[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-273607-105":59,"doc-detail-273607-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","gradient-mirage-trainable-yet-label-unidentifiable-gradients-in-large-language-model-split-learning-abstract","Gradient Mirage - Trainable yet Label-Unidentifiable Gradients in Large Language Model Split Learning - Abstract","","Gradient matching attacks (GMAs) in LLM split learning exploit an underexplored assumption: the gradient exposed at the split interface is a faithful derivative of the client’s full-label training objective. This gradient–objective consistency enables a curious server to recover private label sequences by searching for a candidate whose induced gradient explains the observation. Gradient Mirage defends by breaking this consistency while preserving optimization utility. It induces misspecification across objective, direction, and scale using masked surrogate supervision, randomized scale blinding, and directional privatization with vMF under a metric differential privacy guarantee. Utility remains through dual-track backpropagation and bottom-gradient recovery, yielding stronger privacy-utility trade-offs than prior defenses.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/gradient-mirage-trainable-yet-label-unidentifiable-gradients-in-large-language-model-split-learning-abstract/273607/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/gradient-mirage-trainable-yet-label-unidentifiable-gradients-in-large-language-model-split-learning-abstract/273607.png","ImageObject",300,407,{"name":92,"@type":93},"Ezra","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-16","2026-09-15",true,{"@type":102,"interactionType":103,"userInteractionCount":52},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What assumption do gradient matching attacks make in LLM split learning?","Question",{"text":112,"@type":113},"They assume the gradient exposed at the split interface is a faithful derivative of the client’s full-label training objective. This gradient–objective consistency lets a server search for label sequences that explain the observed gradients.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does Gradient Mirage protect against label recovery?",{"text":117,"@type":113},"It deliberately breaks gradient–objective consistency without discarding the backward utility. It induces misspecified inverse-problem conditions by combining masked surrogate losses, randomized scale blinding, and directional privatization.",{"name":119,"@type":110,"acceptedAnswer":120},"Does Gradient Mirage harm model training utility?",{"text":121,"@type":113},"No. The method preserves utility by keeping Top-segment learning over all target tokens via dual-track backpropagation and restoring effective gradients for Bottom-segment optimization through bottom-gradient recovery.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},273607,1790380846,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":52,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145},1099514068035,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","Gradient Mirage: Trainable yet Label-Unidentifiable Gradients in Large  \nLanguage Model Split Learning  \nShiyu Miao 1 , Yunlong Mao 1 * , Zirui Huang 1 , Liang Yao2 , Tianshuo Zheng3 , Yanhui Gu4 , Fan Liu2 , Sheng Zhong 1 ,  \n1 State Key Laboratory for Novel Software Technology, Nanjing University  \n2 College of Computer Science and Software Engineering, Hohai University  \n3 School of Mathematics, Nanjing University 4 Nanjing Normal University  \n[maoyl@nju.edu.cn](maoyl@nju.edu.cn), [zhongsheng@nju.edu.cn](zhongsheng@nju.edu.cn)  \narXiv : 2608 . 18767v 1 [cs .CL] 19 Aug 2026  \nAbstract  \nGradient matching attacks (GMAs) in LLM split learning (SL) rely on a critical yet underexplored assumption: the gradient exposed at the split interface is a faithful derivative of the client’s full-label training objective. This gradient–objective consistency allows a curious server to recover private labels by searching for a sequence whose induced gradient explains the observation. We propose Gradient Mirage, a defense that breaks this consistency without discarding the optimization utility of the backward signal. Our key idea is to induce the adversary to solve a misspecified inverse problem, in which no plausible label sequence in the sequence space can explain the observed gradients. Concretely, Gradient Mirage achieves this by inducing inconsistency across three dimensions: objective, direction, and scale. Selective Autoregressive Supervision derives the exposed gradient from amasked surrogate loss rather than the full-label objective assumed by the attacker; Scale Blinding then applies randomized multiplicative rescaling, obscuring the gradient’s natural magnitude; and Directional Privatization further randomizes the gradient direction while preserving its magnitude through the von Mises–Fisher (vMF) mechanism under a directional metric differential privacy guarantee. Crucially, utility is preserved: the Top segment still learns from all target tokens via Dual-Track Backpropagation, the exposed gradient remains informative since each supervised token retains its complete autoregressive context, and Bottom-Gradient Recovery restores the effective gradient for Bottom-segment optimization. Extensive experiments show that Gradient Mirage provides substantially stronger protection than existing defenses under comparable fine-tuning performance, achieving a better privacy-utility trade-off.  \nCode—[https://github.com/StevenMsy/GMA-SL](https://github.com/StevenMsy/GMA-SL)  \n1 Introduction  \nMachine Learning-as-a-Service (MLaaS) has become a dominant paradigm for deploying large-scale models (Caiet al. 2024; Lin et al. 2026), allowing data owners to outsource computation and reduce infrastructure overhead. In its training setting, commonly known as Training-asa-Service (TaaS), Split Learning (SL) (Gupta and Raskar  \n* Corresponding Author  \nCopyright © 2026, Association for the Advancement of Artificial Intelligence ([www.aaai.org](www.aaai.org)). All rights reserved.  \nFigure 1: Illustration of label leakage in label-shielded split learning. Given the gradient returned from the client’s Top segment to the Trunk segment, a curious-but-honest server can recover the label sequence by optimization.  \n2018; Vepakomma et al. 2018; Poirot et al. 2019; Chen et al. 2024; Shen et al. 2025; Zhang et al. 2026) mitigates direct data exposure by partitioning model training between the client and server. We focus on LLM supervised finetuning under Label-Shielded Split Learning (Pasquini, Ateniese, and Bernaschi 2021), where the compute-intensive Trunk segment is outsourced to the server, while the Bottom and Top segments remain on the client to keep private inputs, labels, and supervised loss local.  \nHowever, prior research (Chen et al. 2024) shows that this LLM-SL system fails to provide effective privacy protection against a curious-but-honest server. In particular, the client’s private data becomes highly vulnerable to GMAs (Zhu, Liu, and Han 2019; Zha","cbCainqfeS4MX0R1","https://ap.wps.com/l/cbCainqfeS4MX0R1","pdf",3757115,22,"English","# Abstract\n# Introduction\n## Label leakage in label-shielded split learning\n## Gradient matching attack (GMA-SL) in LLM split learning\n## Defense: Gradient Mirage","[{\"question\":\"What assumption do gradient matching attacks make in LLM split learning?\",\"answer\":\"They assume the gradient exposed at the split interface is a faithful derivative of the client’s full-label training objective. This gradient–objective consistency lets a server search for label sequences that explain the observed gradients.\"},{\"question\":\"How does Gradient Mirage protect against label recovery?\",\"answer\":\"It deliberately breaks gradient–objective consistency without discarding the backward utility. It induces misspecified inverse-problem conditions by combining masked surrogate losses, randomized scale blinding, and directional privatization.\"},{\"question\":\"Does Gradient Mirage harm model training utility?\",\"answer\":\"No. The method preserves utility by keeping Top-segment learning over all target tokens via dual-track backpropagation and restoring effective gradients for Bottom-segment optimization through bottom-gradient recovery.\"}]","Gradient Mirage - Trainable yet Label-Unidentifiable Gradients in Large Language Model Split Learning - Abstract | PDF",1789472264,55]