Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
New gradient inversion attacks tied to erasure-coding theory recover 94–100% of ImageNet batches, showing federated learning privacy leakage is underestimated.
The paper connects gradient inversion in federated learning to erasure-correcting code theory, constructing analytic attacks that exceed previously known recovery bounds. The attacks recover batches exactly, with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks, even a passive attacker observing an honestly trained network recovers 94–100% of ImageNet batches up to size 128, and more than 90% actively at batch sizes of several hundred. The authors conclude that federated learning's privacy leakage has been underestimated.
- Connects gradient inversion to erasure-correcting code theory
- Exact batch and label recovery from one FedSGD round
- Passive attacker recovers 94–100% of ImageNet batches up to size 128
- More than 90% recovered actively at batch sizes of several hundred
- Shows federated learning privacy leakage is underestimated
Full article192 words · extracted from arxiv.org · click to collapse
Federated learning shares model updates rather than raw data, yet these updates can be inverted to reconstruct the clients' training data. Analytic reconstruction attacks, which invert a gradient in closed form, degrade as the batch grows: prior single-round attacks recover only about half of a batch of size $100$ even when the attacker fully controls the network parameters, and known upper bounds limit what any such method can recover. We establish a connection between gradient inversion and the theory of erasure-correcting codes, and use it to construct attacks that exceed these bounds. Our attacks recover batches exactly, together with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks they outperform prior single-round attacks by a wide margin. Even a passive attacker who only observes an honestly trained network recovers $94$--$100\%$ of ImageNet batches at sizes up to $128$, more than prior single-round attacks achieve even with active manipulation of the model, and in the active setting more than $90\%$ is recovered at batch sizes of several hundred. These results show that the privacy leakage of federated learning has been underestimated.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.09659