mlsanityData to 7 Oct 2026

SRATTA : Sample Re-ATTribution Attack of Secure Aggregation in Federated Learning

arXiv 2306.07644 ↗First posted 13 Jun 2023cs.LG cs.CRcited by 3

Not on the map. Why?

Abstract (arXiv)

We consider a cross-silo federated learning (FL) setting where a machine learning model with a fully connected first layer is trained between different clients and a central server using FedAvg, and where the aggregation step can be performed with secure aggregation (SA). We present SRATTA an attack relying only on aggregated models which, under realistic assumptions, (i) recovers data samples from the different clients, and (ii) groups data samples coming from the same client together. While sample recovery has already been explored in an FL setting, the ability to group samples per client, despite the use of SA, is novel. This poses a significant unforeseen security threat to FL and effectively breaks SA. We show that SRATTA is both theoretically grounded and can be used in practice on realistic models and datasets. We also propose counter-measures, and claim that clients should play an active role to guarantee their privacy during training.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 33 of its 68 references that are in the map. First posted on arXiv 13 Jun 2023.

Builds on

33 of 68 references.

References · 33

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  4. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  5. 2019Advances and Open Problems in Federated Learningcited by 3,021
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,441
  8. 2019Deep Leakage from Gradientscited by 1,004
  9. 2019Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classificationcited by 836
  10. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  11. 2014OpenML: networked science in machine learningcited by 523
  12. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
21 more
  1. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  2. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  3. 2021Well-tuned Simple Nets Excel on Tabular Datasetscited by 151
  4. 2021Federated Learning for Open Bankingcited by 138
  5. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  6. 2022FLamby: Datasets and Benchmarks for Cross-Silo Federated Learning in Realistic Healthcare Settingscited by 121
  7. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  8. 2020R-GAP: Recursive Gradient Attack on Privacycited by 95
  9. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
  10. 2016A survey of sparse representation: algorithms and applicationscited by 58
  11. 2018Sparse Binary Compression: Towards Distributed Deep Learning with minimal Communicationcited by 51
  12. 2022Do Gradient Inversion Attacks Make Federated Learning Unsafe?cited by 44
  13. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  14. 2018Classification and Disease Localization in Histopathology Using Only Global Labels: A Weakly-Supervised Approachcited by 33
  15. 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
  16. 2022Data Leakage in Federated Averagingcited by 26
  17. 2021Self supervised learning improves dMMR/MSI detection from histology slides across multiple cancerscited by 23
  18. 2020Federated Survival Analysis with Discrete-Time Cox Modelscited by 18
  19. 2020Quality Inference in Federated Learning with Secure Aggregationcited by 15
  20. 2022AGIC: Approximate Gradient Inversion Attack on Federated Learningcited by 15
  21. 2020Exploring the Security Boundary of Data Reconstruction via Neuron Exclusivity Analysiscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 0; 2026: 1.

3 papers.

  1. 2024Fisher Information-based Efficient Curriculum Federated Learning with Large Language Modelscited by 6
  2. 2024Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learningcited by 5
  3. 2026FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregationcited by 0