{"id":"5a407789-c3e2-4ba2-a0f7-0c0b718c7a71","arxiv_id":"2411.18269","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A malicious federated learning server can hide a secret model inside client parameters via code injection and later reconstruct the client's training images from Fibonacci-coded index queries.","lead":"The paper presents a data reconstruction attack on federated learning that embeds a hidden memorization model in the client's own parameters through injected training code, then reads out training images by querying index codes. It reports stealing up to 512 images per round on CIFAR while evading several gradient-based defenses, which matters if a malicious server can distribute code to clients.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Main-task accuracy after the parameter-sharing memory training is never reported; without it, the 'undetected' claim is unverified, and the central attack/stealth result is conditional.","rationale":"The reader's weakest assumption already identifies the missing main-task accuracy as the core unverified condition. My stress-test concurs: the central claim has two parts—high-volume extraction and evasion of detection. The extraction numbers are internally consistent (though the secret model architecture is underspecified), but the evasion claim depends on the attack being invisible to the client. Since the memory task shares parameters with the classification model and is trained alternately, it could plausibly distort the decision boundary; without accuracy numbers, the paper provides no evidence that this does not happen. The defense evaluations in Section 5 target gradient-space monitors, which a client would not necessarily rely on; validation accuracy is a standard, low-cost check that any federated participant could perform. Therefore, the most load-bearing concern is the unmeasured effect on main-task utility. The proposed test is direct and would settle whether the attack is truly stealthy. I also note the architecture gap as a secondary reproducibility issue, but the accuracy gap is the one that, if it lands, invalidates the headline claim. Because both issues are addressable with additional experiments and documentation, conditional acceptance remains the appropriate verdict.","tokens_in":27529,"tokens_out":6125,"duration_ms":61585,"concrete_test":"Rerun the CIFAR-10 FedAvg experiment with N=512 and report the local model's test accuracy (or loss) on a held-out set after each of the 10 local epochs, compared with a benign baseline trained without the memory task. If accuracy drops by more than a few points, the stealth claim fails. Also release the exact layer dimensions and parameter mapping of M' (from ResNet-18 parameters to FC weights) and verify that the extracted 512 images have SSIM/PSNR matching Table 2.","verdict_should_be":"UNCHANGED","load_bearing_attack":"To support the claim that the attack is undetected while extracting 512 images per round, the paper must show that the hidden memory task, trained alternately with the classification task on the same parameters (§3.3, Eq. (3); Figure 1), does not degrade the victim model's utility. No main-task accuracy is reported anywhere, and Section 5 only evaluates gradient-space defenses (D-SNR, noise, pruning, clipping, loss curves). If the alternating optimization reduces classification accuracy by more than a few points, the client can detect the attack by standard validation, breaking the 'without being detected' claim that is central to the paper. In addition, the exact architecture of the secret model M' is never given, so the reported 512/512 leakage cannot be independently reproduced or audited.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a new active data-reconstruction attack against federated learning. The malicious server injects a few lines of training code into the client's local training loop; this code alternately optimizes the classification task and a hidden 'memory task' on a secret model M' that shares parameters with the victim model through systematic sampling (every k-th parameter, r=1, k=2). A Fibonacci-based encoding assigns sparse, label-agnostic indices to training samples, and a block-partitioning scheme with a variation loss is used for high-resolution images. The authors report that the attack extracts 512/512 images on CIFAR-10 and CIFAR-100, 61–64/64 on MINI-ImageNet and CelebA, under both FedAvg and FedSGD, while evading D-SNR, noise perturbation, gradient pruning, and gradient clipping, and that it can operate under secure aggregation when combined with communication acceleration. The evaluation compares against Transpose, RtF, LOKI, SEER, and Inverting across four datasets.","tokens_in":27613,"tokens_out":4314,"duration_ms":41153,"significance":"If the claims are substantiated, the paper would make a meaningful contribution to the active-attack literature: it demonstrates a way to scale data theft to 512 images per round and to high-resolution inputs, and it does so without inserting a conspicuous malicious module into the model architecture, which is the main novelty relative to RtF and LOKI. The parameter-sharing secret model and the Fibonacci index are conceptually interesting and the defense-evasion results, if properly measured, would be valuable for the community. The paper also deserves credit for evaluating both FedAvg and FedSGD and for explicitly attempting to address secure aggregation. However, the current manuscript does not provide enough evidence for the central 'undetected' claim (no main-task accuracy is reported), the secret model architecture is underspecified, the Transpose baseline is conceded to be under-trained, and the defense evaluation omits the actual detection metrics. These issues leave the headline claims conditional rather than established.","major_comments":[{"comment":"The stealth claim is unverified because no main-task accuracy is reported anywhere. The attack alternately trains the classification task and the memory task on the same parameters (Eq. 2, Fig. 1), so the memory task can degrade the victim model's utility. Without showing that classification accuracy after the attack stays within the normal range of training fluctuation, a client can detect the attack by simply validating the model, breaking the 'without being detected' claim in the Abstract and Section 7. Please report the victim model's training/test accuracy before, during, and after the attack rounds, for all datasets and for the largest N used.","section":"Sec. 3.3, Fig. 1; Abstract"},{"comment":"The secret model M' is never fully specified. Eq. (3) defines which parameters are selected (every second parameter), but the paper does not state the number of layers, the input and output dimensions, the activation function, or how the sampled parameters are arranged into a fully-connected network. Without this information the reported 512/512 leakage cannot be reproduced or audited. In addition, the Fibonacci sequence in Eq. (7) sums to 142, which bounds the index space at 142 distinct codes, yet experiments use N up to 512 (Tables 2 and 10). The extension of the encoding beyond 142 is not explained.","section":"Sec. 3.3, Eq. (3); Sec. 3.4, Eq. (7)"},{"comment":"The comparison with the Transpose baseline is compromised. The text states: 'For Transpose, due to the limited number of training epochs, the transpose fails to converge, resulting in poor performance.' This admits that the baseline was not given enough training to converge, so the very low leakage and quality values for Transpose in Tables 2 and 10 do not reflect the method's capability. Please either run Transpose to convergence (and report the number of epochs needed) or remove the comparison and soften the claim of superiority over all five baselines.","section":"Sec. 4.2, Fig. 3"},{"comment":"The defense-evasion evaluation does not report the actual detection outputs. For D-SNR (Sec. 5.1), Table 6 lists leakage and image-quality metrics under a column labeled 'D-SNR Detection', but it does not give the D-SNR values of the submitted gradients, the detection threshold used, or the number of rounds in which D-SNR would have flagged the update. Similarly, Section 5.5 shows a qualitative loss plot (Fig. 4) without a quantitative anomaly-detection threshold. Showing that the attack still leaks after a defense is applied is not the same as showing that the defense is evaded; please report the defense's detection metric and threshold.","section":"Sec. 5.1, Table 6; Sec. 5.5"},{"comment":"The headline leakage result is partly built into the training objective. Eq. (1) directly minimizes the distance between M'(I) and the private sample xi, so a leakage of 512/512 with near-perfect SSIM is an expected outcome of solving this optimization, not an empirical discovery. The paper should explicitly separate this by-construction component from the non-trivial contributions (parameter-sharing stealth, defense evasion, high-resolution block partitioning) and should not present the raw leakage counts as evidence of superiority over methods that solve a harder inverse problem. The comparison against LOKI and RtF is more meaningful, and the paper should frame its contribution accordingly.","section":"Sec. 3.3, Eq. (1)-(2); Sec. 4.2"}],"minor_comments":[{"comment":"There are repeated typos in 'FedA VG' and 'FedSGD' (e.g., in the Abstract and Section 1).","section":"Abstract; Sec. 1"},{"comment":"The indexing notation in the variation loss, e.g., Ii,j,s-1:-1:s,: and Ii,j,:,s-1:-1:s, is not defined and is hard to parse; please clarify the slice notation.","section":"Eq. (11)"},{"comment":"The pseudocode mentions mem_net.fill_model(model) and mem_net.fill_back_paramter(), but the latter function is never described; it is unclear how parameters are copied back after the memory step.","section":"Fig. 1"},{"comment":"The PSNR value 5.810 ± 0.888 for LOKI at N=512 looks anomalous and inconsistent with the other LOKI rows; please verify the reported number and its units.","section":"Table 2, CIFAR-100 row for LOKI at N=512"},{"comment":"Reference [14] is cited as 'MINI-ImageNet' but the entry points to fast.ai's Imagenette; this is likely the wrong source. Please provide the correct reference for MINI-ImageNet.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper tackles a relevant problem and the core idea—embedding a secret memory model through parameter sharing—is worth pursuing. However, the absence of any main-task accuracy measurement is a serious gap for a paper whose central claim is stealth; this is not a cosmetic issue and should be addressed before the work can be considered for publication. I would also ask the authors to provide the exact architecture of M' and the encoding extension beyond 142, and to re-run the Transpose baseline fairly. If these can be fixed with additional experiments and clarifications, the paper could become a solid contribution to the security/privacy literature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper proposes a plausible FL data-theft attack that combines parameter-sharing for a hidden memory model with Fibonacci-coded indices and block partitioning for high-res images. The experimental numbers are striking: near-perfect extraction of 512 images on CIFAR, 64 on ImageNet/CelebA, and robustness to five defenses. I think the attack mechanics are real and the engineering is solid. But the central \"undetected\" claim is not actually demonstrated. No main-task accuracy is reported anywhere. The memory task is trained alternately with classification on the same parameters, and Figure 1 shows both optimizers stepping on the same model. If that alternating training degrades the victim model's accuracy by more than a small amount, the client would notice during validation, and the whole stealth premise collapses. The paper's own loss-change monitor (Fig. 4) is about the training loss, not validation accuracy. That is the single biggest soft spot.\n\nSecond, the comparison against Transpose is compromised. In the Figure 3 caption they admit Transpose was given too few epochs to converge. That is an unfair baseline and should be rerun or dropped. Third, the secret model architecture (M') is under-specified: we are told it is 'selected parameters' with the server reconstructing it via r=1, k=2 systematic sampling, but the actual layer widths, activations, and how the index maps to the parameter vector are never given. Without that, the 512/512 results can't be reproduced. The code is not released yet, so this is a real limitation, not a formality. Fourth, the secure-aggregation bypass in Section 6.1 is hand-wavy and has no experiments. They claim combining with communication acceleration can expose target gradients, but that is two paragraphs of intuition, not a result.\n\nWhat the paper does well: the threat model is honest (no Sybil devices, no user sampling control, no unusual structure), the encoding analysis is thoughtful (sparsity, differentiation, label-agnostic), and the defense robustness evaluation covers five distinct mitigations with parameter sweeps. The ablation on label information is interesting and non-obvious. The overall finding—that a malicious server with code execution can train a hidden memory task inside a normal-looking model—is a useful warning, though the Transpose attack and SEER already established the general class.\n\nThe verdict should be conditional: the attack is plausible and possibly quite strong, but the stealth claim needs to be supported with main-task accuracy. That is a fixable issue. I would send this to peer review—the work is important enough and the core mechanism is novel enough to deserve referee time. I would not cite it yet in its current form; I'd wait for the revision that reports validation accuracy and releases code.","headline":"A genuinely new attack variant with a serious evidence gap: the stealth claim rests on main-task accuracy that is never reported.","tokens_in":28197,"tokens_out":1866,"would_cite":false,"duration_ms":17807,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A federated-learning server can steal nearly all of a client's private images by training a hidden memory model inside the shared weights.","keywords":["federated learning","data reconstruction attack","malicious code injection","parameter sharing","Fibonacci coding","privacy breach","secure aggregation","gradient inversion defense"],"falsifier":"Run the paper's CIFAR-10 protocol exactly as described, measuring the victim model's held-out test accuracy across all rounds; if the accuracy trajectory is statistically distinguishable from clean training, the attack's stealth claim fails even though image recovery may still work.","tokens_in":27282,"feed_emoji":"🕵️","tokens_out":8298,"duration_ms":70644,"temperature":0.7,"pith_summary":"The paper argues that a malicious federated-learning server can steal a client's private training images at scale without changing the model's architecture or making handcrafted parameter modifications. The attack works by injecting a few lines of code into the client's training loop, which trains a hidden memory network whose parameters are a subset of the shared model's parameters, so the model looks normal to an outside observer. With a Fibonacci-based index encoding and a block-partitioning scheme, the hidden network memorizes images and the server later reconstructs them from the received updates. In experiments on CIFAR-10, CIFAR-100, MINI-ImageNet, and CelebA, the paper reports nearly perfect extraction (512/512 on CIFAR-10 and CIFAR-100, 64/64 on the high-resolution sets) and says the attack evades five defenses: D-SNR detection, noise perturbation, gradient pruning, gradient clipping, and loss monitoring. If true, this undermines the default privacy promise of federated learning and shifts the burden onto code integrity and client-side verification.","feed_headline":"Hidden weights let a server steal 512 images per attack","feed_subtitle":"The hidden memory model shares parameters with the victim's network and evades five detection methods.","key_machinery":"The load-bearing object is the shared-parameter secret model $M' = \\{p_i \\mid i \\equiv r \\pmod{k}\\}$ with $r=1$, $k=2$: every other parameter of the local model is reinterpreted, layer by layer, as a fully connected memory network. The supporting mechanism is a Fibonacci-coding indexer (based on Zeckendorf representation, sequence starting $[1,2,3,5,8,\\ldots]$) that produces sparse, well-separated, label-independent input codes, so the hidden network can memorize and later retrieve many images without confusion. Block partitioning extends the scheme to high-resolution images by splitting each image into blocks, indexing blocks with appended Fibonacci codes, and using a total-variation loss $L_{\\mathrm{var}}$ to keep block boundaries smooth. Together these pieces let the server train the memory task in parallel with the classification task, then read out the memorized data after aggregation.","core_discovery":"On the paper's own terms, the central claim is that data reconstruction in federated learning can be turned into a covert memorization problem rather than a gradient-inversion problem. The server injects malicious code that trains a secret model $M'$ sharing parameters with the victim's local model; the secret model maps a sparse index code $I$ to a training image $x_i$, minimizing $L_{\\mathrm{dist}}(M'(I), x_i) = L_1 + L_2 + L_{\\mathrm{var}}$. Parameters are chosen by systematic sampling with offset $r=1$ and interval $k=2$, so the server reconstructs $M'$ from every other parameter of the received model. A Fibonacci-code indexer assigns each sample a sparse, label-independent binary code, and a block-partitioning scheme splits high-resolution images into smaller blocks to fit the hidden network's capacity. The paper reports that this recovers 512 of 512 images on CIFAR-10 and CIFAR-100 and up to 64 of 64 on MINI-ImageNet and CelebA, under both FedAvg and FedSGD, while not being flagged by D-SNR, noise perturbation, gradient pruning, gradient clipping, or a loss-change monitor.","pith_inferences":["Editorial extension: The paper never reports the victim model's main-task accuracy after the memory task runs, so the attack's stealth claim hinges on an unmeasured premise: the hidden training must not visibly degrade classification performance.","Editorial extension: A defender could look for the hidden parameter-subset network by testing whether every other parameter (fixed offset $r=1$, interval $k=2$) carries an unusual correlation with reconstruction quality; if such a signature exists, detection could be cheap.","Editorial extension: The same parameter-sharing and index-memorization scheme could be adapted to language data, as the paper sketches, meaning the privacy risk may extend beyond image datasets to token sequences or prompts."],"forward_implications":["A malicious server can exfiltrate the full local dataset of a victim client (512/512 on CIFAR-10 and CIFAR-100) in a single FedAvg round, without adding unusual layers or corrupting weights in a detectable way.","Five state-of-the-art defenses—D-SNR, noise perturbation, gradient pruning, gradient clipping, and loss monitoring—do not stop the attack, because the hidden-memory gradients are low-magnitude and spread across rounds.","The attack transfers to FedSGD and to high-resolution 224x224 datasets (ImageNet, CelebA) via block partitioning, where gradient-inversion baselines fail.","Secure aggregation alone is not a reliable defense: the paper argues that communication-acceleration inconsistencies between clients can be exploited to expose a target user's update, so systems using such strategies remain vulnerable.","Developers need new defenses, such as verifying training-code integrity and checking for hidden reuse of parameters, rather than relying on gradient statistics."],"supporting_citations":[{"why":"It supplies the Transpose attack baseline and the earlier Gray/one-hot spatial index whose label-dependence the paper's Fibonacci encoding is designed to fix.","marker":"[2]"},{"why":"It provides Fibonacci coding, the universal sparse code on which the distinctive index design is built.","marker":"[4]"},{"why":"It establishes that injected malicious code can run during training without disrupting the primary objective, underpinning the attack's feasibility.","marker":"[5]"},{"why":"It describes secure aggregation, the standard defense the paper claims can be bypassed through communication-acceleration inconsistencies.","marker":"[8]"},{"why":"It is the Robbing the Fed baseline, a structure-manipulation attack that directly copies user data and is compared on leakage and quality.","marker":"[15]"},{"why":"It presents both SEER, the stealthy baseline attack, and D-SNR, the detection metric the paper claims to evade.","marker":"[17]"},{"why":"It provides the Inverting gradients baseline for FedSGD reconstruction comparisons.","marker":"[18]"},{"why":"It states Zeckendorf's theorem, which guarantees each natural index has a unique representation as a sum of non-consecutive Fibonacci numbers and thus underpins the indexer's uniqueness.","marker":"[53]"},{"why":"It is the LOKI baseline, the strongest large-scale model-manipulation attack the paper outperforms at 512-image scale.","marker":"[58]"}],"fun_headline_variants":["Covert model steals all images from federated learning","Hidden model recovers every image, evades five detectors","Federated learning attack: 100% recovery, zero detection","Server-side code injection lifts entire training set","New FL attack: hidden memory exfiltrates high-res data"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"For the attack to be truly undetectable, the malicious code must run inside the client's training loop and the side job of memorizing images must not noticeably hurt the model's normal performance, which the paper never directly measures.","fun_headline_variants_meta":{"raw":{"variants":["Covert model steals all images from federated learning","Hidden model recovers every image, evades five detectors","Federated learning attack: 100% recovery, zero detection","Server-side code injection lifts entire training set","New FL attack: hidden memory exfiltrates high-res data"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000169,"raw_usage":{"total_tokens":1316,"prompt_tokens":1046,"completion_tokens":270,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":662,"completion_tokens_details":{"reasoning_tokens":189}},"tokens_in":662,"tokens_out":270,"duration_ms":3312,"temperature":1.0,"reasoning_tokens":189,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:22:04.241789+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the paper's CIFAR-10 protocol exactly as described, measuring the victim model's held-out test accuracy across all rounds; if the accuracy trajectory is statistically distinguishable from clean training, the attack's stealth claim fails even though image recovery may still work.","supporting_citations":[{"cited_title":"Robust transmission of un- bounded strings using fibonacci representations","cited_arxiv_id":null,"evidence_quote":"It provides Fibonacci coding, the universal sparse code on which the distinctive index design is built."},{"cited_title":"Blind backdoors in deep learning models","cited_arxiv_id":null,"evidence_quote":"It establishes that injected malicious code can run during training without disrupting the primary objective, underpinning the attack's feasibility."},{"cited_title":"Practical secure aggregation for privacy-preserving machine learning","cited_arxiv_id":null,"evidence_quote":"It describes secure aggregation, the standard defense the paper claims can be bypassed through communication-acceleration inconsistencies."},{"cited_title":"Inverting gradients-how easy is it to break privacy in feder- ated learning? Advances in Neural Information Processing Systems , 33:16937–16947, 2020","cited_arxiv_id":null,"evidence_quote":"It provides the Inverting gradients baseline for FedSGD reconstruction comparisons."},{"cited_title":"Representations des nombres naturels par une somme de nombres de fibonacci on de nombres de lucas","cited_arxiv_id":null,"evidence_quote":"It states Zeckendorf's theorem, which guarantees each natural index has a unique representation as a sum of non-consecutive Fibonacci numbers and thus underpins the indexer's uniqueness."},{"cited_title":"Loki: Large-scale data reconstruction attack against federated learning through model manipulation","cited_arxiv_id":null,"evidence_quote":"It is the LOKI baseline, the strongest large-scale model-manipulation attack the paper outperforms at 512-image scale."}],"review_version":1}