Research map / Federated learning and privacy / Privacy attacks and secure learning
Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that data leaked by gradient inversion and linear layer leakage attacks in federated learning can train models that outperform FedAvg on CIFAR-10, MNIST and Tiny ImageNet, and characterizes the limits of each attack for downstream training.
Problem
Data reconstruction attacks on federated learning are judged only by reconstruction fidelity (PSNR, SSIM, LPIPS) or leakage rate, not by whether the leaked data is useful for downstream model training.
Approach
Treat leaked client data as a training resource: train models from scratch, fine-tune FL models, or run semi-supervised learning (CoMatch) on images leaked by Inverting Gradients (GI) and LOKI (LLL), and measure test accuracy against centralized and FedAvg baselines.
Key results
- On CIFAR-10, models trained on LOKI leaked data reach 93.16% accuracy and GI-leaked data 90.34%, versus 72.76% for FedAvg with 10 clients (about 20.40% and 17.58% higher), and centralized training 94.38%.
- On CIFAR-10, training on GI reconstructions with PSNR below 14 yields 58.29% test accuracy, showing poor-quality reconstructions remain useful.
- On MNIST, LOKI reaches 98.82% versus 98.89% centralized; GI reaches 95.96% (batch 8), slightly below FedAvg at 96.17%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train on leaked CIFAR-10 data using LOKI instead of FedAvg | LOKI · CIFAR-10 test | accuracy: 72.76% -> 93.16% | Helped |
| Train on leaked CIFAR-10 data using Inverting Gradients instead of FedAvg | Inverting Gradients · CIFAR-10 test | accuracy: 72.76% -> 90.34% | Helped |
| Increase Inverting Gradients batch size from 4 to 16 (ablation) | Inverting Gradients · CIFAR-10 test | accuracy: 90.34% -> 76.83% | Hurt |
| Reduce LOKI FC factor from 8 to 1 (ablation) | LOKI · CIFAR-10 test | accuracy: 93.16% -> 88.86% | Hurt |
| Train on leaked MNIST data using LOKI rather than FedAvg | LOKI · MNIST test | accuracy: 96.17% -> 98.82% | Helped |
| Train on leaked MNIST data using Inverting Gradients rather than FedAvg | Inverting Gradients · MNIST test | accuracy: 96.17% -> 95.96% | Hurt |
| Reduce LOKI FC factor from 8 to 1 (ablation) | LOKI · Tiny ImageNet validation | top-1 accuracy: 46.70% -> 35.20% | Hurt |
| Increase LOKI FC factor (ablation) | LOKI · CIFAR-10, LOKI FedSGD | leakage rate: 36.48 -> 87.58 | Helped |
| Use LOKI FedAvg rather than LOKI FedSGD | LOKI · CIFAR-10 leakage | leakage rate: 36.48 -> 58.39 | Helped |
| Use LOKI FedAvg rather than LOKI FedSGD | LOKI · CIFAR-10 test | accuracy: 88.86 -> 91.11 | Helped |
| Keep only reconstructions with PSNR > 14 rather than using all batch-size-16 leaked data (ablation) | Inverting Gradients · CIFAR-10 test | accuracy: 76.83% -> 75.48% | Hurt |
| Train using only images with PSNR < 14 (ablation) | Inverting Gradients · CIFAR-10 test | accuracy: 58.29% | Helped |
Surprising findings
- Training on very poorly reconstructed images (PSNR < 14, or < 12 with 45.05% accuracy) still improves over no useful data, so PSNR does not reflect usefulness for training.
- LOKI accuracy on CIFAR-10 drops only from 93.16% to 88.86% while leakage falls from 87.58% to 36.48% of images.
Limitations
- Gradient inversion reconstruction quality degrades with batch size, making leaked data less useful for training at larger batches.
- LLL leaked images are not matched to labels, requiring manual labeling or semi-supervised learning; LLL also requires architecture modification with large model size overhead.
- Experiments assume an untrained or best-case setting with all labels correctly recovered and the attack applied to all batches; results are on small datasets.
Experimental setup
Datasets: CIFAR-10 MNIST Tiny ImageNet
Benchmarks: CIFAR-10 MNIST Tiny ImageNet
Metrics: test accuracy top-1 validation accuracy PSNR SSIM leakage rate
Baselines: Centralized training FedAvg Inverting Gradients LOKI
Builds on: Inverting Gradients LOKI Robbing the Fed CoMatch FedAvg
Closest papers by meaning
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.89)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.89)
- Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspective (AAAI 2024 · similarity 0.87)
- A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning (CVPR 2024 · similarity 0.87)
- Privacy Backdoors: Stealing Data with Corrupted Pretrained Models (ICML 2024 · similarity 0.87)
- Recovering Labels from Local Updates in Federated Learning (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.