Research map / Federated learning and privacy / Privacy attacks and secure learning
Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows all prior malicious-server data stealing attacks are client-detectable, and proposes SEER, a secret-decoder malicious-training attack that reconstructs client images from batches up to 512, even under secure aggregation.
Problem
Malicious server attacks that steal client data in federated learning at large batch sizes or under secure aggregation may be detectable by clients, questioning their practicality.
Approach
Introduces D-SNR, a gradient-space vulnerability metric showing example disaggregation attacks are detectable, and SEER, which jointly trains the shared model and a secret server-side decoder (disaggregator plus reconstructor) on auxiliary data so disaggregation happens in a hidden space, using local batch-dependent brightness/redness properties enabled by batch normalization.
Key results
- SEER reconstructs images on CIFAR10 with Rec 98.6% for CIFAR100 Red at B=512, and 87.8% to 94.2% across batch sizes 64-512 on CIFAR10 Bright.
- On CIFAR10 with B=128 and 100 batches, SEER attains 90% Rec with all successful attacks undetected by D-SNR, while Fishing's undetected success is only 4%-8% for strong settings.
- ImageNet with B=64 gives PSNR-All 21.9 and 82.1% successfully attacked batches; secure aggregation with C=8 keeps PSNR-Top around 25-28.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use SEER instead of prior MS attacks | CIFAR10, B=128, Red · CIFAR10 | Rec (%): 77 -> 90 | Helped |
| use a local batch-dependent property instead of the global property | SEER · large client batches | probability of exactly one selected image: 1/e -> >0.9 | Helped |
| increase the number of secure-aggregation clients | SEER · CIFAR10 secure aggregation | Rec (%) | Hurt |
| increase gradient clipping from C=1.0 to C=4.0 (ablation) | SEER · CIFAR10, Red, B=128 | Rec (%): 36.2 -> 95.2 | Helped |
| add DP-SGD noise at σ=5e-3 instead of σ=0.0 (ablation) | SEER with clipping C=3 · CIFAR10, Red, B=128 | Rec (%): 92.6 -> 84.0 | Hurt |
| add DP-SGD noise at σ=1e-2 instead of σ=0.0 (ablation) | SEER with clipping C=3 · CIFAR10, Red, B=128 | Rec (%): 92.6 -> 0.0 | Hurt |
| test with Btest=64 rather than the training batch size B=128 (ablation) | SEER · CIFAR10, Bright | Rec (%): 94.2% -> 42.0% | Hurt |
| test with Btest=256 rather than the training batch size B=128 (ablation) | SEER · CIFAR10, Bright | Rec (%): 94.2% -> 67.5% | Hurt |
Surprising findings
- Example disaggregation attacks are detectable via D-SNR only when successful; reducing detectability causes the attack to fail, so undetected successful attacks are rare.
- Differential privacy with DP-SGD at clipping norm 2 and noise 5e-3 still allows reconstruction from over 85% of batches.
Limitations
- Attack requires auxiliary data that resembles client data distribution, though transfer across datasets is shown.
- Training cost is high (up to 7 GPU days for CIFAR, 14 for ImageNet), noted as future work.
- Evaluated only on image classification with ResNet18 and single-image reconstruction per batch.
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNet TinyImageNet ISIC2019 CIFAR10.1 CIFAR10.2
Benchmarks: CIFAR10 CIFAR100 ImageNet
Metrics: Rec PSNR-All PSNR-Top D-SNR detectability Und-Rec
Baselines: Fishing Zhang23 LOKI
Builds on: Fishing LOKI Zhang23 DP-SGD
Closest papers by meaning
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.85)
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.85)
- DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans (NeurIPS 2024 · similarity 0.85)
- Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models (ICML 2025 · similarity 0.84)
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.84)
- Fortifying Federated Learning Towards Trustworthiness via Auditable Data Valuation and Verifiable Client Contribution (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.