Federated learning updates can reveal original training data exactly
Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
Machine LearningArtificial IntelligenceCryptography and Security
Summary
Federated learning shares updates to a model instead of raw data to protect privacy. However, this paper shows that even these updates can be reversed to perfectly reconstruct all the original data used to train the model. The authors connect this problem to error-correcting codes to create a powerful new attack that recovers entire batches of training samples and their labels from a single update. This suggests that privacy risks in federated learning have been underestimated, especially when batch sizes grow larger.
What this means in practice
- •For federated learning platform developers: Evaluate and improve privacy defenses by testing against this stronger gradient inversion attack to prevent data leakage from model updates.
- •For cybersecurity teams: Assess vulnerability of machine learning models to data reconstruction attacks from observed gradients to better protect client privacy.
Authors
Saeed Shariati, Mohsen Alambardar Meybodi
Abstract
Federated learning shares model updates rather than raw data, yet these updates can be inverted to reconstruct the clients' training data. Analytic reconstruction attacks, which invert a gradient in closed form, degrade as the batch grows: prior single-round attacks recover only about half of a batch of size $100$ even when the attacker fully controls the network parameters, and known upper bounds limit what any such method can recover. We establish a connection between gradient inversion and the theory of erasure-correcting codes, and use it to construct attacks that exceed these bounds. Our attacks recover batches exactly, together with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks they outperform prior single-round attacks by a wide margin. Even a passive attacker who only observes an honestly trained network recovers $94$--$100\%$ of ImageNet batches at sizes up to $128$, more than prior single-round attacks achieve even with active manipulation of the model, and in the active setting more than $90\%$ is recovered at batch sizes of several hundred. These results show that the privacy leakage of federated learning has been underestimated.