com/topics/dragd