{"id":"d7acd95a-2bdc-450e-b9f0-ce5104cedac1","arxiv_id":"2505.10264","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"A malicious federated learning server can sweep bias hyperplanes across training rounds and perfectly reconstruct every sample in a client's full batch, for images and tabular data.","lead":"This paper presents an attack where a malicious server in federated learning crafts model parameters to force a client to reveal its private training data. The authors report perfect reconstruction of batches with thousands of image or tabular samples, far beyond what prior attacks achieved.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1 as written forces uniform softmax and zero gradients: with identical W^(2) columns (and any b^(2)), the cross-entropy derivative w.r.t. the first layer is exactly zero, so Eqs. (5)-(8) have no input and the perfect-recovery claim is unsupported as stated.","rationale":"The reader's verdict is REJECT, and I concur, but the most load-bearing concern is not the one listed as the reader's weakest assumption. The reader's weakest assumption is Assumption 4.1, i.e., that ∂L_j/∂b^(1)_i is constant across tested bias values. That is a serious approximation concern, but it presupposes the attack has a nonzero gradient signal to work with. Algorithm 1 destroys that signal: by forcing all columns of W^(2) to be identical and all b^(2) entries equal, the network's logits become class-independent, the softmax is exactly uniform, and the cross-entropy gradient with respect to every first-layer parameter is exactly zero. Equations (5), (6), and (8) then have no well-defined input, so the central claim of perfect reconstruction fails before Assumption 4.1 is even reached. The paper's App. E configuration appears to use W^(2) columns drawn from a distribution rather than identical columns, which would avoid the exact cancellation, but the main method section, Algorithm 1, and the claimed equivalence are not what is evaluated. This is an internal inconsistency, not a disagreement with external consensus. My concrete_test is deliberately minimal: reproduce Algorithm 1 as written and check whether any gradient survives. If the authors clarify that the real attack uses independent W^(2) columns, then the paper needs a corrected algorithm and a re-examination of Assumption 4.1's quantitative validity, including the error accumulation in Eq. (8). Until then, the central claim is unsupported by the paper's own formulation, so the REJECT verdict stands unchanged.","tokens_in":23097,"tokens_out":4943,"duration_ms":50471,"concrete_test":"Implement Algorithm 1 exactly: sample one vector w for all rows of W^(1), one vector v for all columns of W^(2), set all b^(2) entries equal, and choose arbitrary b^(1) values. Run a forward and backward pass on any nontrivial batch with C=2 or C=10 classes. The concern is confirmed if every entry of ∂L/∂W^(1) and ∂L/∂b^(1) is exactly zero (or machine zero), making g_k undefined in Eq. (5). An independent analytic check: with identical columns, z^(2)_k = c(x)+b^(2)_k, so softmax p_k is independent of z^(1); hence ∂L/∂b^(1)_i = v_i(-1+Σ_k p_k)=0. If the authors respond that their code instead samples W^(2) columns independently, the required follow-up is to revise Algorithm 1 and Sec. 4.3 to state that configuration and verify that the reconstructed gradients are nonzero and that Eq. (8) remains well-defined under the reported settings.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing flaw is in Algorithm 1 itself. Line 3 sets every column of W^(2) to the same vector v, and line 4 sets every entry of b^(2) to the same large value. Under this configuration, for any input x, z^(2)_k = v^T ReLU(W^(1)x+b^(1)) + const for every class k, so all output logits are equal, the softmax is exactly uniform, and the cross-entropy loss is constant (= log|C|) regardless of x and its label. Consequently ∂L/∂b^(1)_i = -v_i + Σ_k v_i·(1/|C|) = 0, and similarly all first-layer gradients vanish. Even if b^(2) entries are not equal, identical W^(2) columns still give z^(2)_k = v^T z^(1) + b^(2)_k, so the softmax probabilities are independent of z^(1); then ∂L/∂b^(1)_i = v_i(-1 + Σ_k p_k) = 0. The server therefore observes g_k = 0, Eq. (5) is undefined, and no input can be isolated or reconstructed. This is not a numerical-precision issue; it is an exact algebraic cancellation forced by the symmetry in Sec. 4.3 and Algorithm 1. The experiments in App. E appear to use a different configuration (W^(2) columns sampled rather than forced identical), but the main method section and Algorithm 1 are what define the paper's central claim, and that claim is internally inconsistent. The Assumption 4.1 approximation is an additional concern, but the zero-gradient break is more fundamental: even a perfect approximation would leave the server with no signal under the algorithm as written.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a malicious-server data reconstruction attack for federated learning. The server crafts a two-layer fully connected network in which all rows of the first-layer weight matrix are identical (a single random hyperplane direction w), all columns of the second-layer weight matrix are identical (a vector v), and the second-layer biases are set to a common large value. By translating the first-layer hyperplane through a sequence of bias values over communication rounds, the server attempts to isolate individual samples of a client's full batch inside thin strips and then reconstruct each sample from aggregate gradient information using equations (5)-(8). The paper claims perfect recovery of arbitrarily large batches (up to 4096 samples in experiments) on image and tabular datasets, and also provides a theoretical upper bound on the success of sparsity-based attacks (Theorem 3.1).","tokens_in":23486,"tokens_out":14040,"duration_ms":136055,"significance":"If the attack worked as stated, it would be a substantial advance over existing reconstruction attacks: it removes the batch-size bottleneck, works on low-dimensional tabular data without auxiliary data or distributional assumptions, and gives a clean geometric interpretation. The paper ships code, reports extensive experiments on ImageNet, HARUS, and CIFAR-10, and provides a novel analytical bound for sparsity-based attacks. The significance is, however, contingent on the correctness of the gradient-constancy assumption (Assumption 4.1) and on the claimed perfect-recovery guarantee being supported by the theoretical derivations.","major_comments":[{"comment":"The justification of Assumption 4.1 is mathematically incorrect. When all entries of b^(2) are equal (as set in Algorithm 1, line 4), the softmax probabilities are p_k = exp(v_k s) / sum_c exp(v_c s), where s = sum_i z^(1)_i. This expression is exactly invariant to the magnitude of b^(2), because adding a constant to all logits cancels in the softmax. Therefore the claim that setting large second-layer biases makes p_k approximately 1/|C| is false. Consequently, the derivative in Eq. (9) generally depends on the input x and on b^(1)_i through s, so Assumption 4.1 is not established. Without Assumption 4.1, the isolation criterion g_k = g_{k+1} and the reconstruction formulas (7) and (8) lack a valid basis.","section":"Sec. 4.3, Eq. (10)"},{"comment":"I examined the zero-gradient concern raised during review and it does not land as stated. Setting each column of W^(2) to the same vector v does not make all logits equal unless all entries of v are equal; with general v, z^(2)_k = v_k s + b^(2)_k and the derivative in Eq. (9) is -v_{y_j} + sum_k v_k p_k, which is generically nonzero. The true tension is different: making the softmax exactly uniform forces v to be constant, which indeed makes all first-layer gradients vanish. The paper's proposed escape, namely a large common b^(2), is the same error as in Eq. (10). Thus the paper has not shown that nonzero gradients and exact constancy of the per-sample coefficients alpha_j can be achieved simultaneously, which is a load-bearing gap.","section":"Alg. 1 line 3 + Sec. 4.3"},{"comment":"The isolation test uses the exact condition g_i != g_{i-1}. No numerical tolerance is defined in the main algorithm, and no error propagation analysis is provided. Any residual violation of Assumption 4.1, or rounding in the aggregate gradients, will make the equality test unreliable. The local-steps experiments in App. F introduce an ad-hoc projection threshold of 10^-4, but the main attack is claimed to work without such a threshold. The paper should either provide a tolerance with a correctness bound or present a robust test with a defensible threshold.","section":"Alg. 2, line 4"},{"comment":"The theoretical round-complexity bound and the threshold epsilon are not connected to the experimental procedure. Eq. (27) sets epsilon proportional to Delta, the minimum pairwise distance of the unknown client inputs, which the attacker cannot know. Moreover, App. E states explicitly that no value of epsilon was used in the experiments; instead, the attack consumes all T available rounds. This means the claimed O(log n / N) round bound is not validated by the experiments, and the perfect-recovery guarantee lacks an implementable configuration rule for epsilon in practice.","section":"App. D and App. E"}],"minor_comments":[{"comment":"For v ~ N(0, I_d), the variance of the inner product <x_i - x_j, v> is ||x_i - x_j||^2, not ||x_i - x_j||. The subsequent probability calculation should use the corrected standard deviation.","section":"App. D, Eq. (20)"},{"comment":"The phrase 'two orders of magnitude larger than the state of the art' overstates the reported results: the baselines fail around batch size 64, while the proposed attack is demonstrated up to 4096, which is a factor of 64, not 100.","section":"Abstract"},{"comment":"The notation w^(2)_{y_j,i} is ambiguous because W^(2) is defined as having identical columns; please make explicit that w^(2)_{k,i} = v_k for all i.","section":"Sec. 4.3, after Eq. (9)"},{"comment":"The Gaussian case bound O(log^{(d-1)/2} n) is stated without a derivation or a precise citation; the cited reference (Raynaud 1970) is standard for the uniform-ball case. Please either add a formal argument or adjust the statement to match the source.","section":"Sec. 3, Theorem 3.1"},{"comment":"The paper calls the outcome 'perfect reconstruction' while the evaluation uses threshold-based criteria (SSIM >= 0.99 for images, L2 norm < 0.1 for tabular). Clarify whether the theoretical guarantee is meant to be exact recovery or recovery to within these tolerances, and state how the experimental thresholds relate to the theoretical claims.","section":"Sec. 5"}],"recommendation":"major_revision","confidential_remarks":"The main review concern that triggered the negative reader report (zero client gradients under Algorithm 1) appears to rest on a misreading of W^(2) as having identical rows rather than identical columns; the zero-gradient argument does not hold for a general vector v. However, the paper has a different, genuinely load-bearing flaw in the derivation of Assumption 4.1 (Eq. (10)), and the experimental configuration in App. E deliberately bypasses the threshold epsilon. The approach may be salvageable, for instance by substituting a saturated-softmax construction (one dominant class) for the claimed uniform-softmax construction, but the current manuscript does not provide that fix. Given the central role of the flawed derivation, I would request a thorough revision that either supplies a correct mechanism for satisfying Assumption 4.1 or substantially rewrites the theoretical claims. I have no concerns about authorship novelty beyond what is stated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know about arXiv:2505.10264. The hyperplane-sweep attack is a genuinely new idea, and the experiments are ambitious. But the algorithm as printed cannot work. Algorithm 1 sets every column of W^(2) to the same vector v and every entry of b^(2) to the same large constant. Under that configuration, all output logits are equal for any input, the softmax is uniform, and the cross-entropy loss is constant. Every first-layer gradient is exactly zero, so Eqs. (5)–(8) have no input and the reconstruction is undefined. This is not numerical noise; it is an exact cancellation. The experiments in Appendix E use W^(2) columns drawn independently from N(0, 10^-2), not identical columns, and that configuration does not collapse. The paper never acknowledges the mismatch, and its central claim is therefore not supported by the method section as written.\n\nWhat I liked: the convex hull upper bound (Theorem 3.1) is a clean, useful result that explains why sparsity-based attacks degrade with batch size and dimension. The sequential reconstruction from gradient-difference coefficients is clever, and the empirical performance on tabular data with batches of 4096 is striking if it holds. The authors ship code and state Assumption 4.1 plainly, which is credit where due.\n\nThe soft spots: the zero-gradient collapse is load-bearing. Beyond that, Assumption 4.1 is only approximate via a near-uniform softmax; the equality test g_k = g_{k+1} needs a tolerance under floating-point error and none is given. The round bound in App. D depends on the minimum pairwise distance Delta of the unknown data, which the attacker does not know; the experiments sidestep this by just using as many bias values as the round budget allows. The claims about no prior knowledge and a non-adaptive threshold are overstated. The fix is straightforward: use non-identical W^(2) columns, as in the experiments, and re-derive the parallel-search condition. But as published, the main algorithm and the evidence are in different configurations.\n\nWho this is for: FL security and privacy researchers, especially those working on malicious-server models. Should it be peer reviewed? Yes, in the sense that a serious referee should look at it, because the idea is novel and the experiments, if reproducible, matter. But my recommendation is to reject the current version: the central method section contradicts itself, and the authors need to rewrite Algorithm 1 and resubmit. I would not cite the attack as valid in its current form.","headline":"Novel hyperplane-sweep attack idea, but Algorithm 1 as written forces zero gradients, so the central claim is unsupported by the paper's own method section.","tokens_in":24040,"tokens_out":6275,"would_cite":false,"duration_ms":58969,"reading_group":"yes","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A malicious server in federated learning can craft model parameters so that, after enough FedSGD rounds, every sample in a client's batch is recovered exactly, without any prior knowledge of the data.","keywords":["federated learning","data reconstruction attack","gradient inversion","malicious server","hyperplane separation","FedSGD","tabular data","privacy leakage"],"falsifier":"Measure the per-sample derivative $\\partial L_j/\\partial b_i^{(1)}$ directly as $b_i^{(1)}$ is translated but the neuron stays active, with the second-layer biases set to the paper's finite value (1025); if the derivative varies by more than the amount that makes $g_k$ and $g_{k+1}$ indistinguishable under the client's floating-point arithmetic, then the isolation test has no margin and the claimed exact recovery of arbitrary batches is false. A simpler variant: add tiny numerical noise to the client's gradient updates and check whether the equality $g_k=g_{k+1}$ still detects 'no input in strip' correctly at the largest reported batch sizes.","tokens_in":22872,"feed_emoji":"🔓","tokens_out":8448,"duration_ms":78442,"temperature":0.7,"pith_summary":"Federated learning promises that raw client data never leaves the device, but this paper argues the promise can be broken completely: a malicious server can modify model parameters so that, after a number of federated SGD rounds, it recovers every single training sample in a client's batch. The method works for classification tasks on any input dimensionality, including tabular data, and its experiments report exact recovery of batches up to 4,096 points, roughly two orders of magnitude larger than previous attacks manage. The reason it scales is geometric: the server sweeps a hyperplane through the input space by changing a neuron's bias and uses the equality of aggregate gradients to tell exactly when a strip between two hyperplanes contains one input, then strips the batch apart one point at a time. If the central claim holds, any full-batch FedSGD client that trusts the server's parameters is exposed, and secure aggregation alone does not fix the problem because the server still sees aggregate gradients.","feed_headline":"Hyperplanes strip federated-learning batches down to every sample","feed_subtitle":"A crafted bias sweep recovers thousands of images or tabular rows exactly, with no assumptions about the data.","key_machinery":"The load-bearing object is the strip-isolation identity from the per-sample gradient formula: for a fully connected ReLU layer, $\\partial L_j/\\partial W_i = (\\partial L_j/\\partial b_i)\\,x_j$, so an input can be reconstructed as $x_j = (\\partial L_j/\\partial W_i)(\\partial L_j/\\partial b_i)^{-1}$ whenever exactly one sample activates neuron $i$. With a batch, the server instead sees a weighted mixture $g_i=\\sum_j \\alpha_j x_j$, where $\\alpha_j = (\\partial L_j/\\partial b_i)/(\\sum_k \\partial L_k/\\partial b_i)$. The attack converts this mixture into exact recovery by (i) making $\\alpha_j$ independent of the neuron's bias through the near-uniform softmax, (ii) sweeping biases to move a hyperplane and detecting whether any input lies in the strip between two positions by checking whether $g_k$ changes, and (iii) peeling off inputs one by one with Eq. (8), which computes the next unknown input as the leftover of the aggregate gradient after the previously recovered inputs are subtracted. Once the first sample is isolated and reconstructed, each additional sample is a residual computation rather than a fresh search.","core_discovery":"The central claim is that a malicious server can control each data point's contribution to the client's aggregate gradient and use that control to cut a batch into single points. The server sets all rows of the first-layer weight matrix to the same random direction $w$ and chooses a sequence of bias values, which translates one hyperplane $w^\\mathsf{T}x+b=0$ through input space. Whenever no input lies between two consecutive hyperplanes, the observed gradient combination $g_k=\\sum_j \\alpha_{j,k}x_j$ (Eq. 5) is unchanged; whenever an input lies in between, $g_k$ changes. The server binary-searches the bias axis until strips are narrow enough to contain exactly one input, then reconstructs inputs sequentially: Eq. (7) recovers each newly activated sample's derivative from the change in the aggregate bias gradient, and Eq. (8) subtracts the already-recovered inputs' known contributions from $g_{k+1}$. Assumption 4.1 --- that each per-sample derivative $\\partial L_j/\\partial b_i^{(1)}$ is constant while the neuron is active --- is engineered by setting second-layer biases large enough that the softmax is nearly uniform, making the derivative independent of the first-layer bias; identical columns in the second-layer weight matrix make the coefficients uniform across neurons, allowing all $N$ neurons to be searched in parallel.","pith_inferences":["Editorial inference: the same machinery applies to any linear layer whose activation mask can be controlled, so a full-batch attack on the first fully connected layer of a CNN is plausible; the paper shows approximate recovery through feature maps for a CNN, not exact end-to-end recovery.","Editorial inference: the equality test $g_k=g_{k+1}$ has no stated tolerance, so real-world robustness depends on floating-point precision and the absence of any noise in updates; the paper's single-precision experiments fail to fully recover the largest batches, which suggests numerical error is a genuine ceiling.","Editorial inference: a defender could look for the fingerprints of this attack --- all first-layer rows identical, all second-layer columns identical, and unusually large second-layer biases --- and reject such models, although the paper does not discuss client-side verification.","Editorial inference: the round-complexity analysis depends on the minimum pairwise distance $\\Delta$ among the unknown inputs, so batches containing near-duplicates or inputs with nearly identical projections along the swept direction will require many more rounds or a much smaller threshold, a testable limitation not covered by the reported experiments."],"forward_implications":["A full-batch FedSGD client in a classification task has no protection against a malicious server: every sample in a batch of thousands can be reconstructed exactly once enough rounds have been run.","Reconstruction requires no prior knowledge of the data distribution and no auxiliary dataset; the only client-side information assumed is a bound on the range of preprocessed features.","Sparsity-based attacks cannot be patched by scaling up the network: on random inputs the expected number of samples any isolation-based attack can recover grows only as $O(n^{(d-1)/(d+1)})$ (ball), $O(\\log^{d-1} n)$ (hypercube), or $O(\\log^{(d-1)/2} n)$ (normal), so the success fraction tends to zero as batch size grows.","Secure aggregation is not a sufficient defense: the server still receives the aggregate gradient over the union of clients' datasets, so with enough rounds it can recover the underlying data, though without assigning points to specific clients.","Local differential privacy is the only defense the paper identifies; adding client-side noise reduces but does not eliminate reconstruction, and the attack still beats the baseline under the tested noise levels."],"supporting_citations":[{"why":"Provides the trap-weights baseline attack and the comparison setting used in all experiments.","marker":"[Boenisch et al., 2023]"},{"why":"Supplies Theorem 1, the gradient combination identity $g_i=\\sum_j \\alpha_j x_j$ that the paper starts from.","marker":"[Zhang et al., 2023]"},{"why":"Establishes the malicious-server analytical isolation approach that the parallel first round of this attack resembles and extends.","marker":"[Fowl et al., 2022]"},{"why":"The state-of-the-art exact batch-inversion baseline whose small-batch limitation motivates the new method.","marker":"[Dimitrov et al., 2024]"},{"why":"Provides the convex-hull vertex bounds used to prove Theorem 3.1 for uniform-ball and Gaussian input distributions.","marker":"[Raynaud, 1970]"},{"why":"Provides the expected-maxima bound used in Theorem 3.1 for uniform-hypercube inputs.","marker":"[Bentley et al., 1978]"},{"why":"Differential privacy is the only defense the paper identifies as sufficient, via client-side noise on updates.","marker":"[Dwork, 2006]"},{"why":"The malicious fishing strategy that controls per-input gradient contributions but requires a distributional assumption the new method avoids.","marker":"[Wen et al., 2022]"}],"fun_headline_variants":["Hyperplanes cut federated-learning batches down to every sample","Zero-assumption attack recovers every sample from huge batches","Perfect batch reconstruction without any data assumptions","Hyperplane search recovers thousands of samples at once","Federated learning secrets exposed: perfect batch recovery"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's perfect-recovery guarantee rests on Assumption 4.1: that each sample's derivative $\\partial L_j/\\partial b_i^{(1)}$ stays exactly constant for every bias value while that sample keeps the neuron active, and that the resulting equality $g_k=g_{k+1}$ holds with no tolerance; if that derivative drifts or numerical noise breaks the equality, the sequential reconstruction of Eq. (8) accumulates error and perfect recovery no longer follows.","fun_headline_variants_meta":{"raw":{"variants":["Hyperplanes cut federated-learning batches down to every sample","Zero-assumption attack recovers every sample from huge batches","Perfect batch reconstruction without any data assumptions","Hyperplane search recovers thousands of samples at once","Federated learning secrets exposed: perfect batch recovery"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001033,"raw_usage":{"total_tokens":4372,"prompt_tokens":986,"completion_tokens":3386,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":602,"completion_tokens_details":{"reasoning_tokens":3311}},"tokens_in":602,"tokens_out":3386,"duration_ms":24219,"temperature":1.0,"reasoning_tokens":3311,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:13:45.406151+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the per-sample derivative $\\partial L_j/\\partial b_i^{(1)}$ directly as $b_i^{(1)}$ is translated but the neuron stays active, with the second-layer biases set to the paper's finite value (1025); if the derivative varies by more than the amount that makes $g_k$ and $g_{k+1}$ indistinguishable under the client's floating-point arithmetic, then the isolation test has no margin and the claimed exact recovery of arbitrary batches is false. A simpler variant: add tiny numerical noise to the client's gradient updates and check whether the equality $g_k=g_{k+1}$ still detects 'no input in strip' correctly at the largest reported batch sizes.","supporting_citations":[{"cited_title":"Compromise privacy in large-batch federated learning via model poisoning","cited_arxiv_id":null,"evidence_quote":"Supplies Theorem 1, the gradient combination identity $g_i=\\sum_j \\alpha_j x_j$ that the paper starts from."},{"cited_title":"Fishing for user data in large-batch federated learning via gradient magnification","cited_arxiv_id":null,"evidence_quote":"The malicious fishing strategy that controls per-input gradient contributions but requires a distributional assumption the new method avoids."}],"review_version":1}