Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learning

Andr\'e Nusser; Chuan Xu; Francesco Diana; Giovanni Neglia

REVIEW 4 major objections 5 minor 39 references

Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A malicious server in federated learning can craft model parameters so that, after enough FedSGD rounds, every sample in a client's batch is recovered exactly, without any prior knowledge of the data.

desk verdict Novel hyperplane-sweep attack idea, but Algorithm 1 as written forces zero gradients, so the central claim is unsupported by the paper's own method section. read the letter →

arxiv 2505.10264 v2 pith:7RA2ROUC submitted 2025-05-15 cs.LG cs.AIcs.CR

Francesco Diana , André Nusser , Chuan Xu , Giovanni Neglia This is my paper · ORCID

classification cs.LGcs.AIcs.CR

keywords federatedlearningdatareconstructionattackgradientinversionmaliciousserverhyperplaneseparationFedSGDtabularprivacyleakage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning promises that raw client data never leaves the device, but this paper argues the promise can be broken completely: a malicious server can modify model parameters so that, after a number of federated SGD rounds, it recovers every single training sample in a client's batch. The method works for classification tasks on any input dimensionality, including tabular data, and its experiments report exact recovery of batches up to 4,096 points, roughly two orders of magnitude larger than previous attacks manage. The reason it scales is geometric: the server sweeps a hyperplane through the input space by changing a neuron's bias and uses the equality of aggregate gradients to tell exactly when a strip between two hyperplanes contains one input, then strips the batch apart one point at a time. If the central claim holds, any full-batch FedSGD client that trusts the server's parameters is exposed, and secure aggregation alone does not fix the problem because the server still sees aggregate gradients.

What carries the argument

The load-bearing object is the strip-isolation identity from the per-sample gradient formula: for a fully connected ReLU layer, $\partial L_j/\partial W_i = (\partial L_j/\partial b_i)\,x_j$, so an input can be reconstructed as $x_j = (\partial L_j/\partial W_i)(\partial L_j/\partial b_i)^{-1}$ whenever exactly one sample activates neuron $i$. With a batch, the server instead sees a weighted mixture $g_i=\sum_j \alpha_j x_j$, where $\alpha_j = (\partial L_j/\partial b_i)/(\sum_k \partial L_k/\partial b_i)$. The attack converts this mixture into exact recovery by (i) making $\alpha_j$ independent of the neuron's bias through the near-uniform softmax, (ii) sweeping biases to move a hyperplane and detecting whether any input lies in the strip between two positions by checking whether $g_k$ changes, and (iii) peeling off inputs one by one with Eq. (8), which computes the next unknown input as the leftover of the aggregate gradient after the previously recovered inputs are subtracted. Once the first sample is isolated and reconstructed, each additional sample is a residual computation rather than a fresh search.

What would settle it

Measure the per-sample derivative $\partial L_j/\partial b_i^{(1)}$ directly as $b_i^{(1)}$ is translated but the neuron stays active, with the second-layer biases set to the paper's finite value (1025); if the derivative varies by more than the amount that makes $g_k$ and $g_{k+1}$ indistinguishable under the client's floating-point arithmetic, then the isolation test has no margin and the claimed exact recovery of arbitrary batches is false. A simpler variant: add tiny numerical noise to the client's gradient updates and check whether the equality $g_k=g_{k+1}$ still detects 'no input in strip' correctly at the largest reported batch sizes.

Watch

Extended reading notes

Core claim

The central claim is that a malicious server can control each data point's contribution to the client's aggregate gradient and use that control to cut a batch into single points. The server sets all rows of the first-layer weight matrix to the same random direction $w$ and chooses a sequence of bias values, which translates one hyperplane $w^\mathsf{T}x+b=0$ through input space. Whenever no input lies between two consecutive hyperplanes, the observed gradient combination $g_k=\sum_j \alpha_{j,k}x_j$ (Eq. 5) is unchanged; whenever an input lies in between, $g_k$ changes. The server binary-searches the bias axis until strips are narrow enough to contain exactly one input, then reconstructs inputs sequentially: Eq. (7) recovers each newly activated sample's derivative from the change in the aggregate bias gradient, and Eq. (8) subtracts the already-recovered inputs' known contributions from $g_{k+1}$. Assumption 4.1 --- that each per-sample derivative $\partial L_j/\partial b_i^{(1)}$ is constant while the neuron is active --- is engineered by setting second-layer biases large enough that the softmax is nearly uniform, making the derivative independent of the first-layer bias; identical columns in the second-layer weight matrix make the coefficients uniform across neurons, allowing all $N$ neurons to be searched in parallel.

Load-bearing premise

The attack's perfect-recovery guarantee rests on Assumption 4.1: that each sample's derivative $\partial L_j/\partial b_i^{(1)}$ stays exactly constant for every bias value while that sample keeps the neuron active, and that the resulting equality $g_k=g_{k+1}$ holds with no tolerance; if that derivative drifts or numerical noise breaks the equality, the sequential reconstruction of Eq. (8) accumulates error and perfect recovery no longer follows.

Editorial extensions

If this is right

A full-batch FedSGD client in a classification task has no protection against a malicious server: every sample in a batch of thousands can be reconstructed exactly once enough rounds have been run.
Reconstruction requires no prior knowledge of the data distribution and no auxiliary dataset; the only client-side information assumed is a bound on the range of preprocessed features.
Sparsity-based attacks cannot be patched by scaling up the network: on random inputs the expected number of samples any isolation-based attack can recover grows only as $O(n^{(d-1)/(d+1)})$ (ball), $O(\log^{d-1} n)$ (hypercube), or $O(\log^{(d-1)/2} n)$ (normal), so the success fraction tends to zero as batch size grows.
Secure aggregation is not a sufficient defense: the server still receives the aggregate gradient over the union of clients' datasets, so with enough rounds it can recover the underlying data, though without assigning points to specific clients.
Local differential privacy is the only defense the paper identifies; adding client-side noise reduces but does not eliminate reconstruction, and the attack still beats the baseline under the tested noise levels.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the same machinery applies to any linear layer whose activation mask can be controlled, so a full-batch attack on the first fully connected layer of a CNN is plausible; the paper shows approximate recovery through feature maps for a CNN, not exact end-to-end recovery.
Editorial inference: the equality test $g_k=g_{k+1}$ has no stated tolerance, so real-world robustness depends on floating-point precision and the absence of any noise in updates; the paper's single-precision experiments fail to fully recover the largest batches, which suggests numerical error is a genuine ceiling.
Editorial inference: a defender could look for the fingerprints of this attack --- all first-layer rows identical, all second-layer columns identical, and unusually large second-layer biases --- and reject such models, although the paper does not discuss client-side verification.
Editorial inference: the round-complexity analysis depends on the minimum pairwise distance $\Delta$ among the unknown inputs, so batches containing near-duplicates or inputs with nearly identical projections along the swept direction will require many more rounds or a much smaller threshold, a testable limitation not covered by the reported experiments.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things you should know about arXiv:2505.10264. The hyperplane-sweep attack is a genuinely new idea, and the experiments are ambitious. But the algorithm as printed cannot work. Algorithm 1 sets every column of W^(2) to the same vector v and every entry of b^(2) to the same large constant. Under that configuration, all output logits are equal for any input, the softmax is uniform, and the cross-entropy loss is constant. Every first-layer gradient is exactly zero, so Eqs. (5)–(8) have no input and the reconstruction is undefined. This is not numerical noise; it is an exact cancellation. The experiments in Appendix E use W^(2) columns drawn independently from N(0, 10^-2), not identical columns, and that configuration does not collapse. The paper never acknowledges the mismatch, and its central claim is therefore not supported by the method section as written.

What I liked: the convex hull upper bound (Theorem 3.1) is a clean, useful result that explains why sparsity-based attacks degrade with batch size and dimension. The sequential reconstruction from gradient-difference coefficients is clever, and the empirical performance on tabular data with batches of 4096 is striking if it holds. The authors ship code and state Assumption 4.1 plainly, which is credit where due.

The soft spots: the zero-gradient collapse is load-bearing. Beyond that, Assumption 4.1 is only approximate via a near-uniform softmax; the equality test g_k = g_{k+1} needs a tolerance under floating-point error and none is given. The round bound in App. D depends on the minimum pairwise distance Delta of the unknown data, which the attacker does not know; the experiments sidestep this by just using as many bias values as the round budget allows. The claims about no prior knowledge and a non-adaptive threshold are overstated. The fix is straightforward: use non-identical W^(2) columns, as in the experiments, and re-derive the parallel-search condition. But as published, the main algorithm and the evidence are in different configurations.

Who this is for: FL security and privacy researchers, especially those working on malicious-server models. Should it be peer reviewed? Yes, in the sense that a serious referee should look at it, because the idea is novel and the experiments, if reproducible, matter. But my recommendation is to reject the current version: the central method section contradicts itself, and the authors need to rewrite Algorithm 1 and resubmit. I would not cite the attack as valid in its current form.

Referee Report

4 major / 5 minor

Summary. The paper proposes a malicious-server data reconstruction attack for federated learning. The server crafts a two-layer fully connected network in which all rows of the first-layer weight matrix are identical (a single random hyperplane direction w), all columns of the second-layer weight matrix are identical (a vector v), and the second-layer biases are set to a common large value. By translating the first-layer hyperplane through a sequence of bias values over communication rounds, the server attempts to isolate individual samples of a client's full batch inside thin strips and then reconstruct each sample from aggregate gradient information using equations (5)-(8). The paper claims perfect recovery of arbitrarily large batches (up to 4096 samples in experiments) on image and tabular datasets, and also provides a theoretical upper bound on the success of sparsity-based attacks (Theorem 3.1).

Significance. If the attack worked as stated, it would be a substantial advance over existing reconstruction attacks: it removes the batch-size bottleneck, works on low-dimensional tabular data without auxiliary data or distributional assumptions, and gives a clean geometric interpretation. The paper ships code, reports extensive experiments on ImageNet, HARUS, and CIFAR-10, and provides a novel analytical bound for sparsity-based attacks. The significance is, however, contingent on the correctness of the gradient-constancy assumption (Assumption 4.1) and on the claimed perfect-recovery guarantee being supported by the theoretical derivations.

major comments (4)

[Sec. 4.3, Eq. (10)] The justification of Assumption 4.1 is mathematically incorrect. When all entries of b^(2) are equal (as set in Algorithm 1, line 4), the softmax probabilities are p_k = exp(v_k s) / sum_c exp(v_c s), where s = sum_i z^(1)_i. This expression is exactly invariant to the magnitude of b^(2), because adding a constant to all logits cancels in the softmax. Therefore the claim that setting large second-layer biases makes p_k approximately 1/|C| is false. Consequently, the derivative in Eq. (9) generally depends on the input x and on b^(1)_i through s, so Assumption 4.1 is not established. Without Assumption 4.1, the isolation criterion g_k = g_{k+1} and the reconstruction formulas (7) and (8) lack a valid basis.
[Alg. 1 line 3 + Sec. 4.3] I examined the zero-gradient concern raised during review and it does not land as stated. Setting each column of W^(2) to the same vector v does not make all logits equal unless all entries of v are equal; with general v, z^(2)_k = v_k s + b^(2)_k and the derivative in Eq. (9) is -v_{y_j} + sum_k v_k p_k, which is generically nonzero. The true tension is different: making the softmax exactly uniform forces v to be constant, which indeed makes all first-layer gradients vanish. The paper's proposed escape, namely a large common b^(2), is the same error as in Eq. (10). Thus the paper has not shown that nonzero gradients and exact constancy of the per-sample coefficients alpha_j can be achieved simultaneously, which is a load-bearing gap.
[Alg. 2, line 4] The isolation test uses the exact condition g_i != g_{i-1}. No numerical tolerance is defined in the main algorithm, and no error propagation analysis is provided. Any residual violation of Assumption 4.1, or rounding in the aggregate gradients, will make the equality test unreliable. The local-steps experiments in App. F introduce an ad-hoc projection threshold of 10^-4, but the main attack is claimed to work without such a threshold. The paper should either provide a tolerance with a correctness bound or present a robust test with a defensible threshold.
[App. D and App. E] The theoretical round-complexity bound and the threshold epsilon are not connected to the experimental procedure. Eq. (27) sets epsilon proportional to Delta, the minimum pairwise distance of the unknown client inputs, which the attacker cannot know. Moreover, App. E states explicitly that no value of epsilon was used in the experiments; instead, the attack consumes all T available rounds. This means the claimed O(log n / N) round bound is not validated by the experiments, and the perfect-recovery guarantee lacks an implementable configuration rule for epsilon in practice.

minor comments (5)

[App. D, Eq. (20)] For v ~ N(0, I_d), the variance of the inner product <x_i - x_j, v> is ||x_i - x_j||^2, not ||x_i - x_j||. The subsequent probability calculation should use the corrected standard deviation.
[Abstract] The phrase 'two orders of magnitude larger than the state of the art' overstates the reported results: the baselines fail around batch size 64, while the proposed attack is demonstrated up to 4096, which is a factor of 64, not 100.
[Sec. 4.3, after Eq. (9)] The notation w^(2)_{y_j,i} is ambiguous because W^(2) is defined as having identical columns; please make explicit that w^(2)_{k,i} = v_k for all i.
[Sec. 3, Theorem 3.1] The Gaussian case bound O(log^{(d-1)/2} n) is stated without a derivation or a precise citation; the cited reference (Raynaud 1970) is standard for the uniform-ball case. Please either add a formal argument or adjust the statement to match the source.
[Sec. 5] The paper calls the outcome 'perfect reconstruction' while the evaluation uses threshold-based criteria (SSIM >= 0.99 for images, L2 norm < 0.1 for tabular). Clarify whether the theoretical guarantee is meant to be exact recovery or recovery to within these tolerances, and state how the experimental thresholds relate to the theoretical claims.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: derivation is self-contained; Algorithm 1's zero-gradient configuration is a soundness bug, not a circular step.

full rationale

The reconstruction derivation is not circular. Equations (5)-(8) follow algebraically from the chain-rule identities (3)-(4) together with Assumption 4.1; the attack is a constructive algorithm rather than a fitted model, and the claimed recovery is not a quantity that was fitted to the data being 'predicted'. Theorem 3.1 is supported by independent published convex-hull bounds (Raynaud 1970; Bentley et al. 1978), not by the authors' own prior results. The only self-citation, Diana et al. 2025, appears in related-work context and is not load-bearing. The dependence of the round-complexity bound on the unknown minimum pairwise distance Δ in App. D is an explicitly stated assumption, not a circular reuse of the target result. I do flag a serious internal-consistency problem that is not circularity: Algorithm 1 lines 3-4 set every row of W^(1) to the same vector, every column of W^(2) to the same vector, and all entries of b^(2) to the same large value; then all logits are equal, the softmax is exactly uniform, ∂Lj/∂b_i^(1) = v_i(-1 + Σ_k p_k) = 0, and Eq. (5) becomes undefined. The appendix experiments use independently sampled W^(2) columns, so the reported experiments do not instantiate the main-text algorithm. This undermines the demonstrated claim but does not make the derivation circular, so it does not raise the circularity score.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The attack depends on a small set of attacker-chosen hyperparameters (interval width, threshold, bias magnitudes, layer width) and on several domain assumptions (FedSGD full-batch, known feature ranges, absence of secure aggregation and client-side noise). Assumption 4.1 is the most fragile: the constancy of per-sample derivatives is only approximate and is not given an error bound. No invented entities are introduced; the paper is an attack construction, not a new physical theory.

free parameters (6)

bias search interval [l1,u1] = derived from feature preprocessing bounds
Initial interval width W determines resolution; server must know data range.
isolation threshold epsilon = not set in main experiments; suggested as sqrt(2*pi)*Delta/(n^2*delta)
Controls when two hyperplanes are considered to separate a point; depends on unknown minimum distance Delta.
second-layer bias magnitude b^(2) = 1025
Chosen to make softmax nearly uniform so per-sample derivatives are roughly constant.
number of first-layer neurons N = 1000
Attack layer width; larger N speeds up parallel search and improves reconstruction.
scale of malicious weights W^(1), W^(2) = N(0,1e-2)
Arbitrary initialization; authors note other distributions work.
probability parameter delta in round bound = not instantiated
App. D's epsilon and complexity guarantee are stated up to 1-delta; experiments do not set delta.

assumptions (6)

domain assumption Assumption 4.1: per-sample derivative dL_j/db_i is independent of b_i for all tested bias values while the neuron is active.
Load-bearing for comparing g_k across rounds and for the sequential reconstruction in Eq. (8); only approximately satisfied by a near-uniform softmax.
domain assumption Client uses FedSGD with full-batch updates.
The attack's gradient comparisons require the update to be the full-batch gradient; multi-local-step setting is only partially handled in App. F.
domain assumption Server knows bounds on feature ranges after preprocessing.
Needed to set [l1,u1]; contradicts the abstract's 'without any prior knowledge' phrasing.
domain assumption No secure aggregation or client-side differential privacy in the main threat model.
Secure aggregation and LDP are discussed only as defenses, not evaluated in the main attack.
domain assumption First layer uses ReLU and loss is cross-entropy.
The reconstruction equations (2)-(10) rely on ReLU sparsity and softmax gradient form.
standard math Convex hull vertex count bounds for random points (Raynaud 1970, Bentley 1978).
Theorem 3.1 applies these known bounds; they are accepted mathematical results, not derived in the paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learning." pith.science (2026). https://pith.science/paper/7RA2ROUC

@misc{pith2026250510264,
  author       = {Pith},
  title        = {Pith review of: Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7RA2ROUC}},
  note         = {Machine review of arXiv:2505.10264}
}

read the original abstract

Federated Learning (FL) enables collaborative training of machine learning models across distributed clients without sharing raw data, ostensibly preserving data privacy. Nevertheless, recent studies have revealed critical vulnerabilities in FL, showing that a malicious central server can manipulate model updates to reconstruct clients' private training data. Existing data reconstruction attacks have important limitations: they often rely on assumptions about the clients' data distribution or their efficiency significantly degrades when batch sizes exceed just a few tens of samples. In this work, we introduce a novel data reconstruction attack that overcomes these limitations. Our method leverages a new geometric perspective on fully connected layers to craft malicious model parameters, enabling the perfect recovery of arbitrarily large data batches in classification tasks without any prior knowledge of clients' data. Through extensive experiments on both image and tabular datasets, we demonstrate that our attack outperforms existing methods and achieves perfect reconstruction of data batches two orders of magnitude larger than the state of the art.

Figures

Figures reproduced from arXiv: 2505.10264 by the authors.

**Figure 2.** The percentage of perfectly reconstructed inputs on ImageNet and HARUS for a two-layer FC NN with [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

**Figure 3.** Difference in the percentage of correctly recon [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: a) Effect of batch size on CIFAR-10 after 20 communication rounds. b) Effect of the number of rounds on [PITH_FULL_IMAGE:figures/full_fig_p016_4.png]

**Figure 5.** Figure 5: Percentage difference in reconstructed inputs on CIFAR-10. Red indicates cases where our attack achieves better [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]

**Figure 6.** Figure 6: The percentage of perfectly reconstructed inputs for a two-layer FC NN with [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

**Figure 7.** Figure 7: The percentage of perfectly reconstructed inputs on for two-layer fully connected neural network with [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]

**Figure 8.** Figure 8: Percentage difference in reconstructed inputs on ImageNet. Red indicates cases where our attack achieves better [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]

**Figure 9.** Figure 9: The recovered images from a batch containing 1024 samples from ImageNet. The first row shows the original [PITH_FULL_IMAGE:figures/full_fig_p021_9.png]

**Figure 10.** Figure 10: The recovered images from a batch containing 1024 samples from ImageNet. [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 22 canonical work pages

[1]

Anguita, Alessandro Ghio, L

D. Anguita, Alessandro Ghio, L. Oneto, Xavier Parra, and Jorge Luis Reyes-Ortiz. A public domain dataset for human activity recognition using smartphones. In The European Symposium on Artificial Neural Networks, 2013. URL https://api.semanticscholar.org/CorpusID:6975432

work page 2013
[2]

Jon Louis Bentley, H. T. Kung, Mario Schkolnick, and Clark D. Thompson. On the average number of maxima in a set of vectors and applications. J. ACM , 25 0 (4): 0 536--543, 1978. doi:10.1145/322092.322095. URL https://doi.org/10.1145/322092.322095

arXiv 1978
[3]

Protection against reconstruction and its applications in private federated learning, 2019

Abhishek Bhowmick, John Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan Rogers. Protection against reconstruction and its applications in private federated learning, 2019. URL https://arxiv.org/pdf/1812.00984

arXiv 2019
[4]

When the curious abandon honesty: Federated learning is not private

Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 175--199, 2023. doi:10.1109/EuroSP57164.2023.00020

arXiv 2023
[5]

Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth

Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. CCS '17, page 1175–1191, New York, NY, USA, 2017. Association for Computing Machinery. ISBN 9781450349468. doi:10.1145/3133956.3133982. URL https...

arXiv 2017
[6]

Caterini, Brendan Leigh Ross, Jesse C Cresswell, and Gabriel Loaiza-Ganem

Bradley CA Brown, Anthony L. Caterini, Brendan Leigh Ross, Jesse C Cresswell, and Gabriel Loaiza-Ganem. Verifying the union of manifolds hypothesis for image data. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=Rvee9CAX4fi

work page 2023
[7]

Practical Attribute Reconstruction Attack Against Federated Learning

Chen Chen, Lingjuan Lyu, Han Yu, and Gang Chen. Practical Attribute Reconstruction Attack Against Federated Learning . IEEE Transactions on Big Data, 10 0 (06): 0 851--863, December 2024. ISSN 2332-7790. doi:10.1109/TBDATA.2022.3159236. URL https://doi.ieeecomputersociety.org/10.1109/TBDATA.2022.3159236

arXiv 2024
[8]

Revisiting distributed synchronous sgd

Jianmin Chen, Rajat Monga, Samy Bengio, and Rafal Jozefowicz. Revisiting distributed synchronous sgd. In International Conference on Learning Representations Workshop Track, 2016. URL https://arxiv.org/abs/1604.00981

arXiv 2016

Show all 39 references

[9]

Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot

Christopher A. Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine L...

1964
[10]

Panning for gold in federated learning: Targeted text extraction under arbitrarily large-scale aggregation

Hong-Min Chu, Jonas Geiping, Liam H Fowl, Micah Goldblum, and Tom Goldstein. Panning for gold in federated learning: Targeted text extraction under arbitrarily large-scale aggregation. In The Eleventh International Conference on Learning Representations, 2023

2023
[11]

Attribute inference attacks for federated regression tasks

Francesco Diana, Othmane Marfoq, Chuan Xu, Giovanni Neglia, Frédéric Giroire, and Eoin Thomas. Attribute inference attacks for federated regression tasks. Proceedings of the AAAI Conference on Artificial Intelligence, 39 0 (15): 0 16271--16279, Apr. 2025. doi:10.1609/aaai.v39i...

2025 doi
[12]

Data leakage in federated averaging

Dimitar Iliev Dimitrov, Mislav Balunovic, Nikola Konstantinov, and Martin Vechev. Data leakage in federated averaging. Transactions on Machine Learning Research, 2022. ISSN 2835-8856. URL https://openreview.net/forum?id=e7A0B99zJf

2022
[13]

SPEAR : Exact gradient inversion of batches in federated learning

Dimitar Iliev Dimitrov, Maximilian Baader, Mark Niklas Mueller, and Martin Vechev. SPEAR : Exact gradient inversion of batches in federated learning. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https://openreview.net/forum?id=lPDxPVS6ix

2024
[14]

Differential privacy

Cynthia Dwork. Differential privacy. In Michele Bugliesi, Bart Preneel, Vladimiro Sassone, and Ingo Wegener, editors, Automata, Languages and Programming, pages 1--12, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg. ISBN 978-3-540-35908-1

2006
[15]

Robbing the fed: Directly obtaining private data in federated learning with modified models

Liam H Fowl, Jonas Geiping, Wojciech Czaja, Micah Goldblum, and Tom Goldstein. Robbing the fed: Directly obtaining private data in federated learning with modified models. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=fwzUgo0FM9v

2022
[16]

Decepticons: Corrupted transformers breach privacy in federated learning for language models

Liam H Fowl, Jonas Geiping, Steven Reich, Yuxin Wen, Wojciech Czaja, Micah Goldblum, and Tom Goldstein. Decepticons: Corrupted transformers breach privacy in federated learning for language models. In The Eleventh International Conference on Learning Representations, 2023

2023
[17]

Hiding in plain sight: Disguising data stealing attacks in federated learning

Kostadin Garov, Dimitar Iliev Dimitrov, Nikola Jovanovi \'c , and Martin Vechev. Hiding in plain sight: Disguising data stealing attacks in federated learning. In The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=krx55l2A6G

2024
[18]

Jonas Geiping, Hartmut Bauermeister, Hannah Dr\" o ge, and Michael Moeller. Inverting gradients - how easy is it to break privacy in federated learning? In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS '20, Red Hook, NY, USA, 2...

2020
[19]

Edward Suh, Moinuddin K Qureshi, and Hsien-Hsin S

Sanjay Kariyappa, Chuan Guo, Kiwan Maeng, Wenjie Xiong, G. Edward Suh, Moinuddin K Qureshi, and Hsien-Hsin S. Lee. Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis. In Andreas Krause, Emma Brunskill, Kyunghyun...

2023
[20]

Learning multiple layers of features from tiny images

Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009. URL https://api.semanticscholar.org/CorpusID:18268744

2009
[21]

April: Finding the achilles' heel on privacy for vision transformers

Jiahao Lu, Xi Sheryl Zhang, Tianli Zhao, Xiangyu He, and Jian Cheng. April: Finding the achilles' heel on privacy for vision transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10051--10060, 2022

2022
[22]

Communication-efficient learning of deep networks from decentralized data

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics, pages 1273--1282. PMLR, 2017

2017
[23]

Exploiting unintended feature leakage in collaborative learning

Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 691--706, 2019. doi:10.1109/SP.2019.00029

2019
[24]

Sample complexity of testing the manifold hypothesis

Hariharan Narayanan and Sanjoy Mitter. Sample complexity of testing the manifold hypothesis. In J. Lafferty, C. Williams, J. Shawe-Taylor, R. Zemel, and A. Culotta, editors, Advances in Neural Information Processing Systems, volume 23. Curran Associates, Inc., 2010. URL https:...

2010
[25]

Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning

Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 739--753, 2019. doi:10.1109/SP.2...

2019
[26]

Eluding secure aggregation in federated learning via model inconsistency

Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. Eluding secure aggregation in federated learning via model inconsistency. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS '22, page 2429–2443, New York, NY, USA, 2022. Associa...

2022
[27]

Paverd and Andrew C

Andrew J. Paverd and Andrew C. Martin. Modelling and automatically analysing privacy properties for honest-but-curious adversaries. 2014. URL https://api.semanticscholar.org/CorpusID:211141069

2014
[28]

Privacy-preserving deep learning: Revisited and enhanced

Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy-preserving deep learning: Revisited and enhanced. In Lynn Batten, Dong Seong Kim, Xuyun Zhang, and Gang Li, editors, Applications and Techniques in Information Security, pages 100--110, Singa...

2017
[29]

The intrinsic dimension of images and its impact on learning

Phil Pope, Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. In International Conference on Learning Representations, 2021. URL https://openreview.net/forum?id=XJk19XzGq2J

2021
[30]

H. Raynaud. Sur l’enveloppe convexe des nuages de points aleatoires dans rn. i. Journal of Applied Probability, 7 0 (1): 0 35–48, 1970. doi:10.2307/3212146

1970 doi
[31]

Berg, and Li Fei-Fei

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115...

2015 doi
[32]

Dimitrov, and Martin Vechev

Mark Vero, Mislav Balunovi\' c , Dimitar I. Dimitrov, and Martin Vechev. Tableak: tabular data leakage in federated learning. In Proceedings of the 40th International Conference on Machine Learning, ICML'23. JMLR.org, 2023

2023
[33]

Cenk Gursoy

Feng Wang, Senem Velipasalar, and M. Cenk Gursoy. Maximum knowledge orthogonality reconstruction with gradients in federated learning. In 2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 3872--3881, 2024. doi:10.1109/WACV57701.2024.00384

2024
[34]

Fishing for user data in large-batch federated learning via gradient magnification

Yuxin Wen, Jonas A Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in large-batch federated learning via gradient magnification. In International Conference on Machine Learning, pages 23668--23684. PMLR, 2022

2022
[35]

Alvarez, Jan Kautz, and Pavlo Molchanov

Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M. Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. In 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16332--16341, 2021. doi:10.1109/CVPR46437...

2021
[36]

Compromise privacy in large-batch federated learning via model poisoning

Shuaishuai Zhang, Jie Huang, Zeping Zhang, Peihao Li, and Chunyang Qi. Compromise privacy in large-batch federated learning via model poisoning. Information Sciences, 647: 0 119421, 2023. ISSN 0020-0255. doi:https://doi.org/10.1016/j.ins.2023.119421. URL https://www.sciencedir...

2023
[37]

idlg: Improved deep leakage from gradients, 2020

Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients, 2020. URL https://arxiv.org/abs/2001.02610

2020 arXiv
[38]

Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H

Joshua C. Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H. Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. Loki: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulation . In 2024 IEEE Symposium on Security and Privacy (SP), pages 1287--1...

2024
[39]

Deep leakage from gradients

Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d Alch\' e -Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019. URL https://proce...

2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Anguita, Alessandro Ghio, L

D. Anguita, Alessandro Ghio, L. Oneto, Xavier Parra, and Jorge Luis Reyes-Ortiz. A public domain dataset for human activity recognition using smartphones. In The European Symposium on Artificial Neural Networks, 2013. URL https://api.semanticscholar.org/CorpusID:6975432

work page 2013

[2] [2]

Jon Louis Bentley, H. T. Kung, Mario Schkolnick, and Clark D. Thompson. On the average number of maxima in a set of vectors and applications. J. ACM , 25 0 (4): 0 536--543, 1978. doi:10.1145/322092.322095. URL https://doi.org/10.1145/322092.322095

arXiv 1978

[3] [3]

Protection against reconstruction and its applications in private federated learning, 2019

Abhishek Bhowmick, John Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan Rogers. Protection against reconstruction and its applications in private federated learning, 2019. URL https://arxiv.org/pdf/1812.00984

arXiv 2019

[4] [4]

When the curious abandon honesty: Federated learning is not private

Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 175--199, 2023. doi:10.1109/EuroSP57164.2023.00020

arXiv 2023

[5] [5]

Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth

Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. CCS '17, page 1175–1191, New York, NY, USA, 2017. Association for Computing Machinery. ISBN 9781450349468. doi:10.1145/3133956.3133982. URL https...

arXiv 2017

[6] [6]

Caterini, Brendan Leigh Ross, Jesse C Cresswell, and Gabriel Loaiza-Ganem

Bradley CA Brown, Anthony L. Caterini, Brendan Leigh Ross, Jesse C Cresswell, and Gabriel Loaiza-Ganem. Verifying the union of manifolds hypothesis for image data. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=Rvee9CAX4fi

work page 2023

[7] [7]

Practical Attribute Reconstruction Attack Against Federated Learning

Chen Chen, Lingjuan Lyu, Han Yu, and Gang Chen. Practical Attribute Reconstruction Attack Against Federated Learning . IEEE Transactions on Big Data, 10 0 (06): 0 851--863, December 2024. ISSN 2332-7790. doi:10.1109/TBDATA.2022.3159236. URL https://doi.ieeecomputersociety.org/10.1109/TBDATA.2022.3159236

arXiv 2024

[8] [8]

Revisiting distributed synchronous sgd

Jianmin Chen, Rajat Monga, Samy Bengio, and Rafal Jozefowicz. Revisiting distributed synchronous sgd. In International Conference on Learning Representations Workshop Track, 2016. URL https://arxiv.org/abs/1604.00981

arXiv 2016