Research map / Federated learning and privacy / Privacy attacks and secure learning
Recovering Labels from Local Updates in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RLU, a least-squares label recovery attack from output-layer local updates that works for multi-epoch local training, well-trained models, and non-FedAvg FL schemes (FedProx, SGDm, etc.).
Problem
Label recovery for gradient inversion attacks in federated learning fails under realistic settings: repeated labels, multiple local epochs, trained models, non-SGD or regularized local objectives, and when the server only sees model updates rather than gradients.
Approach
Relates the output-layer bias update to per-class sample counts via expected "erroneous confidence" statistics estimated by Monte Carlo on an auxiliary dataset, solves a constrained least-squares problem for label counts, and tracks the erroneous-confidence evolution across local epochs with a simulated dynamical model; generalized to FedProx, FedDyn, Scaffold, FedDC, SGDm and NAG through a coeffi
Key results
- On untrained models with m=1 local epoch, RLU reaches near-perfect iAcc (1.000 on SVHN, CIFAR100, Tiny-ImageNet with ReLU), outperforming LLG+, ZLG+ and iRLG.
- With m=10 local epochs, RLU keeps at least 84% cAcc and 90% iAcc across datasets and activations, while iRLG drops below 70% iAcc on CIFAR10 and CIFAR100.
- On trained models at 90% global training accuracy, RLU exceeds iRLG by 16.3%, 17.3% and 23.9% iAcc on SVHN, CIFAR10 and CIFAR100.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RLU instead of the strongest reported baseline | Label recovery on untrained models, single local epoch · SVHN, CIFAR10, CIFAR100, and Tiny-ImageNet | iAcc | Mixed |
| Use RLU instead of the strongest reported baseline | Label recovery on untrained models, 10 local epochs · SVHN, CIFAR10, CIFAR100, and Tiny-ImageNet | iAcc | Helped |
| Use RLU instead of the strongest reported baseline | Label recovery with varying data heterogeneity · CIFAR10, α=0.05 | iAcc: 0.766 -> 0.961 | Helped |
| Use RLU instead of the strongest reported baseline | Label recovery with varying data heterogeneity · CIFAR10, α=5 | iAcc: 0.944 -> 0.931 | Hurt |
| Use RLU instead of the strongest reported baseline | Label recovery on FedProx · SVHN, λ=0.5 | iAcc: 0.982 -> 0.991 | Helped |
| Use RLU instead of the strongest reported baseline | Label recovery on FedProx · CIFAR10, λ=5 | iAcc: 0.665 -> 0.899 | Helped |
| Use RLU instead of the strongest reported baseline | Label recovery with SGD momentum · CIFAR100, SGDm γ=0.9 | iAcc: 0.755 -> 0.882 | Helped |
| Use RLU to estimate labels before reconstructing images | Gradient inversion on CIFAR10 · CIFAR10 image reconstruction | PSNR | Helped |
| Use RLU to estimate labels before reconstructing images | Gradient inversion on CIFAR10 · CIFAR10 image reconstruction | LPIPS | Helped |
| Reduce the auxiliary dataset to 5 samples per class (ablation) | RLU · SVHN and Tiny-ImageNet | iAcc | No clear effect |
| Reduce the auxiliary dataset to 5 samples per class (ablation) | RLU · CIFAR10 and CIFAR100 | iAcc: 2.4%; 3.1% | Hurt |
| Train for 10 local epochs instead of one | Label recovery methods · Untrained models across the evaluated datasets | iAcc | Hurt |
Surprising findings
- The iRLG baseline, which performs well on single-epoch untrained models, degrades sharply under multi-epoch training on CIFAR10 and CIFAR100.
Limitations
- Accuracy declines as the global model becomes highly accurate because gradient magnitudes vanish and estimation becomes noise-sensitive.
- Requires a small auxiliary dataset held by the server and knowledge of batch size, epochs and learning rate.
Experimental setup
Datasets: SVHN CIFAR10 CIFAR100 Tiny-ImageNet
Benchmarks: SVHN CIFAR10 CIFAR100 Tiny-ImageNet
Metrics: cAcc iAcc PSNR LPIPS
Baselines: LLG+ ZLG+ iRLG IG
Builds on: DLG iDLG GradInversion iRLG FedAvg
Closest papers by meaning
- Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks (ICLR 2024 · similarity 0.90)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.87)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.87)
- SPEAR: Exact Gradient Inversion of Batches in Federated Learning (NeurIPS 2024 · similarity 0.86)
- Little Is Enough: Boosting Privacy by Sharing Only Hard Labels in Federated Semi-Supervised Learning (AAAI 2025 · similarity 0.86)
- Personalized Label Inference Attack in Federated Transfer Learning via Contrastive Meta Learning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.