mlsanityData to 7 Oct 2026

LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulation

arXiv 2303.12233 ↗First posted 21 Mar 2023cs.LG cs.CRcited by 35

Not on the map. Why?

Abstract (arXiv)

Federated learning was introduced to enable machine learning over large decentralized datasets while promising privacy by eliminating the need for data sharing. Despite this, prior work has shown that shared gradients often contain private information and attackers can gain knowledge either through malicious modification of the architecture and parameters or by using optimization to approximate user data from the shared gradients. However, prior data reconstruction attacks have been limited in setting and scale, as most works target FedSGD and limit the attack to single-client gradients. Many of these attacks fail in the more practical setting of FedAVG or if updates are aggregated together using secure aggregation. Data reconstruction becomes significantly more difficult, resulting in limited attack scale and/or decreased reconstruction quality. When both FedAVG and secure aggregation are used, there is no current method that is able to attack multiple clients concurrently in a federated learning setting. In this work we introduce LOKI, an attack that overcomes previous limitations and also breaks the anonymity of aggregation as the leaked data is identifiable and directly tied back to the clients they come from. Our design sends clients customized convolutional parameters, and the weight gradients of data points between clients remain separate even through aggregation. With FedAVG and aggregation across 100 clients, prior work can leak less than 1% of images on MNIST, CIFAR-100, and Tiny ImageNet. Using only a single training round, LOKI is able to leak 76-86% of all data samples.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). Builds on 37 of its 54 references that are in the map. First posted on arXiv 21 Mar 2023.

Builds on

37 of 54 references.

References · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  5. 2019Advances and Open Problems in Federated Learningcited by 3,021
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2019Deep Leakage from Gradientscited by 1,004
  8. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  9. 2021MedMNIST v2 -- A large-scale lightweight benchmark for 2D and 3D biomedical image classificationcited by 682
  10. 2019Federated Learning with Differential Privacy: Algorithms and Performance Analysiscited by 528
  11. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  12. 2020Label-Only Membership Inference Attackscited by 371
25 more
  1. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  2. 2020HeteroFL: Computation and Communication Efficient Federated Learning for Heterogeneous Clientscited by 334
  3. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  4. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  5. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
  6. 2020Client Selection in Federated Learning: Convergence Analysis and Power-of-Choice Selection Strategiescited by 196
  7. 2021Federated Learning with Buffered Asynchronous Aggregationcited by 188
  8. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  9. 2020Optimal Client Sampling for Federated Learningcited by 123
  10. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  11. 2020Feature Inference Attack on Model Predictions in Vertical Federated Learningcited by 105
  12. 2020Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learningcited by 78
  13. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 72
  14. 2021Understanding Clipping for Federated Learning: Convergence and Client-Level Differential Privacycited by 66
  15. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
  16. 2021LightSecAgg: a Lightweight and Versatile Design for Secure Aggregation in Federated Learningcited by 63
  17. 2020FastSecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learningcited by 60
  18. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  19. 2021Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learningcited by 38
  20. 2020Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attackscited by 32
  21. 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
  22. 2022Data Leakage in Federated Averagingcited by 26
  23. 2020Secure Aggregation with Heterogeneous Quantization in Federated Learningcited by 21
  24. 2021Information Theoretic Secure Aggregation with User Dropoutscited by 19
  25. 2020Quality Inference in Federated Learning with Secure Aggregationcited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 11; 2025: 11; 2026: 11.

35 papers.

Sort:

By area:

  1. 2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 20
  2. 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 18
  3. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
  4. 2023Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learningcited by 9
  5. 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
  6. 2024Decaf: Data Distribution Decompose Attack against Federated Learningcited by 4
  7. 2025Vertical Federated Learning in Practice: The Good, the Bad, and the Uglycited by 4
  8. 2024MedLeak: Multimodal Medical Data Leakage in Secure Federated Learning with Crafted Modelscited by 3
  9. 2024Memory Backdoor Attacks on Neural Networkscited by 3
  10. 2024Geminio: Language-Guided Gradient Inversion Attacks in Federated Learningcited by 3
  11. 2025Gradient Inversion Attacks on Parameter-Efficient Fine-Tuningcited by 3
  12. 2025From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learningcited by 3
23 more
  1. 2024Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learningcited by 2
  2. 2025Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learningcited by 2
  3. 2026Beyond Corner Patches: Semantics-Aware Backdoor Attack in Federated Learningcited by 2
  4. 2024Federated Learning Nodes Can Reconstruct Peers' Image Datacited by 1
  5. 2024Attribute Inference Attacks for Federated Regression Taskscited by 1
  6. 2025Evaluating Membership Inference Attacks in heterogeneous-data setupscited by 1
  7. 2025Integrating Identity-Based Identification against Adaptive Adversaries in Federated Learningcited by 1
  8. 2025Hear No Evil: Detecting Gradient Leakage by Malicious Servers in Federated Learningcited by 1
  9. 2026Integrating Homomorphic Encryption and Synthetic Data in FL for Privacy and Learning Qualitycited by 1
  10. 2026No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learningcited by 1
  11. 2024Fluent: Round-efficient Secure Aggregation for Private Federated Learningcited by 0
  12. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  13. 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systemscited by 0
  14. 2025TimberStrike: Dataset Reconstruction Attack Revealing Privacy Leakage in Federated Tree-Based Systemscited by 0
  15. 2025On the Detectability of Active Gradient Inversion Attacks in Federated Learningcited by 0
  16. 2026SoK: Enhancing Cryptographic Collaborative Learning with Differential Privacycited by 0
  17. 2026Privacy-Preserving Machine Learning for IoT: A Cross-Paradigm Survey and Future Roadmapcited by 0
  18. 2026ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recoverycited by 0
  19. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  20. 2026MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuningcited by 0
  21. 2026Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learningcited by 0
  22. 2026Temporal Gradient Inversion for Private Trajectory Reconstruction in Embodied Reinforcement Learningcited by 0
  23. 2026Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learningcited by 0