Pith. sign in

REVIEW 2 major objections 6 minor 44 references

FL Server Steals Private Training Data Through Parameter Encoding

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-09 14:21 UTC pith:JZA667HG

load-bearing objection New active data-extraction attack in FL: adapts CVEA to federated setting with segmented aggregation. Proof-of-concept scale only; recovery quality degrades at larger payloads with the default placement strategy. the 2 major comments →

arxiv 2607.07314 v1 pith:JZA667HG submitted 2026-07-08 cs.LG cs.AIcs.CR

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Chongkai Li , Bang Zhang , Wenjian Luo This is my paper
classification cs.LG cs.AIcs.CR
keywords federated learningprivacy leakagewhite-box attackTaking Away Training DataCorrelation Value Encoding Attacksegmented aggregationparameter-level memorizationmalicious server
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces FedCVESA, an attack in which a malicious federated learning server actively writes private training data from selected target clients into the global model's parameters during training, then extracts and recovers that data after training completes. The attack adapts the centralized Correlation Value Encoding Attack (CVEA) to the federated setting by adding a Pearson-correlation regularizer to the local loss function of target clients. This regularizer causes a designated subset of model parameters—called carrier parameters—to become statistically correlated with the private training data vector, effectively encoding the data into the model's weights. The key technical challenge the paper addresses is that standard federated averaging would overwrite these carrier parameters with updates from non-target clients. To prevent this, the authors propose segmented aggregation: the malicious server preserves carrier parameters uploaded by target clients while applying standard averaging to all remaining parameters. Carrier parameters are also dispersed across the model rather than concentrated in one contiguous block, to avoid disrupting any single layer's function. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under non-IID Dirichlet data partitions show that the method recovers semantically recognizable private training images while maintaining near-baseline classification accuracy, demonstrating that federated learning can function as a parameter-level memorization channel under a white-box malicious-server threat model.

Core claim

The central discovery is that federated learning's aggregation step, long viewed as a mixing mechanism that would obscure individual client information, can be selectively bypassed by a malicious server to preserve encoded training data in specific model parameters. By combining a Pearson-correlation encoding objective on target clients with a segmented aggregation rule that protects carrier parameters from being averaged away, the attack creates a coordinated encode-preserve-recover pipeline that operates across the full federated training lifecycle. The dispersed placement of carrier parameters across the model prevents the encoding from concentrating in one layer and degrading main-task性能

What carries the argument

Pearson-correlation regularizer (CVEA loss term) + segmented aggregation over dispersed carrier parameters + server-side extraction and recovery via min-max normalization

Load-bearing premise

The attack assumes the malicious server can directly inspect raw, unencrypted model updates from individual clients and selectively preserve specific parameters during aggregation—a condition that fails when secure aggregation protocols cryptographically mask individual client updates from the server.

What would settle it

A federated learning deployment using secure aggregation that prevents the server from seeing individual client updates would break the segmented aggregation step, since the server cannot selectively preserve carrier parameters it cannot identify or inspect.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Secure aggregation protocols that cryptographically hide individual client updates from the server would directly block this attack, since the server cannot selectively preserve carrier parameters it cannot inspect.
  • The attack's stealth—maintaining near-baseline classification accuracy—suggests that anomaly detection based solely on model utility degradation may be insufficient to detect parameter-level data theft in FL.
  • The finding that dispersed carrier placement outperforms contiguous placement on complex data (CIFAR-10) implies that the attack scales with model capacity: larger models offer more candidate carrier positions without functional disruption.
  • The proof-of-concept setting (one image per client, 10 clients) means the practical risk of large-scale data exfiltration under this method remains uncharacterized.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If secure aggregation becomes standard practice in FL deployments, this attack vector narrows considerably, but the paper does not test against secure aggregation, so the interaction remains an open question.
  • The attack's reliance on modifying the local loss function means it could potentially be detected by clients that inspect their own training objectives, though this assumes a level of client-side vigilance not standard in current FL deployments.
  • The non-monotonic relationship between attack strength and recovery quality suggests that optimal attack parameters are dataset- and architecture-dependent, which could make the attack harder to deploy generically but also harder to defend against with fixed detection thresholds.
  • Extending the attack to non-image data (text, tabular) would require adapting the carrier-parameter budget and encoding scheme, since the current method relies on image-shaped payloads (C x H x W).

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. This paper proposes FedCVESA, a white-box Taking Away Training Data (TATD) attack in federated learning. A malicious server selects target clients, injects a Pearson-correlation regularizer into their local loss to encode private training data into designated carrier parameters, and applies segmented aggregation to prevent those parameters from being overwritten by standard federated averaging. The server then extracts and decodes the preserved parameters to recover the stolen images. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions evaluate the accuracy–stealing-quality trade-off across attack strengths, target-client counts, and carrier-parameter placement strategies. The paper is explicitly framed as a proof-of-concept study.

Significance. The paper identifies a genuine gap: TATD attacks have been studied in centralized settings but not under federated aggregation, where multi-client averaging could overwrite encoded data. The combination of correlation-based encoding with segmented aggregation is a reasonable technical contribution to this problem. The authors provide publicly available source code, which strengthens reproducibility. The threat model is clearly stated, and the experimental setup uses standard datasets and non-IID partitions. The work is a reasonable proof-of-concept that FL parameters can serve as a memorization channel under a white-box malicious-server adversary.

major comments (2)
  1. §5.1, Eq. (9) and §5.2: The central claim that recovered images are 'semantically meaningful' (abstract, §5.2, §6) is supported only by MAPE and qualitative visual examples (Fig. 4). MAPE is a pixel-wise metric that the paper itself acknowledges is 'sensitive to near-zero pixels' (§5.2). A MAPE of 0.2524 on MNIST at γ=1.0 (Fig. 3) represents substantial pixel-level deviation, and without a semantic metric such as SSIM, PSNR, or a classifier-based recognizability test, the claim of semantic meaningfulness is not adequately substantiated. This is load-bearing because 'semantically meaningful' is the core qualitative claim of the paper. Adding at least one standard structural or perceptual metric, or a simple classifier-based evaluation on recovered images, would address this.
  2. Table 2 and §5.4: The default dispersed placement strategy performs substantially worse than contiguous placement on MNIST and Fashion-MNIST at larger payloads. At q=50 images/client, dispersed MAPE is 0.2225 (MNIST) and 0.2072 (Fashion-MNIST), compared to 0.0639 and 0.0508 for contiguous placement. The main experiments (§5.2–5.3) use only 1 image/client, where this degradation does not manifest. The paper justifies dispersed placement based on CIFAR-10 utility preservation, but the default method is worse at recovery quality on 2 of 3 datasets at scale. The gap between the proof-of-concept scale (1 image/client) and the ablation scale (50 images/client) is large, and the paper does not discuss whether the main-experiment results would hold at the larger scale with the default placement. This raises a question about whether the central claim generalizes beyond the narrow 1-image-per-1c1c
minor comments (6)
  1. §3: The threat model assumes the server has white-box access to raw, unencrypted model updates. The paper does not discuss secure aggregation protocols (e.g., Bonawitz et al. [4], which is cited in §2.1) as a potential mitigation. A brief discussion of how secure aggregation would affect the attack's feasibility would strengthen the threat model analysis.
  2. §5.1: The experimental setup uses only K=10 clients. While the paper frames this as a controlled proof-of-concept, it would be helpful to state explicitly how the findings might scale to larger client pools, or to acknowledge this as a limitation.
  3. §4.2, Eq. (3): The dispersed index formula s_r = floor(r(L-1)/(T-1)) is defined for r=0,...,T-1. It would help to clarify whether L refers to the total number of parameters or the length of the flattened parameter vector, and whether edge cases (e.g., T > L) are handled.
  4. §5.2: The paper notes that MAPE does not decrease monotonically with γ. Given that the best MAPE for MNIST and Fashion-MNIST is at γ=1.0 but for CIFAR-10 is at γ=0.5, a brief discussion of why the optimal γ differs across datasets would improve clarity.
  5. Fig. 4: The qualitative examples are referenced but the figure caption does not specify which γ or n values are used beyond 'the representative default attack setting.' Stating the exact configuration in the caption would aid reproducibility.
  6. §4.3, Eq. (7): The min-max normalization maps extracted values to [0,1], but the paper does not discuss how this interacts with the original pixel value distribution. If the original image has a narrow intensity range, the normalization could amplify noise. A brief note on this would be helpful.

Circularity Check

0 steps flagged

No significant circularity; the encoding–aggregation–recovery chain is not tautological, and the load-bearing CVEA foundation is an external citation.

full rationale

The paper's derivation chain has three stages: (1) local encoding via a Pearson-correlation regularizer (Eq. 2) that pushes carrier parameters toward alignment with training data during optimization, (2) segmented aggregation (Eq. 5) that preserves carrier parameters from target clients while averaging the rest, and (3) server-side extraction (Eq. 6) and min-max normalization + reshaping (Eq. 7). None of these stages reduce to their inputs by construction in a way that would constitute circularity. The encoding step is a genuine optimization process whose success is not guaranteed — the correlation regularizer biases the trajectory, but actual recovery quality depends on training dynamics, model capacity, non-IID data, and stochasticity. The MAPE metric (Eq. 9) measures the real gap between recovered and original images. Segmented aggregation does preserve carrier values by construction (Eq. 5), but this is explicitly presented as a design choice, not as a derived result or prediction. The extraction (Eq. 6) uses the same index mapping as encoding, which is a necessary protocol consistency requirement, not a circular argument — the index mapping is not a fitted parameter being passed off as a prediction. The load-bearing technical foundation is CVEA from Song et al. [30], which is an external citation (no author overlap). There is a self-citation to Naseem et al. [26] (same authors: Li, Zhang, Luo), but it refers to CMA, a different attack in a gray-box setting, and is not load-bearing for FedCVESA's core mechanism. The concerns raised by the skeptic (MAPE being pixel-wise, lack of semantic metrics, dispersed-vs-contiguous trade-off) are correctness and evaluation-quality concerns, not circularity. Score 2 reflects the minor self-citation to [26] which is non-load-bearing.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 0 invented entities

The paper does not invent new entities. It introduces a new attack method (FedCVESA) and a new aggregation strategy (segmented aggregation), but these are techniques, not new physical or mathematical objects. The free parameters are standard experimental variables.

free parameters (3)
  • gamma (attack strength) = 0.05, 0.2, 0.5, 1.0
    The attack strength coefficient gamma is varied across experiments to study the trade-off between stealing quality and main-task utility.
  • n (number of target clients) = 1, 2, 3, 4, 5, 10
    The number of target clients is varied to evaluate the scalability of the attack.
  • T (total number of carrier parameters) = CHW or qCHW
    The number of carrier parameters is determined by the size and number of images to be stolen, set to match the payload size.
axioms (3)
  • domain assumption The malicious server has white-box access to the model parameters and can inspect individual client updates before aggregation.
    This is a standard assumption in white-box FL attack literature, but it is a necessary condition for the segmented aggregation in Eq. 5 to work.
  • domain assumption Neural networks have sufficient capacity to memorize training data in their parameters without severely degrading main-task performance.
    This assumption underlies all TATD attacks and is inherited from prior work like Song et al. [30].
  • domain assumption Standard federated averaging would overwrite the encoded carrier parameters if not protected by segmented aggregation.
    This is a core motivation for the proposed segmented aggregation method, supported by the conceptual argument that non-target client updates would dilute the encoded signal.

pith-pipeline@v1.1.0-glm · 14181 in / 2169 out tokens · 303711 ms · 2026-07-09T14:21:41.314625+00:00 · methodology

0 comments
read the original abstract

Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data. However, this memorization-based threat has not been systematically studied under FL environments, where multi-client averaging could overwrite encoded training data. In this paper, we study a white-box TATD attack in which a malicious server selects n target clients from K participating clients and actively writes private training data into the global model during federated training. We propose FedCVESA, a federated variant of Correlation Value Encoding Attack (CVEA), by adding a Pearson-correlation regularizer to the loss function of target clients, so that private training data are gradually encoded into selected model parameters, referred to as carrier parameters. To reduce the overwriting of carrier parameters during server aggregation, we further propose segmented aggregation over dispersed carrier parameters, preserving selected carrier parameters while keeping standard averaging on the remaining parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images from the trained model while maintaining acceptable main-task utility in a controlled proof-of-concept setting. These results demonstrate that FL can become a parameter-level memorization channel for active TATD attack under the studied white-box malicious-server setting.

Figures

Figures reproduced from arXiv: 2607.07314 by Bang Zhang, Chongkai Li, Wenjian Luo.

Figure 1
Figure 1. Figure 1: Overall pipeline of the proposed white-box TATD attack in federated learning under a malicious server targeting n clients selected from K participating clients. wt to these K participating clients. Each participating client performs local op￾timization on its private dataset and uploads an updated local parameter vector w k t . The server then aggregates these updates to obtain wt+1. A malicious server sel… view at source ↗
Figure 2
Figure 2. Figure 2: Segmented aggregation with dispersed carrier parameters. Logical segments are assigned to target clients, but the carrier parameters are globally scattered in the parameter vector. For a single training image with preprocessed shape C × H × W, we set |Ωc| = S = CHW and recover the image by min–max normalization [11] and reshaping: xˆc = Reshape(Norm(zc), C, H, W), Norm(zc)i = zc,i − min(zc) max(zc) − min(z… view at source ↗
Figure 3
Figure 3. Figure 3: Attack-strength scan under Dirichlet non-IID partitions with five target clients and one training image per client. Main-task utility is shown by final accuracy, with the no-attack baseline indicated by the dashed line, while stealing quality is measured by MAPE. where ϵ = 10−8 is a small constant used to avoid division by zero for near-black pixels. For the no-attack baseline (γ = 0), MAPE is not reported… view at source ↗
Figure 4
Figure 4. Figure 4: Qualitative recovery examples under the representative Dirichlet non-IID set￾ting with γ = 0.5, n = 5 target clients, one training image per target client, segmented aggregation, and dispersed placement. For each dataset, the first row shows original private training images and the second row shows the corresponding images recovered from the trained global model. CIFAR-10 with ResNet18 also shows a stable … view at source ↗
Figure 5
Figure 5. Figure 5: Effect of target-client scale under Dirichlet non-IID partitions with γ = 0.5 and one training image per client. Main-task utility is shown by final accuracy, with the no-attack baseline indicated by the dashed line, while stealing quality is measured by MAPE. plots final accuracy together with the no-attack baseline and MAPE against the number of target clients n. For MNIST and Fashion-MNIST, varying n ha… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

44 extracted references · 44 canonical work pages · 3 internal anchors

  1. [1]

    In: Proceedings of the 23rd International Conference on Artifi- cial Intelligence and Statistics

    Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., Shmatikov, V.: How to backdoor federated learning. In: Proceedings of the 23rd International Conference on Artifi- cial Intelligence and Statistics. pp. 2938–2948 (2020)

    work page 2020

  2. [2]

    In: Proceedings of the 36th International Conference on Machine Learning

    Bhagoji, A.N., Chakraborty, S., Mittal, P., Calo, S.: Analyzing federated learning through an adversarial lens. In: Proceedings of the 36th International Conference on Machine Learning. pp. 634–643 (2019)

    work page 2019

  3. [3]

    In: 2023 IEEE European Symposium on Security and Privacy

    Boenisch, F., Dziedzic, A., Schuster, R., Shamsabadi, A., Shumailov, I., Papernot, N.: When the curious abandon honesty: Federated learning is not private. In: 2023 IEEE European Symposium on Security and Privacy. pp. 175–199 (2023)

    work page 2023

  4. [4]

    In: Proceedings of the 2017 ACM SIGSAC Conference on Com- puter and Communications Security

    Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H.B., Patel, S., Ramage,D.,Segal,A.,Seth,K.:Practicalsecureaggregationforprivacy-preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Com- puter and Communications Security. pp. 1175–1191 (2017)

    work page 2017

  5. [5]

    In: 28th USENIX Security Symposium

    Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., Song, D.: The secret sharer: Evalu- ating and testing unintended memorization in neural networks. In: 28th USENIX Security Symposium. pp. 267–284 (2019)

    work page 2019

  6. [6]

    In: 30th USENIX Security Symposium

    Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, Ú., Oprea, A., Raffel, C.: Extracting training data from large language models. In: 30th USENIX Security Symposium. pp. 2633–2650 (2021)

    work page 2021

  7. [7]

    In: 29th USENIX Security Symposium

    Fang, M., Cao, X., Jia, J., Gong, N.Z.: Local model poisoning attacks to Byzantine- robust federated learning. In: 29th USENIX Security Symposium. pp. 1605–1622 (2020)

    work page 2020

  8. [8]

    In: International Conference on Learning Representations (2022)

    Fowl, L., Geiping, J., Czaja, W., Goldblum, M., Goldstein, T.: Robbing the Fed: Directly obtaining private data in federated learning with modified models. In: International Conference on Learning Representations (2022)

    work page 2022

  9. [9]

    In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

    Fredrikson, M., Jha, S., Ristenpart, T.: Model inversion attacks that exploit con- fidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. pp. 1322–1333 (2015). https://doi.org/10.1145/2810103.2813677 FedCVESA for TATD in FL 15

    work page doi:10.1145/2810103.2813677 2015

  10. [10]

    Geiping, J., Bauermeister, H., Dröge, H., Moeller, M.: Inverting gradients: How easyisittobreakprivacyinfederatedlearning?In:AdvancesinNeuralInformation Processing Systems. vol. 33 (2020)

    work page 2020

  11. [11]

    Elsevier, 3 edn

    Han, J., Kamber, M., Pei, J.: Data Mining: Concepts and Techniques. Elsevier, 3 edn. (2011)

    work page 2011

  12. [12]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 770–778 (2016)

    work page 2016

  13. [13]

    Hitaj, B., Ateniese, G., Pérez-Cruz, F.: Deep models under the GAN: Information leakagefromcollaborativedeeplearning.In:Proceedingsofthe2017ACMSIGSAC Conference on Computer and Communications Security. pp. 603–618 (2017)

    work page 2017

  14. [14]

    In: Proceedings of the NeurIPS Workshop on Federated Learning for Data Privacy and Confidentiality (2019)

    Hsu, T.M.H., Qi, H., Brown, M.: Measuring the effects of non-identical data distri- bution for federated visual classification. In: Proceedings of the NeurIPS Workshop on Federated Learning for Data Privacy and Confidentiality (2019)

    work page 2019

  15. [15]

    In: Advances in Neural Information Processing Systems

    Jeon, J., Lee, K., Oh, S., Ok, J.: Gradient inversion with generative image prior. In: Advances in Neural Information Processing Systems. vol. 34, pp. 29898–29908 (2021)

    work page 2021

  16. [16]

    Foundations and Trends in Machine Learning 14(1–2), 1–210 (2021)

    Kairouz, P., McMahan, H.B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A.N., Bonawitz, K.A., Charles, Z., Cormode, G., Cummings, R., et al.: Advances and open problems in federated learning. Foundations and Trends in Machine Learning 14(1–2), 1–210 (2021)

    work page 2021

  17. [17]

    In: Proceedings of the 40th International Conference on Machine Learning

    Kariyappa, S., Guo, C., Maeng, K., Xiong, W., Su, G., Qureshi, M.K., Lee, H.H.S.: Cocktail Party Attack: Breaking aggregation-based privacy in federated learning using independent component analysis. In: Proceedings of the 40th International Conference on Machine Learning. pp. 15884–15899 (2023)

    work page 2023

  18. [18]

    Krizhevsky, A.: Learning multiple layers of features from tiny images. Tech. rep., University of Toronto (2009)

    work page 2009

  19. [19]

    Proceedings of the IEEE86(11), 2278–2324 (1998)

    LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. Proceedings of the IEEE86(11), 2278–2324 (1998)

    work page 1998

  20. [20]

    IEEE Signal Processing Magazine37(3), 50–60 (2020)

    Li, T., Sahu, A.K., Talwalkar, A., Smith, V.: Federated learning: Challenges, meth- ods, and future directions. IEEE Signal Processing Magazine37(3), 50–60 (2020)

    work page 2020

  21. [21]

    IEEE Transac- tions on Emerging Topics in Computational Intelligence6(6), 1427–1437 (2022)

    Luo, W., Zhang, L., Han, P., Liu, C., Zhuang, R.: Taking away both model and data: Remember training data by parameter combinations. IEEE Transac- tions on Emerging Topics in Computational Intelligence6(6), 1427–1437 (2022). https://doi.org/10.1109/TETCI.2022.3182415

    work page doi:10.1109/tetci.2022.3182415 2022

  22. [22]

    IEEE Transactions on Artificial Intelligence5(2), 814–826 (2024)

    Luo, W., Zhang, L., Wu, Y., Liu, C., Han, P., Zhuang, R.: Capacity Abuse Attack of deep learning models without need of label encodings. IEEE Transactions on Artificial Intelligence5(2), 814–826 (2024)

    work page 2024

  23. [23]

    In: Proceedings of the 40th International Conference on Machine Learning

    Marchand, T., Loeb, R., Marteau-Ferey, U., Ogier Du Terrail, J., Pignet, A.: SRATTA: Sample re-attribution attack of secure aggregation in federated learn- ing. In: Proceedings of the 40th International Conference on Machine Learning. pp. 23886–23914 (2023)

    work page 2023

  24. [24]

    In: Proceedings of the 20th International Conference on Artificial Intelligence and Statistics

    McMahan, H.B., Moore, E., Ramage, D., Hampson, S., Arcas, B.A.y.: Communication-efficient learning of deep networks from decentralized data. In: Proceedings of the 20th International Conference on Artificial Intelligence and Statistics. pp. 1273–1282 (2017)

    work page 2017

  25. [25]

    In: 2019 IEEE Symposium on Security and Privacy

    Melis, L., Song, C., De Cristofaro, E., Shmatikov, V.: Exploiting unintended fea- ture leakage in collaborative learning. In: 2019 IEEE Symposium on Security and Privacy. pp. 691–706 (2019) 16 C. Li et al

    work page 2019

  26. [26]

    Applied Soft Computing199, 115320 (2026)

    Naseem, M.L., Li, C., Zhang, B., Luo, W.: Taking away training data by confidences. Applied Soft Computing199, 115320 (2026). https://doi.org/10.1016/j.asoc.2026.115320

    work page doi:10.1016/j.asoc.2026.115320 2026

  27. [27]

    In: 2019 IEEE Symposium on Security and Privacy

    Nasr, M., Shokri, R., Houmansadr, A.: Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In: 2019 IEEE Symposium on Security and Privacy. pp. 739– 753 (2019)

    work page 2019

  28. [28]

    In: Advances in Neural Information Processing Systems

    Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., Desmaison, A., Köpf, A., Yang, E., DeVito, Z., Raison, M., Tejani, A., Chilamkurthy, S., Steiner, B., Fang, L., Bai, J., Chin- tala, S.: PyTorch: An imperative style, high-performance deep learning library. In: Advances in Neural Inform...

    work page 2019

  29. [29]

    In: 2017 IEEE Symposium on Security and Pri- vacy

    Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Pri- vacy. pp. 3–18 (2017). https://doi.org/10.1109/SP.2017.41

    work page doi:10.1109/sp.2017.41 2017

  30. [30]

    In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

    Song, C., Ristenpart, T., Shmatikov, V.: Machine learning models that remember too much. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 587–601 (2017)

    work page 2017

  31. [31]

    Sun, Z., Kairouz, P., Suresh, A.T., McMahan, H.B.: Can you really backdoor fed- erated learning? CoRRabs/1911.07963(2019)

    work page internal anchor Pith review Pith/arXiv arXiv 1911

  32. [32]

    In: Proceedings of the 40th International Conference on Machine Learning

    Vero, M., Balunovic, M., Dimitrov, D.I., Vechev, M.: TabLeak: Tabular data leak- age in federated learning. In: Proceedings of the 40th International Conference on Machine Learning. pp. 35051–35083 (2023)

    work page 2023

  33. [33]

    In: Advances in Neural Information Processing Systems

    Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.y., Lee, K., Papailiopoulos, D.: Attack of the tails: Yes, you really can backdoor fed- erated learning. In: Advances in Neural Information Processing Systems. vol. 33, pp. 16070–16084 (2020)

    work page 2020

  34. [34]

    In: Computer Security – ESORICS 2020

    Wei, K., Li, J., Ding, M., Ma, C., Yang, H.H., Farokhi, F., Jin, S., Quek, T.Q.S., Poor, H.V.: A framework for evaluating client privacy leakages in federated learn- ing. In: Computer Security – ESORICS 2020. pp. 545–566 (2020)

    work page 2020

  35. [35]

    In: Proceedings of the 39th International Conference on Machine Learning

    Wen, Y., Geiping, J., Fowl, L., Goldblum, M., Goldstein, T.: Fishing for user data in large-batch federated learning via gradient magnification. In: Proceedings of the 39th International Conference on Machine Learning. pp. 23668–23684 (2022)

    work page 2022

  36. [36]

    Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms

    Xiao, H., Rasul, K., Vollgraf, R.: Fashion-MNIST: A novel image dataset for bench- marking machine learning algorithms. CoRRabs/1708.07747(2017)

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  37. [37]

    In: International Conference on Learning Represen- tations (2020)

    Xie, C., Huang, K., Chen, P.Y., Li, B.: DBA: Distributed backdoor attacks against federated learning. In: International Conference on Learning Represen- tations (2020)

    work page 2020

  38. [38]

    ACM Transactions on Intelligent Systems and Technology10(2), 1– 19 (2019)

    Yang, Q., Liu, Y., Chen, T., Tong, Y.: Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology10(2), 1– 19 (2019)

    work page 2019

  39. [39]

    In: 2022 4th In- ternational Conference on Data Intelligence and Security

    Yang, X., Luo, W., Zhang, L., Chen, Z., Wang, J.: Data leakage attack via backdoor misclassification triggers of deep learning models. In: 2022 4th In- ternational Conference on Data Intelligence and Security. pp. 61–66 (2022). https://doi.org/10.1109/ICDIS55630.2022.00017

    work page doi:10.1109/icdis55630.2022.00017 2022

  40. [40]

    In: 2023 IEEE Symposium Series on Computational Intelligence

    Yang, X., Luo, W., Zhou, Q., Chen, Z.: Training data leakage via imperceptible backdoor attack. In: 2023 IEEE Symposium Series on Computational Intelligence. pp. 1553–1559 (2023)

    work page 2023

  41. [41]

    In: Proceedings of the FedCVESA for TATD in FL 17 IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Yin, H., Mallya, A., Vahdat, A., Alvarez, J.M., Kautz, J., Molchanov, P.: See through gradients: Image batch recovery via GradInversion. In: Proceedings of the FedCVESA for TATD in FL 17 IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 16337– 16346 (2021)

    work page 2021

  42. [42]

    In: Proceedings of the 39th International Conference on Machine Learning

    Zhang, Z., Panda, A., Song, L., Yang, Y., Mahoney, M., Mittal, P., Kannan, R., Gonzalez, J.: Neurotoxin: Durable backdoors in federated learning. In: Proceedings of the 39th International Conference on Machine Learning. pp. 26429–26446 (2022)

    work page 2022

  43. [43]

    iDLG: Improved Deep Leakage from Gradients

    Zhao, B., Mopuri, K.R., Bilen, H.: iDLG: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610 (2020)

    work page internal anchor Pith review Pith/arXiv arXiv 2001

  44. [44]

    Advances in Neural Infor- mation Processing Systems32(2019)

    Zhu, L., Liu, Z., Han, S.: Deep leakage from gradients. Advances in Neural Infor- mation Processing Systems32(2019)

    work page 2019