mlsanityData to 7 Oct 2026

Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrix

arXiv 2106.06089 ↗First posted 10 Jun 2021cs.CR cs.AIcited by 43

Not on the map. Why?

Abstract (arXiv)

We show that aggregated model updates in federated learning may be insecure. An untrusted central server may disaggregate user updates from sums of updates across participants given repeated observations, enabling the server to recover privileged information about individual users' private training data via traditional gradient inference attacks. Our method revolves around reconstructing participant information (e.g: which rounds of training users participated in) from aggregated model updates by leveraging summary information from device analytics commonly used to monitor, debug, and manage federated learning systems. Our attack is parallelizable and we successfully disaggregate user updates on settings with up to thousands of participants. We quantitatively and qualitatively demonstrate significant improvements in the capability of various inference attacks on the disaggregated updates. Our attack enables the attribution of learned properties to individual users, violating anonymity, and shows that a determined central server may undermine the secure aggregation protocol to break individual users' data privacy in federated learning.

Key facts. Cited by 43 papers in the map (data through 7 Oct 2026). Builds on 23 of its 32 references that are in the map. First posted on arXiv 10 Jun 2021.

Builds on

23 of 32 references.

References · 23

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  3. 2019Advances and Open Problems in Federated Learningcited by 3,021
  4. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,291
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
  7. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,531
  8. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  10. 2019Deep Leakage from Gradientscited by 1,004
  11. 2019Towards Federated Learning at Scale: System Designcited by 826
  12. 2018How To Backdoor Federated Learningcited by 745
11 more
  1. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  2. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  3. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  4. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  5. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  6. 2015Federated Optimization:Distributed Optimization Beyond the Datacentercited by 193
  7. 2020Threats to Federated Learning: A Surveycited by 171
  8. 2018Mitigating Sybils in Federated Learning Poisoningcited by 158
  9. 2020Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learningcited by 78
  10. 2020A Framework for Evaluating Gradient Leakage Attacks in Federated Learningcited by 63
  11. 2014Matrix factorization with Binary Componentscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 9; 2023: 11; 2024: 14; 2025: 3; 2026: 3.

43 papers.

Sort:

By area:

  1. 2021Federated Learning with Buffered Asynchronous Aggregationcited by 188
  2. 2022Federated Learning Enables Big Data for Rare Cancer Boundary Detectioncited by 83
  3. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 72
  4. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
  5. 2023Recent Advances on Federated Learning: A Systematic Surveycited by 40
  6. 2022A Survey on Gradient Inversion: Attacks, Defenses and Future Directionscited by 39
  7. 2022Gradient Obfuscation Gives a False Sense of Security in Federated Learningcited by 37
  8. 2023Personalized Federated Learning under Mixture of Distributionscited by 37
  9. 2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 35
  10. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  11. 2021FLASHE: Additively Symmetric Homomorphic Encryption for Cross-Silo Federated Learningcited by 15
  12. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
31 more
  1. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
  2. 2022Privacy-preserving Decentralized Federated Learning over Time-varying Communication Graphcited by 11
  3. 2023Surrogate Model Extension (SME): A Fast and Accurate Weight Update Attack on Federated Learningcited by 10
  4. 2023Client-specific Property Inference against Secure Aggregation in Federated Learningcited by 9
  5. 2023The Resource Problem of Using Linear Layer Leakage Attack in Federated Learningcited by 9
  6. 2023Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learningcited by 9
  7. 2024Privacy Preserving Federated Learning in Medical Imaging with Uncertainty Estimationcited by 9
  8. 2022ScionFL: Efficient and Robust Secure Quantized Aggregationcited by 8
  9. 2024Knowledge Distillation in Federated Learning: a Survey on Long Lasting Challenges and New Solutionscited by 8
  10. 2023Theoretically Principled Federated Learning for Balancing Privacy and Utilitycited by 6
  11. 2024Secure Aggregation is Not Private Against Membership Inference Attackscited by 5
  12. 2024Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learningcited by 5
  13. 2023Maximum Knowledge Orthogonality Reconstruction with Gradients in Federated Learningcited by 4
  14. 2024Analyzing Inference Privacy Risks Through Gradients in Machine Learningcited by 4
  15. 2023SRATTA : Sample Re-ATTribution Attack of Secure Aggregation in Federated Learningcited by 3
  16. 2024Linkage on Security, Privacy and Fairness in Federated Learning: New Balances and New Perspectivescited by 3
  17. 2022Perfectly Accurate Membership Inference by a Dishonest Central Server in Federated Learningcited by 2
  18. 2023Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verificationcited by 2
  19. 2024Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomycited by 2
  20. 2024Exploring User-level Gradient Inversion with a Diffusion Priorcited by 2
  21. 2024Federated Learning Nodes Can Reconstruct Peers' Image Datacited by 1
  22. 2025Accelerating Differentially Private Federated Learning via Adaptive Extrapolationcited by 1
  23. 2026ZK-HybridFL: Zero-Knowledge Proof-Enhanced Hybrid Ledger for Federated Learningcited by 1
  24. 2022Generative Adversarial Network Based Synthetic Learning and a Novel Domain Relevant Loss Term for Spine Radiographscited by 0
  25. 2024Survey of Privacy Threats and Countermeasures in Federated Learningcited by 0
  26. 2024FedHide: Federated Learning by Hiding in the Neighborscited by 0
  27. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  28. 2025Differential Privacy Personalized Federated Learning Based on Dynamically Sparsified Client Updatescited by 0
  29. 2025Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learningcited by 0
  30. 2026FedFG: Privacy-Preserving and Robust Federated Learning via Flow-Matching Generationcited by 0
  31. 2026When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learningcited by 0