Unmasking Transformers: A Theoretical Approach to Data Recovery via Attention Weights

ICLR 2025 Workshop BuildingTrust Submission29 Authors

06 Feb 2025 (modified: 06 Mar 2025)Submitted to BuildingTrustEveryoneRevisionsBibTeXCC BY 4.0
Track: Long Paper Track (up to 9 pages)
Keywords: Inversion Attack, Data Privacy in LLMs, Optimization
Abstract:

In the realm of deep learning, transformers have emerged as a dominant architecture, particularly in both natural language processing and computer vision tasks. However, with their widespread adoption, concerns regarding the security and privacy of the data processed by these models have arisen. In this paper, we address a pivotal question: Can the data fed into transformers be recovered using their attention weights and outputs? We introduce a theoretical framework to tackle this problem. Specifically, we present an algorithm that aims to recover the input data $X \in \mathbb{R}^{d \times n}$ from given attention weights $W = QK^\top \in \mathbb{R}^{d \times d}$ and output $B \in \mathbb{R}^{n \times n}$ by minimizing the loss function $L(X)$. This loss function captures the discrepancy between the expected output and the actual output of the transformer. Our findings have significant implications for preventing privacy leakage from attacking open-sourced model weights, suggesting potential vulnerabilities in the model's design from a security and privacy perspective - you may need only a few steps of training to force LLMs to tell their secrets.

Submission Number: 29
Loading

OpenReview is a long-term project to advance science through improved peer review with legal nonprofit status. We gratefully acknowledge the support of the OpenReview Sponsors. © 2025 OpenReview