The paper introduces a new gradient inversion attack for federated learning that leverages concepts from erasure‑correcting codes to recover entire training batches and their labels from a single FedSGD round. Unlike previous analytic attacks, this method can exactly reconstruct batches of up to 128 samples on ImageNet and achieves over 90% recovery even when the attacker actively manipulates the model. The study demonstrates that federated learning’s privacy leakage is far greater than previously estimated.
arXiv:2508.19819v3 Announce Type: replace-cross Abstract: Gradient inversion attacks are often presented as a serious privacy threat in federated learning, with recent work reporting increasingly str...
arXiv:2606. 00986v1 Announce Type: new Abstract: Federated learning (FL) enables multiple data holders to train machine learning models collaboratively without centralizing raw data, making it useful in privacy sensitive domains such as healthcare and institutional data sharing.
The paper introduces PI‑SME, a Path‑Integral Surrogate Model Extension, to improve gradient inversion attacks in federated learning. By treating a client’s accumulated update as a path integral of the gradient field and approximating it with Gauss–Legendre quadrature over a learnable Bézier path, PI‑SME reconstructs private input images more accurately than existing surrogate baselines. Experiments on CIFAR‑100 and FEMNIST demonstrate its superior performance across various trajectory lengths and class‑restricted batches.
The paper investigates privacy and integrity risks in federated fine‑tuning of a pretrained MobileNetV4 model on Quick, Draw! data. It shows that a single client update can reveal private labels, that label‑count recovery degrades with more clients, and that backdoor and label‑flipping attacks can succeed under FedAvg but are mitigated by FLTrust. The study also demonstrates a live poisoning session using Indigma’s FedMaestro orchestrator.
Aegis is a client‑side defense for medical federated learning that protects against model inversion attacks by adding a masking gradient derived from locally synthesized data. The method exploits the fact that attacks fail when the effective batch size exceeds the model’s leakage capacity, turning this bottleneck into a privacy guarantee. Experiments on MNIST, CIFAR‑10, and MedMNIST datasets show that Aegis neutralizes state‑of‑the‑art attacks while preserving model accuracy and adding only modest overhead.
arXiv:2607. 07314v1 Announce Type: cross Abstract: Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself.
FedLNS is a server‑side framework that screens federated learning updates by representing each client’s contribution through changes in trainable normalization‑layer parameters, creating lightweight signatures that can be compared against a history‑aware cross‑client reference. The method requires no extra client‑to‑server communication, raw data, or labeled attack examples, and after screening, the remaining full‑model updates are aggregated with standard federated learning rules. Experiments on GPT‑style, BERT‑style, and LLaMA‑style models with 200 clients demonstrate that FedLNS achieves lower test perplexity than six baselines even when 40% of the population performs target manipulation under both IID and non‑IID data partitions.
Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data.
The paper demonstrates a novel remote Rowhammer attack that targets federated learning (FL) servers by manipulating client sensor observations to induce repetitive clustered memory updates. Using a reinforcement learning attacker, the authors show that they can achieve approximately 70% repeated update rate in FL systems with sparse updates, leading to bit‑flips in the server’s DRAM during tasks such as automatic speech recognition and CIFAR‑10 classification. This work highlights a previously underexplored vulnerability where client‑side adversarial behavior can compromise server memory integrity in FL environments.
The paper introduces Fed-ADR, a coordinated attack framework where a malicious orchestrator server directs heterogeneous adversarial clients to adapt their gradient updates in real time, thereby evading existing federated learning defenses and drastically reducing global model accuracy. It also presents a lightweight detection mechanism that estimates true client gradients from historical data to spot coordinated attacks, and an in-situ recovery method that restores model performance without restarting training. Experiments on MNIST, Fashion‑MNIST, and CIFAR‑10 show the attack can drop accuracy from over 90% to below 10%, while the defense can recover accuracy to above 90% within a few rounds at a computational cost at least 20× lower than retraining from scratch.
arXiv:2610.07677v1 Announce Type: new Abstract: In this paper, we show that standard evaluations of high-resolution Model Inversion Attacks (MIAs) significantly underestimate training-data privacy le...
arXiv:2606. 17110v1 Announce Type: cross Abstract: Large Language Models are increasingly trained on proprietary or sensitive data, from private healthcare and financial records to user conversations containing secrets.