mlsanityData to 7 Oct 2026

Two Models are Better than One: Federated Learning Is Not Private For Google GBoard Next Word Prediction

arXiv 2210.16947 ↗First posted 30 Oct 2022cs.LGcited by 4

Not on the map. Why?

Abstract (arXiv)

In this paper we present new attacks against federated learning when used to train natural language text models. We illustrate the effectiveness of the attacks against the next word prediction model used in Google's GBoard app, a widely used mobile keyboard app that has been an early adopter of federated learning for production use. We demonstrate that the words a user types on their mobile handset, e.g. when sending text messages, can be recovered with high accuracy under a wide range of conditions and that counter-measures such a use of mini-batches and adding local noise are ineffective. We also show that the word order (and so the actual sentences typed) can be reconstructed with high fidelity. This raises obvious privacy concerns, particularly since GBoard is in production use.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 19 of its 29 references that are in the map. First posted on arXiv 30 Oct 2022.

Builds on

19 of 29 references.

References · 19

  1. 2017Attention Is All You Needcited by 59,932
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2020Extracting Training Data from Large Language Modelscited by 2,144
  5. 2019Deep Leakage from Gradientscited by 1,004
  6. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  7. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  8. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  9. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  10. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  11. 2015LSTM: A Search Space Odysseycited by 315
  12. 2016Using the Output Embedding to Improve Language Modelscited by 266
7 more
  1. 2016Practical Secure Aggregation for Federated Learning on User-Held Datacited by 178
  2. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 169
  3. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  4. 2020R-GAP: Recursive Gradient Attack on Privacycited by 95
  5. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
  6. 2021TAG: Gradient Attack on Transformer-based Language Modelscited by 63
  7. 2020SAPAG: A Self-Adaptive Privacy Attack From Gradientscited by 27

Built on by

Cited by year

Citing papers per year: 2023: 2; 2024: 2.

4 papers.

  1. 2024Federated Learning in Practice: Reflections and Projectionscited by 15
  2. 2023Private Federated Learning with Autotuned Compressioncited by 5
  3. 2024Confidential Federated Computationscited by 4
  4. 2023Balancing Privacy, Robustness, and Efficiency in Machine Learningcited by 1