Summary
Federated learning lets many devices train an AI model together without sharing their private data. To keep each device’s updates hidden, systems usually add up updates locally before sharing, so only combined information is visible. This paper shows that when devices only combine updates from a few neighbors, bad actors can use math to figure out individual private updates. The authors develop a new attack method using known mathematical problems to break this privacy, revealing sensitive data behind the updates. This means that just adding neighbor-based aggregation isn't enough to protect privacy in decentralized setups.
What this means in practice
- •For federated learning platform developers: Evaluate and redesign aggregation protocols to prevent privacy leaks from sparse neighbor-based data combinations in decentralized networks.
- •For network security teams: Detect and mitigate privacy risks stemming from colluding nodes exploiting local aggregation structure in decentralized machine learning systems.
Authors
Wenrui Yu, Changlong Ji, Johannes Bjerva, Qiongxiu Li
Abstract
Secure Aggregation (SA) is widely regarded as a strong defense against model-update leakage in Federated Learning (FL), as it reveals only aggregate results while hiding individual updates. In Decentralized Federated Learning (DFL), SA is commonly instantiated as local neighborhood aggregation, where each node obtains a weighted aggregate over its neighbors. We show that this locality creates a structural leakage surface: sparse decentralized topologies provide colluding semi-honest nodes with asymmetric aggregate views, exposing multiple hidden linear combinations of honest participants' private states. Reconstructing private states from these aggregate views is fundamentally challenging, as both the private states and the aggregation coefficients are hidden. We tackle this challenge by establishing a formal connection to the Hidden Subset Sum Problem, a long-studied problem in cryptography. Building on this formulation, we design a lattice-based reconstruction approach that combines lattice reduction with structural filtering to reconstruct protected model states. We evaluate our attack on image, tabular, and text tasks under sparse DFL topologies. Our results show that colluding semi-honest nodes can recover the original local updates of honest nodes, enabling downstream reconstruction of private training data. These findings demonstrate that SA alone does not guarantee privacy in DFL when local aggregation induces asymmetric observations.