When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
Researchers show colluding nodes in decentralized federated learning can reconstruct private updates despite secure aggregation, using lattice-based attacks tied to the Hidden Subset Sum Problem.
Secure aggregation in decentralized federated learning is widely assumed to hide individual model updates. The authors show that sparse decentralized topologies give colluding semi-honest nodes asymmetric aggregate views exposing hidden linear combinations of honest participants' private states. They establish a formal connection to the Hidden Subset Sum Problem and design a lattice-based reconstruction approach combining lattice reduction with structural filtering. Evaluations on image, tabular, and text tasks show attackers recover local updates and can reconstruct private training data.
- Neighborhood aggregation leaks hidden linear combinations of honest nodes' states
- Reconstruction framed as Hidden Subset Sum Problem
- Lattice reduction plus structural filtering recovers private updates
- Attack validated on image, tabular, and text tasks
- Secure aggregation alone insufficient for DFL privacy
Full article199 words · extracted from arxiv.org · click to collapse
Secure Aggregation (SA) is widely regarded as a strong defense against model-update leakage in Federated Learning (FL), as it reveals only aggregate results while hiding individual updates. In Decentralized Federated Learning (DFL), SA is commonly instantiated as local neighborhood aggregation, where each node obtains a weighted aggregate over its neighbors. We show that this locality creates a structural leakage surface: sparse decentralized topologies provide colluding semi-honest nodes with asymmetric aggregate views, exposing multiple hidden linear combinations of honest participants' private states. Reconstructing private states from these aggregate views is fundamentally challenging, as both the private states and the aggregation coefficients are hidden. We tackle this challenge by establishing a formal connection to the Hidden Subset Sum Problem, a long-studied problem in cryptography. Building on this formulation, we design a lattice-based reconstruction approach that combines lattice reduction with structural filtering to reconstruct protected model states. We evaluate our attack on image, tabular, and text tasks under sparse DFL topologies. Our results show that colluding semi-honest nodes can recover the original local updates of honest nodes, enabling downstream reconstruction of private training data. These findings demonstrate that SA alone does not guarantee privacy in DFL when local aggregation induces asymmetric observations.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.08476