{"id":"16dd8556-7295-4171-9ddd-02148403743d","arxiv_id":"2607.07314","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":3,"one_line_summary":"A malicious FL server can steal private training images by encoding them into model parameters via a correlation regularizer and preserving them through segmented aggregation.","lead":"This paper shows that a malicious federated learning server can encode and steal private training images from clients by modifying their local loss functions and selectively preserving the modified parameters during aggregation. It demonstrates a new privacy threat in federated learning where the model itself becomes a storage channel for stolen data.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"The claim of 'semantically meaningful' recovery rests on pixel-wise MAPE and qualitative inspection only; at the paper's default dispersed placement, recovery quality degrades sharply when payload scales beyond 1 image/client.","rationale":"The reader correctly identified the threat-model limitation (secure aggregation bypass) and the small evaluation scale. My concern is more specific: even within the stated threat model, the evaluation does not rigorously validate the 'semantically meaningful' claim because it lacks any semantic metric and the default design choice degrades sharply at larger payloads. However, the paper explicitly frames itself as a proof-of-concept and acknowledges limitations, so the CONDITIONAL verdict remains appropriate. The reader's weakest_assumption about secure aggregation is about external applicability; my concern is about internal evaluation validity. Both are valid but distinct. The paper's core technical construction (CVEA regularizer + segmented aggregation) is sound by construction — Eq. 5 preserves carrier parameters by design, and the Pearson correlation objective (Eq. 2) is a reasonable encoding mechanism. The issue is not that the method is flawed but that the evidence for 'semantically meaningful' recovery is insufficient at the reported scale and metric. The GitHub repository could not be verified, but the methodological description is sufficient for reproduction. No verdict change is needed; the CONDITIONAL assessment already captures the proof-of-concept nature of the work.","tokens_in":11930,"tokens_out":4525,"duration_ms":271069,"concrete_test":"Train a standard classifier (e.g., the same CNN or ResNet18 from Table 1) on original training images and measure top-1 classification accuracy on the recovered images. Run this at both q=1 (main setting, γ=0.5, dispersed placement) and q=50 (ablation setting, dispersed placement) across all three datasets. If classification accuracy on recovered images is near-random (e.g., <15% for 10-class datasets) at either scale, the 'semantically meaningful' claim weakens significantly. Additionally, compute SSIM between original and recovered images as a complementary structural-similarity metric.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that recovered images be 'semantically meaningful.' However, the evaluation relies exclusively on MAPE (Eq. 9, a pixel-wise metric) and qualitative visual examples (Fig. 4), with no quantitative measure of semantic recognizability such as classifier-based evaluation, SSIM, or human study. This is load-bearing because MAPE can be misleading: a MAPE of 0.25 on MNIST (Fig. 3, γ=1.0) represents 25% average pixel error, and without a semantic metric we cannot determine whether the recovered images are actually recognizable. More concretely, the paper's default design choice (dispersed placement) shows poor recovery quality at larger payloads: Table 2 shows that with q=50 images per client and dispersed placement, MAPE is 0.2225 for MNIST and 0.2072 for Fashion-MNIST, compared to 0.0639 and 0.0508 with the simpler contiguous placement. The main experiments (§5.2–5.3) avoid this issue by using only 1 image per target client, where the dispersed-vs-contiguous gap is not examined. The paper argues for dispersed placement based on utility preservation on CIFAR-10, but this comes at a substantial recovery-quality cost on the simpler datasets at scale. The gap between the proof-of-concept scale (1 image/client, 5 targets) and the ablation scale (50 images/client, 10 targets) is large, and the default method performs worse at the larger scale on 2 of 3 datasets. This raises the question of whether the method generalizes beyond the narrow 1-image-per-client setting in which the headline results are reported.","agreement_with_reader":"partial"},"referee_report":{"model":"glm-5.2","summary":"This paper proposes FedCVESA, a white-box Taking Away Training Data (TATD) attack in federated learning. A malicious server selects target clients, injects a Pearson-correlation regularizer into their local loss to encode private training data into designated carrier parameters, and applies segmented aggregation to prevent those parameters from being overwritten by standard federated averaging. The server then extracts and decodes the preserved parameters to recover the stolen images. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions evaluate the accuracy–stealing-quality trade-off across attack strengths, target-client counts, and carrier-parameter placement strategies. The paper is explicitly framed as a proof-of-concept study.","tokens_in":12140,"tokens_out":2176,"duration_ms":147243,"significance":"The paper identifies a genuine gap: TATD attacks have been studied in centralized settings but not under federated aggregation, where multi-client averaging could overwrite encoded data. The combination of correlation-based encoding with segmented aggregation is a reasonable technical contribution to this problem. The authors provide publicly available source code, which strengthens reproducibility. The threat model is clearly stated, and the experimental setup uses standard datasets and non-IID partitions. The work is a reasonable proof-of-concept that FL parameters can serve as a memorization channel under a white-box malicious-server adversary.","major_comments":[{"comment":"§5.1, Eq. (9) and §5.2: The central claim that recovered images are 'semantically meaningful' (abstract, §5.2, §6) is supported only by MAPE and qualitative visual examples (Fig. 4). MAPE is a pixel-wise metric that the paper itself acknowledges is 'sensitive to near-zero pixels' (§5.2). A MAPE of 0.2524 on MNIST at γ=1.0 (Fig. 3) represents substantial pixel-level deviation, and without a semantic metric such as SSIM, PSNR, or a classifier-based recognizability test, the claim of semantic meaningfulness is not adequately substantiated. This is load-bearing because 'semantically meaningful' is the core qualitative claim of the paper. Adding at least one standard structural or perceptual metric, or a simple classifier-based evaluation on recovered images, would address this.","section":null},{"comment":"Table 2 and §5.4: The default dispersed placement strategy performs substantially worse than contiguous placement on MNIST and Fashion-MNIST at larger payloads. At q=50 images/client, dispersed MAPE is 0.2225 (MNIST) and 0.2072 (Fashion-MNIST), compared to 0.0639 and 0.0508 for contiguous placement. The main experiments (§5.2–5.3) use only 1 image/client, where this degradation does not manifest. The paper justifies dispersed placement based on CIFAR-10 utility preservation, but the default method is worse at recovery quality on 2 of 3 datasets at scale. The gap between the proof-of-concept scale (1 image/client) and the ablation scale (50 images/client) is large, and the paper does not discuss whether the main-experiment results would hold at the larger scale with the default placement. This raises a question about whether the central claim generalizes beyond the narrow 1-image-per-1c1c","section":null}],"minor_comments":[{"comment":"§3: The threat model assumes the server has white-box access to raw, unencrypted model updates. The paper does not discuss secure aggregation protocols (e.g., Bonawitz et al. [4], which is cited in §2.1) as a potential mitigation. A brief discussion of how secure aggregation would affect the attack's feasibility would strengthen the threat model analysis.","section":null},{"comment":"§5.1: The experimental setup uses only K=10 clients. While the paper frames this as a controlled proof-of-concept, it would be helpful to state explicitly how the findings might scale to larger client pools, or to acknowledge this as a limitation.","section":null},{"comment":"§4.2, Eq. (3): The dispersed index formula s_r = floor(r(L-1)/(T-1)) is defined for r=0,...,T-1. It would help to clarify whether L refers to the total number of parameters or the length of the flattened parameter vector, and whether edge cases (e.g., T > L) are handled.","section":null},{"comment":"§5.2: The paper notes that MAPE does not decrease monotonically with γ. Given that the best MAPE for MNIST and Fashion-MNIST is at γ=1.0 but for CIFAR-10 is at γ=0.5, a brief discussion of why the optimal γ differs across datasets would improve clarity.","section":null},{"comment":"Fig. 4: The qualitative examples are referenced but the figure caption does not specify which γ or n values are used beyond 'the representative default attack setting.' Stating the exact configuration in the caption would aid reproducibility.","section":null},{"comment":"§4.3, Eq. (7): The min-max normalization maps extracted values to [0,1], but the paper does not discuss how this interacts with the original pixel value distribution. If the original image has a narrow intensity range, the normalization could amplify noise. A brief note on this would be helpful.","section":null}],"recommendation":"major_revision","confidential_remarks":"The paper is a reasonable proof-of-concept and the authors are transparent about the controlled setting. The two major concerns are addressable: adding a semantic metric (SSIM or classifier-based) and discussing the dispersed-vs-contiguous gap at scale would substantially strengthen the paper. The threat model limitation regarding secure aggregation is worth noting but is not load-bearing for the proof-of-concept claim. I would encourage the editor to give the authors a chance to address these issues."},"author_rebuttal":null,"desk_editor":{"model":"glm-5.2","letter":"The core new contribution is segmented aggregation (Eq. 5): the malicious server preserves carrier parameters uploaded by target clients instead of averaging them, which prevents the standard FedAvg overwrite problem. This is a clean idea and the right solution to the specific FL challenge that distinguishes this setting from centralized CVEA. The Pearson correlation regularizer itself is inherited from Song et al., so the novelty is in the aggregation scheme and the dispersed placement strategy. The paper is honest about being a proof-of-concept, and the method description is sufficient for reproduction. Code is referenced at a GitHub URL that I could not verify as active at review time, but the methodology is clear enough to reimplement from the paper alone. Credit for that. The threat model is clearly stated: white-box malicious server with access to raw unencrypted updates. This is a strong adversary assumption, and the paper does not oversell it. The stress-test concern about MAPE and semantic recognizability is partially valid but overstated. The qualitative examples in Fig. 4 do show recognizable digits and garments at the default 1-image-per-client setting, and the CIFAR-10 recoveries at MAPE ~0.05 are plausibly meaningful. The real problem is the gap between the headline experiments (1 image/client, 5 targets) and the ablation (10 images/client, 10 targets). Table 2 is the soft spot: with dispersed placement at q=50, MAPE is 0.22 on MNIST and 0.21 on Fashion-MNIST — roughly 3-4x worse than contiguous placement. The paper argues dispersed placement is the better default because it preserves utility on CIFAR-10, but this comes at a substantial recovery-quality cost on the simpler datasets at scale. So the method works well in the narrow regime where it is headline-tested and degrades meaningfully when payload scales up, at least for 2 of 3 datasets. This is a real limitation but not a fatal one — it is consistent with a proof-of-concept paper that is upfront about its scope. The reader's concern about secure aggregation as a defense is fair but standard for this threat model literature; the paper does not need to defeat all defenses to make its point. This paper is for FL privacy researchers and security people who work on data-leakage attacks. It deserves a serious referee who can push on the payload-scaling question and ask for a semantic metric (SSIM or classifier-based) alongside MAPE. The central idea is sound and worth engaging with. Recommend conditional accept pending the scaling evaluation and a verified code release.","headline":"New active data-extraction attack in FL: adapts CVEA to federated setting with segmented aggregation. Proof-of-concept scale only; recovery quality degrades at larger payloads with the default placement strategy.","tokens_in":12736,"tokens_out":607,"would_cite":false,"duration_ms":118917,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"FL Server Steals Private Training Data Through Parameter Encoding","keywords":["federated learning","privacy leakage","white-box attack","Taking Away Training Data","Correlation Value Encoding Attack","segmented aggregation","parameter-level memorization","malicious server"],"falsifier":"A federated learning deployment using secure aggregation that prevents the server from seeing individual client updates would break the segmented aggregation step, since the server cannot selectively preserve carrier parameters it cannot identify or inspect.","tokens_in":11988,"feed_emoji":"🔓","tokens_out":2522,"duration_ms":73936,"temperature":0.7,"pith_summary":"The paper introduces FedCVESA, an attack in which a malicious federated learning server actively writes private training data from selected target clients into the global model's parameters during training, then extracts and recovers that data after training completes. The attack adapts the centralized Correlation Value Encoding Attack (CVEA) to the federated setting by adding a Pearson-correlation regularizer to the local loss function of target clients. This regularizer causes a designated subset of model parameters—called carrier parameters—to become statistically correlated with the private training data vector, effectively encoding the data into the model's weights. The key technical challenge the paper addresses is that standard federated averaging would overwrite these carrier parameters with updates from non-target clients. To prevent this, the authors propose segmented aggregation: the malicious server preserves carrier parameters uploaded by target clients while applying standard averaging to all remaining parameters. Carrier parameters are also dispersed across the model rather than concentrated in one contiguous block, to avoid disrupting any single layer's function. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under non-IID Dirichlet data partitions show that the method recovers semantically recognizable private training images while maintaining near-baseline classification accuracy, demonstrating that federated learning can function as a parameter-level memorization channel under a white-box malicious-server threat model.","feed_headline":"FL Server Steals Private Training Data Through Parameter Encoding","feed_subtitle":"Correlation regularizer and selective aggregation turn model parameters into a covert storage channel for private client images.","key_machinery":"Pearson-correlation regularizer (CVEA loss term) + segmented aggregation over dispersed carrier parameters + server-side extraction and recovery via min-max normalization","core_discovery":"The central discovery is that federated learning's aggregation step, long viewed as a mixing mechanism that would obscure individual client information, can be selectively bypassed by a malicious server to preserve encoded training data in specific model parameters. By combining a Pearson-correlation encoding objective on target clients with a segmented aggregation rule that protects carrier parameters from being averaged away, the attack creates a coordinated encode-preserve-recover pipeline that operates across the full federated training lifecycle. The dispersed placement of carrier parameters across the model prevents the encoding from concentrating in one layer and degrading main-task性能","pith_inferences":["If secure aggregation becomes standard practice in FL deployments, this attack vector narrows considerably, but the paper does not test against secure aggregation, so the interaction remains an open question.","The attack's reliance on modifying the local loss function means it could potentially be detected by clients that inspect their own training objectives, though this assumes a level of client-side vigilance not standard in current FL deployments.","The non-monotonic relationship between attack strength and recovery quality suggests that optimal attack parameters are dataset- and architecture-dependent, which could make the attack harder to deploy generically but also harder to defend against with fixed detection thresholds.","Extending the attack to non-image data (text, tabular) would require adapting the carrier-parameter budget and encoding scheme, since the current method relies on image-shaped payloads (C x H x W)."],"forward_implications":["Secure aggregation protocols that cryptographically hide individual client updates from the server would directly block this attack, since the server cannot selectively preserve carrier parameters it cannot inspect.","The attack's stealth—maintaining near-baseline classification accuracy—suggests that anomaly detection based solely on model utility degradation may be insufficient to detect parameter-level data theft in FL.","The finding that dispersed carrier placement outperforms contiguous placement on complex data (CIFAR-10) implies that the attack scales with model capacity: larger models offer more candidate carrier positions without functional disruption.","The proof-of-concept setting (one image per client, 10 clients) means the practical risk of large-scale data exfiltration under this method remains uncharacterized."],"fun_headline_variants":["Malicious FL Server Hides Private Data Inside Model Parameters","Federated Aggregation Bypassed to Store Private Client Images","Segmented Aggregation Preserves Stolen Training Data in FL Models","Pearson-Correlation Encoding Enables Data Theft Across FL Training","White-Box FL Attack Stores Private Images in Carrier Parameters"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The attack assumes the malicious server can directly inspect raw, unencrypted model updates from individual clients and selectively preserve specific parameters during aggregation—a condition that fails when secure aggregation protocols cryptographically mask individual client updates from the server.","fun_headline_variants_meta":{"raw":{"variants":["Malicious FL Server Hides Private Data Inside Model Parameters","Federated Aggregation Bypassed to Store Private Client Images","Segmented Aggregation Preserves Stolen Training Data in FL Models","Pearson-Correlation Encoding Enables Data Theft Across FL Training","White-Box FL Attack Stores Private Images in Carrier Parameters"]},"model":"glm-5.2","effort":"low","cost_usd":0.0,"raw_usage":{"total_tokens":690,"prompt_tokens":621,"completion_tokens":69,"prompt_tokens_details":null},"tokens_in":621,"tokens_out":69,"duration_ms":95073,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-09T14:21:41.314625+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"A federated learning deployment using secure aggregation that prevents the server from seeing individual client updates would break the segmented aggregation step, since the server cannot selectively preserve carrier parameters it cannot identify or inspect.","supporting_citations":[],"review_version":1}