Pith. sign in

REVIEW 3 major objections 4 minor 73 references

TimberStrike: Dataset Reconstruction Attack Revealing Privacy Leakage in Federated Tree-Based Systems

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single honest-but-curious client can reconstruct 73–96% of another client's training data in federated gradient-boosted tree systems.

desk verdict First reconstruction attack on horizontal tree-based FL with sound core algebra, but the Cyclic results depend on a base-score assumption that only the first round-robin client satisfies. read the letter →

arxiv 2506.07605 v3 pith:TFS7OYH5 submitted 2025-06-09 cs.CR cs.DCcs.LG

Marco Di Gennaro , Giovanni De Lucia , Stefano Longari , Stefano Zanero , Michele Carminati This is my paper
classification cs.CRcs.DCcs.LG
keywords federatedlearningdatasetreconstructionattackgradientboostingdecisiontreesXGBoosthorizontalprivacyleakagedifferentialtree-basedmodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that horizontal federated learning with gradient-boosted decision trees leaks the training data of honest participants to other participants. TimberStrike is an attack executed by one honest-but-curious client — a participant who follows the protocol but inspects everything — that uses the leaf-level aggregated gradient and Hessian sums (G and H), along with split values and leaf values, to infer how many samples fall in each leaf, what fraction is positive, and increasingly precise feature ranges for every sample. On five federated gradient-boosting implementations and two health datasets, the attack reconstructs between 73.05% and 86.86% of the full target dataset, and up to 95.63% on the most important features of the Stroke dataset. It also shows that differential privacy lowers but does not eliminate the reconstruction, at a visible cost in model utility, and argues that future tree-based federated systems should send clients only the chosen split, never the underlying G and H sums.

What carries the argument

The load-bearing identities are the leaf-level statistics of boosted trees. For the first tree, written with binary cross-entropy loss, every sample has the same Hessian $h = \text{base\_score}(1-\text{base\_score})$, so the aggregated Hessian $H_j$ of a leaf determines the number of samples in that leaf via $N_j = H_j / (\text{base\_score}(1-\text{base\_score}))$. The aggregated gradient is tied to the leaf value by $G_j = -(\text{leaf\_value}_j/\eta)(H_j + \lambda)$, and splitting $G_j$ into base-score-weighted and $(1-\text{base\_score})$-weighted contributions yields the counts of label-0 and label-1 samples. These identities turn a tree into a partially known dataset, and a Mixed-Integer Linear Program over assignment variables $x_{ij}$ then fits each reconstructed sample to a leaf in every later tree by matching reconstructed per-leaf $G$ and $H$ sums to the observed ones, progressively narrowing feature ranges.

What would settle it

Modify one of the five evaluated federated boosting systems so the server broadcasts only the chosen split and leaf value, never the per-leaf aggregated G and H, and run the identical attack; a drop to near-chance reconstruction accuracy would confirm that per-leaf G/H exposure is the enabling leak, whereas sustained 73–96% accuracy would refute the paper's stated mechanism. The decisive check is the first tree: without $H_j$, the equation $N_j = H_j / (\text{base\_score}(1-\text{base\_score}))$ cannot be evaluated, so the attacker should be unable to even count samples per leaf.

Watch

Extended reading notes

Core claim

TimberStrike's central discovery is that the statistics gradient boosting already shares inside a federated tree ensemble are enough to invert the training data. In the first phase, First-Tree Probing, the attacker uses the fact that the first tree is trained from a constant base score, so every sample has the same Hessian; the aggregated Hessian H_j in each leaf directly reveals the exact number of samples N_j in that leaf, and the aggregated gradient G_j together with the leaf value reveals how many of those samples have label 0 versus label 1. The attacker seeds a synthetic dataset with these counts, constrained to the feature ranges implied by the tree's decision path. In the second phase, Feature Range Inference, each subsequent tree contributes a mixed-integer program: assign each reconstructed sample to one of the leaves it can still reach so that the reconstructed per-leaf G and H sums match the observed ones, then tighten feature ranges accordingly. The paper reports that this procedure reconstructs between 73.05% and 86.86% of all features of the target data across the five evaluated systems on the Stroke dataset, rising to 95.63% when only the five most important features are scored; on the smaller all-numerical Pima diabetes dataset the range is 54.45–73.37%.

Load-bearing premise

The entire attack rests on the participating client being able to read the per-leaf aggregated gradient and Hessian sums (G and H) of every tree, or to recover them from the serialized model; if a framework hands clients only split decisions and leaf values, the reconstruction equations have no input.

Editorial extensions

If this is right

  • Any horizontally federated gradient-boosting framework that exposes per-leaf G and H sums to participating clients carries a client-side data reconstruction vulnerability that does not require server compromise or protocol deviation.
  • An attacker does not need the whole ensemble: First-Tree Probing alone already yields substantial reconstruction accuracy, and the Feature Range Inference phase adds only a few percentage points on average, so even short or shallow federated runs leak.
  • Histogram-based aggregation localizes the attack to the union of all clients' datasets rather than a specific client, but that union is still reconstructed with high accuracy, and the degradation from scaling from 3 to 30 clients is small.
  • Differential privacy under the FedTree-style histogram implementation is not a standalone mitigation: at the strongest tested privacy budget, reconstruction accuracy stays above 50% while the model's F1-score and AUC drop substantially.
  • A practical design change motivated by the results is to have the server compute split gains and broadcast only the winning split or leaf value, keeping global G and H statistics off the client side.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If a framework withholds per-leaf G and H, the paper's exact counting equations lose their input, but the general recipe of using public decision paths to constrain feature ranges still applies to any tree ensemble whose structure is visible; a natural next test is whether federated random forests leak through path constraints alone, despite lacking the boosting statistics that give exact counts.
  • Because categorical features reconstruct more easily and the number of clients has little effect, the attack is likely strongest in the tabular healthcare settings that motivate horizontal FL, where categorical demographics are common and data is non-IID across institutions.
  • The multiclass formalization in the appendix implies the attack extends beyond binary classification, so deployments with K classes should assume that K per-class first trees expose comparable per-leaf counts and label distributions.
  • The paper's mechanism suggests a simple audit rule for practitioners: if any client-visible artifact in a federated tree protocol contains per-leaf G or H values, that protocol should be treated as exposing training data to reconstruction attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. TimberStrike proposes a client-side dataset reconstruction attack for horizontally federated gradient-boosted trees. The attacker uses leaf-level aggregated gradients G and Hessians H, together with split paths, to first recover per-leaf sample counts and label distributions from the victim's first tree (Eqs. 4-9), and then refines feature ranges by solving MILPs that match reconstructed leaf sums to the observed G and H (Eq. 13). The paper evaluates the attack on Flower Bagging, Flower Cyclic, FedXGBllr, NVFlare, and FedTree, on the Stroke and Pima datasets, reporting Reconstruction Accuracy between 73.05% and 95.63% on Stroke; it also evaluates FedTree's Differential Privacy and proposes protocol-level mitigations. The paper argues this is the first dataset reconstruction attack in horizontal tree-based FL.

Significance. If the central assumptions hold, TimberStrike is a relevant contribution: it shows that client-side white-box access to split paths and aggregated gradient/Hessian statistics can effectively invert part of the training data in a setting previously studied mostly for neural networks. The algebraic derivation of leaf counts and label distributions is clean and correct given the base-score premise; the evaluation is broad (five implementations, two datasets, six depths); the code is released, supporting reproducibility; and the DP analysis is a useful first step. The conditional is important: two load-bearing access/premise issues and the reconstruction metric weaken the headline claim as currently stated.

major comments (3)
  1. [Section 5.3.1, Eqs. (4)-(9)] The base-score premise of First-Tree Probing is not satisfied for most victims in Flower Cyclic. Eq. (4) sets h_i = base_score * (1 - base_score) for every sample in the victim's first tree, which is valid only when the victim trains before any other tree contributes. In the Cyclic protocol of Section 2.3, trees are appended round-robin, so at most the round-1 client satisfies this premise; the first tree of every later client is trained on margins that already include previous clients' trees. Section 5.3.1 acknowledges the interleaving but only replaces the later-tree leaf values by a Hessian-weighted average, and it does not supply a replacement for Eqs. (5)-(9) in the first-tree phase. The reported Cyclic RA in Table 4 (73.05% at depth 3) may therefore reflect a favorable victim choice. Please either derive the corresponding count/label-recovery equations for a first tree trained after a nonempty ensemble, or report the Cyclic results separately for round-1 and later victims and state which case the experiments use.
  2. [Sections 4 and 5.3.3] The threat model asserts in Section 4 that the attacker has access to the aggregated gradient and Hessian values used during training, but the manuscript does not demonstrate this access for NVFlare. In the NVFlare histogram-aggregation flow of Section 2.3 (Fig. 4), clients compute and send local histograms and the server returns global histograms; Section 5.3.3 states that clients receive only aggregated gradient and Hessian statistics derived from the combined histograms, yet the paper does not trace how the final per-leaf G_j and H_j required by Eqs. (5)-(9) appear in the objects a client actually receives. If the broadcast contains only selected split points and leaf values, the first phase and the MILP constants are unavailable. Please provide a code-level or serialization-level demonstration for NVFlare, and clarify the FedTree case where Section 2.3 states that node information containing G and H is sent to clients.
  3. [Section 6.1, Eq. (14), Tables 2 and 4] The headline RA numbers mix exact categorical matches with interval matches on continuous features and give every feature equal weight. On Stroke, 7 of 11 features are categorical, and Table 2 shows that a continuous feature counts as 'reconstructed' if it falls in roughly the central 25% of a normal distribution (epsilon = 0.319 sigma). A full-feature RA of 73-95% therefore does not establish that a comparable fraction of samples or attribute values is reconstructed in a meaningful sense; a model that recovers the categorical features and label but only coarsely brackets the continuous ones could reach much of this score. Please report per-feature RA (continuous versus categorical), state how much of the reported RA is driven by exact categorical recovery and by the 25% interval tolerance, and rephrase the claim that the attack 'reconstructs between 73.05% and 95.63% of the target dataset' so that it matches the metric actually computed.
minor comments (4)
  1. [Appendix D] The complexity statement says each leaf traversal requires O(log d) time; for a decision tree, traversing a path from the root to a leaf costs O(d), not O(log d). Please correct this and adjust the stated bound accordingly.
  2. [Eqs. (7) and (10)] The notation for leaf values is inconsistent: Eq. (7) divides leaf_value by eta to recover G_j, while Eq. (10) sums leaf_score(t) without an explicit eta factor. Please state explicitly whether the stored leaf values include the learning rate or not.
  3. [Section 6.3, Table 8] The DP evaluation is limited to FedTree on the Pima dataset, and the authors state that the horizontal DP implementation is extended 'to the best of our ability'; the conclusion that DP is insufficient as a standalone defense should be phrased with this scope limitation.
  4. [Section 5.3.1, Figure 7] The tree-to-client attribution heuristic is described only verbally. Since Section 6.2.3 reports cases where the second phase lowers RA for Bagging and Cyclic on Pima, please report attribution error rates or evaluate the heuristic separately.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: TimberStrike solves an inverse reconstruction problem from leaf-level aggregate G/H statistics and is evaluated against external ground truth; the only self-citation is non-load-bearing.

full rationale

The derivation chain in TimberStrike is self-contained rather than circular. First-Tree Probing (Section 5.1) derives leaf sample counts and label counts algebraically from the observed leaf-level Hessian H_j and gradient G_j using Equations (5)-(9); the inputs are the aggregate statistics, base score, leaf value, learning rate, and regularization parameter, and the output is compared against the actual victim dataset, which is external to the model. Feature Range Inference (Section 5.2) is an optimization-based inverse problem whose objective (Equation 13) minimizes the mismatch between reconstructed and observed per-leaf gradients and Hessians; it is a fit to observable aggregates, not a prediction that is forced by construction from the evaluation target. The Reconstruction Accuracy metric (Section 6.1, Equation 14) is taken from TabLeak and uses Hungarian matching against the ground-truth dataset, so the evaluation is independent of the attack's inputs. No uniqueness theorem, no load-bearing self-citation, and no ansatz-smuggling citation is used: the cited formulas for gradients and Hessians are standard XGBoost results, and the only self-citation is a non-load-bearing reference to the authors' earlier healthcare-FL paper in the introduction. Concerns about the first-tree base-score assumption in Flower Cyclic (Section 5.3.1) are validity or scope limitations, not circularity, because the paper does not redefine the victim or the target dataset to make Equations (5)-(9) trivially true.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central attack depends on two free parameters (RA tolerance and MILP time budget) and on five assumptions, the most critical being that clients can obtain leaf-level gradient and Hessian aggregates.

free parameters (2)
  • RA tolerance multiplier = 0.319
    Per-feature matching tolerance epsilon_i is set to 0.319 * sigma_i following TabLeak [54]. This admits a central interval of about 25% of the feature distribution, directly determining reported RA values. It is a hand-chosen metric parameter.
  • MILP time limit = 600 seconds per tree
    Section 6.1 imposes a 10-minute time constraint per tree in Feature Range Inference. This hand-chosen budget bounds optimization cost and affects the final RA, as noted in Section 6.2.5.
assumptions (5)
  • domain assumption Clients can access leaf-level aggregated gradient G and Hessian H (or recover them from model artifacts).
    Used to derive Eq. (6)-(9); asserted in Section 4 but not demonstrated for every framework.
  • standard math For the first tree, every sample shares the same probability p = transformed base score, so H_j = N_j * b(1-b).
    Eq. (4)-(6); relies on XGBoost initializing training with a constant base score.
  • standard math The XGBoost leaf weight formula leaf = -eta * G/(H+lambda) holds and eta, lambda are known to the attacker.
    Eq. (7) inverts leaf values to gradients.
  • domain assumption The tree-chain matching heuristic based on Hessian distances correctly identifies the victim's trees for Flower Bagging/Cyclic.
    Section 5.3.1; the paper itself shows it fails for Pima with those frameworks.
  • domain assumption The Hungarian algorithm provides a valid pairing of reconstructed and original samples for RA computation.
    Section 6.1; a real attacker lacks ground truth, so this oracle pairing may overstate reconstruction accuracy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TimberStrike: Dataset Reconstruction Attack Revealing Privacy Leakage in Federated Tree-Based Systems." pith.science (2026). https://pith.science/paper/TFS7OYH5

@misc{pith2026250607605,
  author       = {Pith},
  title        = {Pith review of: TimberStrike: Dataset Reconstruction Attack Revealing Privacy Leakage in Federated Tree-Based Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TFS7OYH5}},
  note         = {Machine review of arXiv:2506.07605}
}
read the original abstract

Federated Learning has emerged as a privacy-oriented alternative to centralized Machine Learning, enabling collaborative model training without direct data sharing. While extensively studied for neural networks, the security and privacy implications of tree-based models remain underexplored. This work introduces TimberStrike, an optimization-based dataset reconstruction attack targeting horizontally federated tree-based models. Our attack, carried out by a single client, exploits the discrete nature of decision trees by using split values and decision paths to infer sensitive training data from other clients. We evaluate TimberStrike on State-of-the-Art federated gradient boosting implementations across multiple frameworks, including Flower, NVFlare, and FedTree, demonstrating their vulnerability to privacy breaches. On a publicly available stroke prediction dataset, TimberStrike consistently reconstructs between 73.05% and 95.63% of the target dataset across all implementations. We further analyze Differential Privacy, showing that while it partially mitigates the attack, it also significantly degrades model performance. Our findings highlight the need for privacy-preserving mechanisms specifically designed for tree-based Federated Learning systems, and we provide preliminary insights into their design.

Figures

Figures reproduced from arXiv: 2506.07605 by the authors.

Figure 1
Figure 1. Flower Bagging algorithm schema. PS r Trees Round r Round-robin Selected Client Concatenate the New Tree Train a New Tree [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Flower Cyclic algorithm schema. Client 1 ... Client 2 ... Client K ... Concatenate & Send PS XGBoost Model XGBoost Model XGBoost Model ŷ ... CNN ... [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. FedXGBllr algorithm schema. model as a starting point for the next boosting round. In particular, each client trains a new local tree based on the prediction obtained from the global model, then it sends this tree to the server, which aggregates them by concatenation in the order of arrival. This pro￾cess repeats until the desired number of trees (or training rounds) is achieved. Such an approach is implemented in t… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: NVFlare Histogram-based algorithm schema. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: TimberStrike attack schema. understanding the internals of TimberStrike, we provide all relevant definitions related to gradient boosting in Section 2.1. The intuition behind our approach is that an attacker, by control￾ling a client, can exploit the sequential nature …
Figure 6
Figure 6. Figure 6: Decision Tree (DT) with its reconstructed dataset [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Root node Hessian for 90 trees trained using the [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Reconstruction assessment of a 4-sample dataset, [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Experimental results on the Stroke Prediction Dataset (left) and the Pima Indians Diabetes Dataset (right). [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: RA on the Stroke dataset using FedTree, with vary [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

73 extracted references · 34 canonical work pages

  1. [1]

    Fouad, Doaa L

    Mustafa Abdul Salam, Khaled M. Fouad, Doaa L. Elbably, and Salah M. Elsayed

    work page

  2. [2]

    Selcuk Uluagac, and Mauro Conti

    Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, and Mauro Conti. 2018. A Survey on Homomorphic Encryption Schemes: Theory and Implementation. ACM Comput. Surv. 51, 4 (July 2018), 79:1–79:35. https://doi.org/10.1145/3214303

    doi:10.1145/3214303 2018

  3. [3]

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How To Backdoor Federated Learning. In Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics (Pro- ceedings of Machine Learning Research, Vol. 108), Silvia Chiappa and Roberto Calan- dra (Eds.). PMLR, 2938–2948. https://pr...

    work page 2020

  4. [4]

    Beutel, Taner Topal, Akhil Mathur, Xinchi Qiu, Javier Fernandez- Marques, Yan Gao, Lorenzo Sani, Kwing Hei Li, Titouan Parcollet, Pedro Porto Buarque de Gusmão, and Nicholas D

    Daniel J. Beutel, Taner Topal, Akhil Mathur, Xinchi Qiu, Javier Fernandez- Marques, Yan Gao, Lorenzo Sani, Kwing Hei Li, Titouan Parcollet, Pedro Porto Buarque de Gusmão, and Nicholas D. Lane. 2022. Flower: A Friendly Feder- ated Learning Research Framework. https://doi.org/10.48550/arXiv.2007.14390 arXiv:2007.14390 [cs]

    arXiv doi:10.48550/arxiv.2007.14390 2022

  5. [5]

    Bren- dan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Bren- dan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth

  6. [6]

    Bernardo Camajori Tedeschini, Stefano Savazzi, Roman Stoklasa, Luca Barbieri, Ioannis Stathopoulos, Monica Nicoli, and Luigi Serio. 2022. Decentralized Feder- ated Learning for Healthcare Networks: A Case Study on Tumor Segmentation. IEEE Access 10 (2022), 8693–8708. https://doi.org/10.1109/ACCESS.2022.3141913

    arXiv 2022

  7. [7]

    Centers for Medicare & Medicaid Services. 1996. The Health Insurance Porta- bility and Accountability Act of 1996 (HIPAA). Published: Online at https://www.hhs.gov/hipaa

    work page 1996

  8. [8]

    Sylvain Chatel, Apostolos Pyrgelis, Juan Ramón Troncoso-Pastoriza, and Jean- Pierre Hubaux. 2021. SoK: Privacy-Preserving Collaborative Tree-based Model Learning. Proceedings on Privacy Enhancing Technologies 3 (2021), 182–203. https: //doi.org/10.2478/popets-2021-0043

    work page doi:10.2478/popets-2021-0043 2021

Show all 73 references
  1. [9]

    N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer. 2002. SMOTE: Synthetic Minority Over-sampling Technique. Journal of Artificial Intelligence Research 16 (June 2002), 321–357. https://doi.org/10.1613/jair.953

    2002 doi

  2. [10]

    Tianqi Chen and Carlos Guestrin. 2016. XGBoost: A Scalable Tree Boosting System. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (San Francisco, California, USA) (KDD ’16). Association for Computing Machinery, New York, NY,...

    2016

  3. [11]

    Tianqi Chen, Sameer Singh, Ben Taskar, and Carlos Guestrin. 2015. Efficient Second-Order Gradient Boosting for Conditional Random Fields. In Proceedings of the Eighteenth International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Resear...

    2015

  4. [12]

    Xiaolin Chen, Daoguang Zan, Wei Li, Bei Guan, and Yongji Wang. 2024. FIA- TE: Feature Inference Attack on Decision Tree Ensembles in Vertical Federated Learning. In 2024 IEEE International Conference on Multimedia and Expo (ICME) . 1–6. https://doi.org/10.1109/ICME57554.2024.10687832

    2024

  5. [13]

    Kewei Cheng, Tao Fan, Yilun Jin, Yang Liu, Tianjian Chen, Dimitrios Papadopou- los, and Qiang Yang. 2021. SecureBoost: A Lossless Federated Learning Frame- work. IEEE Intelligent Systems 36, 6 (2021), 87–98. https://doi.org/10.1109/MIS. 2021.3082561

    2021

  6. [14]

    Dilip Kumar Choubey, Sanchita Paul, Santosh Kumar, and Shankar Kumar. 2017. Classification of Pima indian diabetes dataset using naive bayes with genetic algorithm as an attribute selection. In Communication and computing systems: proceedings of the international conference on...

    2017

  7. [15]

    Kelong Cong, Debajyoti Das, Jeongeun Park, and Hilder V.L. Pereira. 2022. SortingHat: Efficient Private Decision Tree Evaluation via Homomorphic En- cryption and Transciphering. In Proceedings of the 2022 ACM SIGSAC Con- ference on Computer and Communications Security (Los Ang...

    2022

  8. [16]

    Thien-Phuc Doan, Bong Jun Choi, Kihun Hong, Jungsoo Park, and Souhwan Jung. 2023. Random Forest in Federated Learning Setting. In Advances in Com- puter Science and Ubiquitous Computing , Ji Su Park, Laurence T. Yang, Yi Pan, and Jong Hyuk Park (Eds.). Vol. 1028. Springer Natu...

    2023 doi

  9. [17]

    Cynthia Dwork. 2006. Differential Privacy. In Automata, Languages and Pro- gramming, Michele Bugliesi, Bart Preneel, Vladimiro Sassone, and Ingo Wegener (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 1–12

    2006

  10. [18]

    David Enthoven and Zaid Al-Ars. 2020. An Overview of Federated Deep Learning Privacy Attacks and Defensive Strategies. http://arxiv.org/abs/2004.04676 arXiv:2004.04676 [cs, stat]

    2020 arXiv

  11. [19]

    Yann Fraboni, Richard Vidal, and Marco Lorenzi. 2021. Free-rider Attacks on Model Aggregation in Federated Learning. InProceedings of The 24th International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research, Vol. 130), Arindam Baner...

    2021

  12. [20]

    Friedman

    Jerome H. Friedman. 2001. Greedy function approximation: A gradient boosting machine. The Annals of Statistics 29, 5 (Oct. 2001). https://doi.org/10.1214/aos/ 1013203451

    2001 doi

  13. [21]

    Ian Goodfellow, Yoshua Bengio, and Aaron Courville. 2016. Deep Learning. MIT Press. http://www.deeplearningbook.org

    2016

  14. [22]

    Gurobi Optimization, LLC. 2024. Gurobi Optimizer Reference Manual. https: //www.gurobi.com

    2024

  15. [23]

    Hafsa Habehh and Suril Gohel. 2021. Machine Learning in Healthcare. Current Genomics 22, 4 (Dec. 2021), 291–300. https://doi.org/10.2174/ 1389202922666210705124359

    2021

  16. [24]

    Ahmad Hassan. 2023. Stroke Prediction Dataset. https://doi.org/10.21227/mxfb- sc71

    2023 doi

  17. [25]

    Anne-Christin Hauschild, Marta Lemanczyk, Julian Matschinske, Tobias Frisch, Olga Zolotareva, Andreas Holzinger, Jan Baumbach, and Dominik Heider. 2022. Federated Random Forests can improve local performance of predictive models for various healthcare applications. Bioinformat...

    2022 doi

  18. [26]

    Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. 2017. Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (Dallas, Texas, USA) (CCS ’17). Associatio...

    2017

  19. [27]

    Lipton, and Charles Elkan

    Zhanglong Ji, Zachary C. Lipton, and Charles Elkan. 2014. Differential Privacy and Machine Learning: a Survey and Review. https://doi.org/10.48550/arXiv. 1412.7584 arXiv:1412.7584 [cs]

    2014 doi arXiv

  20. [28]

    H. W. Kuhn. 1955. The Hungarian method for the assignment problem. Naval Research Logistics Quarterly 2, 1-2 (1955), 83–97. https://doi.org/10.1002/nav. 3800020109

    1955 doi

  21. [29]

    K Naveen Kumar, C Krishna Mohan, and Linga Reddy Cenkeramaddi. 2023. The Impact of Adversarial Attacks on Federated Learning: A Survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2023), 1–20. https: //doi.org/10.1109/TPAMI.2023.3322785

    2023

  22. [30]

    Andrew Law, Chester Leung, Rishabh Poddar, Raluca Ada Popa, Chenyu Shi, Octavian Sima, Chaofan Yu, Xingmeng Zhang, and Wenting Zheng. 2020. Secure Collaborative Training and Inference for XGBoost. In Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Pr...

    2020

  23. [31]

    Mengqian Li, Youliang Tian, Junpeng Zhang, Dandan Fan, and Dongmei Zhao

  24. [32]

    Qinbin Li, Zeyi Wen, and Bingsheng He. 2020. Practical Federated Gradient Boost- ing Decision Trees. Proceedings of the AAAI Conference on Artificial Intelligence 34, 04 (Apr. 2020), 4642–4649. https://doi.org/10.1609/aaai.v34i04.5895

    2020 doi

  25. [33]

    Qinbin Li, WU ZHAOMIN, Yanzheng Cai, yuxuan han, Ching Man Yung, Tianyuan Fu, and Bingsheng He. 2023. FedTree: A Federated Learning System For Trees. In Proceedings of Machine Learning and Systems , D. Song, M. Carbin, and T. Chen (Eds.), Vol. 5. Curan, 89–103. https://proceed...

    2023

  26. [34]

    Yehuda Lindell and Benny Pinkas. 2009. Secure Multiparty Computation for Privacy-Preserving Data Mining. Journal of Privacy and Confidentiality 1, 1 (Apr. 2009). https://doi.org/10.29012/jpc.v1i1.566 14 TimberStrike (Preprint) Proceedings on Privacy Enhancing Technologies 2025(4)

    2009 doi

  27. [35]

    William Lindskog-Münzing and Christian Prehofer. 2024. treeXnets: Comparing Federated Tree-BasedModels and Neural Networks on Tabular Data. https: //doi.org/10.21203/rs.3.rs-4499006/v1

    2024 doi

  28. [36]

    Pengrui Liu, Xiangrui Xu, and Wei Wang. 2022. Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives. Cybersecurity 5, 1 (Dec. 2022), 4. https://doi.org/10.1186/s42400-021-00105-6

    2022 doi

  29. [37]

    H Deng, and Kui Ren

    Yang Liu, Zhuo Ma, Ximeng Liu, Siqi Ma, Surya Nepal, Robert. H Deng, and Kui Ren. 2020. Boosting Privately: Federated Extreme Gradient Boosting for Mobile Crowdsensing. In 2020 IEEE 40th International Conference on Distributed Computing Systems (ICDCS) . 1–11. https://doi.org/...

    2020

  30. [38]

    Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi. 2021. Feature Inference Attack on Model Predictions in Vertical Federated Learning. In 2021 IEEE 37th International Conference on Data Engineering (ICDE) . IEEE, Chania, Greece, 181–192. https://doi.org/10.1109/ICDE513...

    2021

  31. [39]

    Chenyang Ma, Xinchi Qiu, Daniel Beutel, and Nicholas Lane. 2023. Gradient-less Federated Gradient Boosting Tree with Learnable Learning Rates. In Proceedings of the 3rd Workshop on Machine Learning and Systems (Rome, Italy) (EuroMLSys ’23). Association for Computing Machinery,...

    2023

  32. [40]

    Samuel Maddock, Graham Cormode, Tianhao Wang, Carsten Maple, and Somesh Jha. 2022. Federated Boosted Decision Trees with Differential Privacy. In Pro- ceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. ACM, Los Angeles CA USA, 2249–2263. https:...

    2022 doi

  33. [41]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (Proceedings of ...

    2017

  34. [42]

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. 2019. Exploiting Unintended Feature Leakage in Collaborative Learning. In 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, San Francisco, CA, USA, 691–706. https://doi.org/10.1109/SP.2019.00029

    2019

  35. [43]

    Murdoch and Allan S

    Travis B. Murdoch and Allan S. Detsky. 2013. The Inevitable Application of Big Data to Health Care. JAMA 309, 13 (April 2013), 1351. https://doi.org/10.1001/ jama.2013.393

    2013

  36. [44]

    Hanchi Ren, Jingjing Deng, and Xianghua Xie. 2022. GRNN: Generative Regres- sion Neural Network—A Data Leakage Attack for Federated Learning. ACM Trans. Intell. Syst. Technol. 13, 4, Article 65 (May 2022), 24 pages. https: //doi.org/10.1145/3510032

    2022 doi

  37. [45]

    Ryan Rifkin and Aldebaro Klautau. 2004. In Defense of One-Vs-All Classification. J. Mach. Learn. Res. 5 (Dec. 2004), 101–141

    2004

  38. [46]

    Maria Rigaki and Sebastian Garcia. 2023. A Survey of Privacy Attacks in Machine Learning. ACM Comput. Surv. 56, 4, Article 101 (Nov. 2023), 34 pages. https: //doi.org/10.1145/3624010

    2023 doi

  39. [47]

    Lior Rokach and Oded Maimon. 2005. Decision Trees. In Data Mining and Knowledge Discovery Handbook, Oded Maimon and Lior Rokach (Eds.). Springer- Verlag, New York, 165–192. https://doi.org/10.1007/0-387-25465-X_9

    2005 doi

  40. [48]

    Holger R. Roth, Yan Cheng, Yuhong Wen, Isaac Yang, Ziyue Xu, Yuan-Ting Hsieh, Kristopher Kersten, Ahmed Harouni, Can Zhao, Kevin Lu, Zhihong Zhang, Wenqi Li, Andriy Myronenko, Dong Yang, Sean Yang, Nicola Rieke, Abood Quraini, Chester Chen, Daguang Xu, Nic Ma, Prerna Dogra, Mo...

    2022 doi arXiv

  41. [49]

    Diogo Reis Santos, Albert Sund Aillet, Antonio Boiano, Usevalad Milasheuski, Lorenzo Giusti, Marco Di Gennaro, Sanaz Kianoush, Luca Barbieri, Monica Nicoli, Michele Carminati, Alessandro E. C. Redondi, Stefano Savazzi, and Luigi Serio. 2024. A Federated Learning Platform as a ...

    2024

  42. [50]

    Sinharay

    S. Sinharay. 2010. Continuous Probability Distributions. In International Encyclo- pedia of Education. Elsevier, 98–102. https://doi.org/10.1016/B978-0-08-044894- 7.01720-6

    2010 doi

  43. [51]

    Brendan McMahan

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H. Brendan McMahan

  44. [52]

    Hideaki Takahashi, Jingjing Liu, and Yang Liu. 2023. Eliminating Label Leakage in Tree-Based Vertical Federated Learning. https://doi.org/10.48550/arXiv.2307. 10318 arXiv:2307.10318 [cs]

    2023 doi arXiv

  45. [53]

    Zhihua Tian, Rui Zhang, Xiaoyang Hou, Lingjuan Lyu, Tianyi Zhang, Jian Liu, and Kui Ren. 2024. FederBoost: Private Federated Learning for GBDT. IEEE Transactions on Dependable and Secure Computing 21, 3 (2024), 1274–1285. https: //doi.org/10.1109/TDSC.2023.3276365

    2024

  46. [54]

    Dimitrov, and Martin Vechev

    Mark Vero, Mislav Balunović, Dimitar I. Dimitrov, and Martin Vechev. 2023. TabLeak: tabular data leakage in federated learning. In Proceedings of the 40th International Conference on Machine Learning (Honolulu, Hawaii, USA) (ICML’23). JMLR.org, Article 1460, 33 pages

    2023

  47. [55]

    Paul Voigt and Axel von dem Bussche. 2017. The EU General Data Protection Regulation (GDPR): A Practical Guide (1st ed.). Springer Publishing Company, Incorporated

    2017

  48. [56]

    Zijun Wang and Keke Gai. 2024. Decision Tree-Based Federated Learning: A Survey. Blockchains 2, 1 (March 2024), 40–60. https://doi.org/10.3390/ blockchains2010003

    2024

  49. [57]

    Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. 2019. Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning. In IEEE INFOCOM 2019 - IEEE Conference on Computer Communications (Paris, France). IEEE Press, 2512–2...

    2019

  50. [58]

    Chen, and Aad Van Moorsel

    Han Wu, Zilong Zhao, Lydia Y. Chen, and Aad Van Moorsel. 2022. Federated Learning for Tabular Data: Exploring Potential Risk to Privacy. In 2022 IEEE 33rd International Symposium on Software Reliability Engineering (ISSRE) . IEEE, Charlotte, NC, USA, 193–204. https://doi.org/1...

    2022

  51. [59]

    Yuncheng Wu, Shaofeng Cai, Xiaokui Xiao, Gang Chen, and Beng Chin Ooi. 2020. Privacy preserving vertical federated learning for tree-based models. Proceedings of the VLDB Endowment 13, 12 (Aug. 2020), 2090–2103. https://doi.org/10.14778/ 3407790.3407811

    2020

  52. [60]

    Chen, and Jeremie Decouchant

    Jin Xu, Chi Hong, Jiyue Huang, Lydia Y. Chen, and Jeremie Decouchant. 2022. AGIC: Approximate Gradient Inversion Attack on Federated Learning . In 2022 41st International Symposium on Reliable Distributed Systems (SRDS) . IEEE Com- puter Society, Los Alamitos, CA, USA, 12–22. ...

    2022

  53. [61]

    Fuki Yamamoto, Seiichi Ozawa, and Lihua Wang. 2022. eFL-Boost: Efficient Federated Learning for Gradient Boosting Decision Trees. IEEE Access 10 (2022), 43954–43963. https://doi.org/10.1109/ACCESS.2022.3169502

    2022

  54. [62]

    Fuki Yamamoto, Lihua Wang, and Seiichi Ozawa. 2020. New Approaches to Federated XGBoost Learning for Privacy-Preserving Data Analysis. In Neural Information Processing, Haiqin Yang, Kitsuchart Pasupa, Andrew Chi-Sing Leung, James T. Kwok, Jonathan H. Chan, and Irwin King (Eds....

    2020 doi

  55. [63]

    Haomiao Yang, Mengyu Ge, Kunlan Xiang, and Jingwei Li. 2023. Using Highly Compressed Gradients in Federated Learning for Data Reconstruction Attacks. IEEE Transactions on Information Forensics and Security 18 (2023), 818–830. https: //doi.org/10.1109/TIFS.2022.3227761

    2023

  56. [64]

    Mengwei Yang, Linqi Song, Jie Xu, Congduan Li, and Guozhen Tan. 2019. The Tradeoff Between Privacy and Accuracy in Anomaly Detection Using Federated XGBoost. https://doi.org/10.48550/arXiv.1907.07157 arXiv:1907.07157 [cs]

    2019 doi arXiv

  57. [65]

    Boyang Zhang, Zheng Li, Ziqing Yang, Xinlei He, Michael Backes, Mario Fritz, and Yang Zhang. 2024. SecurityNet: Assessing Machine Learning Vulnerabilities on Public Models. In 33rd USENIX Security Symposium (USENIX Security 24) . USENIX Association, Philadelphia, PA, 3873–3890...

    2024

  58. [66]

    Chuan Zhang, Haotian Liang, Youqi Li, Tong Wu, Liehuang Zhu, and Weiting Zhang. 2023. Stealing Secrecy from Outside: A Novel Gradient Inversion Attack in Federated Learning. In 2022 IEEE 28th International Conference on Parallel and Distributed Systems (ICPADS). IEEE, Nanjing,...

    2023

  59. [67]

    Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H

    Joshua C. Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H. Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. 2024. Loki: Large-scale Data Re- construction Attack against Federated Learning through Model Manipulation. In 2024 IEEE Symposium on Security and Privacy (SP) . 1287–...

    2024

  60. [68]

    path traversal

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep Leakage from Gradients. In Advances in Neural Information Processing Systems , H. Wallach, H. Larochelle, A. Beygelzimer, F. d 'Alché-Buc, E. Fox, and R. Garnett (Eds.), Vol. 32. Cur- ran Associates, Inc. https://proceedings.ne...

    2019

  61. [1854]

    https://proceedings.mlr.press/v130/fraboni21a.html

  62. [2016]

    https://doi.org/10.48550/arXiv.1611.04482 arXiv:1611.04482 [cs]

    Practical Secure Aggregation for Federated Learning on User-Held Data. https://doi.org/10.48550/arXiv.1611.04482 arXiv:1611.04482 [cs]

    doi arXiv

  63. [2019]

    07963 arXiv:1911.07963 [cs, stat]

    Can You Really Backdoor Federated Learning? http://arxiv.org/abs/1911. 07963 arXiv:1911.07963 [cs, stat]

    1911 arXiv

  64. [2021]

    In 2021 International Conference on Networking and Network Applications (NaNA)

    The Trade-off Between Privacy and Utility in Local Differential Privacy. In 2021 International Conference on Networking and Network Applications (NaNA) . 373–378. https://doi.org/10.1109/NaNA53684.2021.00071

    2021

  65. [2024]

    Neural Computing and Applications 36, 11 (April 2024), 6231–6256

    Federated learning model for credit card fraud detection with data balancing techniques. Neural Computing and Applications 36, 11 (April 2024), 6231–6256. https://doi.org/10.1007/s00521-023-09410-2

    2024 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.