mlsanityData to 14 Oct 2026

Decaf: Data Distribution Decompose Attack against Federated Learning

arXiv 2405.15316 ↗First posted 24 May 2024cs.LG cs.CRcited by 4

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

In contrast to prevalent Federated Learning (FL) privacy inference techniques such as generative adversarial networks attacks, membership inference attacks, property inference attacks, and model inversion attacks, we devise an innovative privacy threat: the Data Distribution Decompose Attack on FL, termed Decaf. This attack enables an honest-but-curious FL server to meticulously profile the proportion of each class owned by the victim FL user, divulging sensitive information like local market item distribution and business competitiveness. The crux of Decaf lies in the profound observation that the magnitude of local model gradient changes closely mirrors the underlying data distribution, including the proportion of each class. Decaf addresses two crucial challenges: accurately identify the missing/null class(es) given by any victim user as a premise and then quantify the precise relationship between gradient changes and each remaining non-null class. Notably, Decaf operates stealthily, rendering it entirely passive and undetectable to victim users regarding the infringement of their data distribution privacy. Experimental validation on five benchmark datasets (MNIST, FASHION-MNIST, CIFAR-10, FER-2013, and SkinCancer) employing diverse model architectures, including customized convolutional networks, standardized VGG16, and ResNet18, demonstrates Decaf's efficacy. Results indicate its ability to accurately decompose local user data distribution, regardless of whether it is IID or non-IID distributed. Specifically, the dissimilarity measured using L∞ distance between the distribution decomposed by Decaf and ground truth is consistently below 5% when no null classes exist. Moreover, Decaf achieves 100% accuracy in determining any victim user's null classes, validated through formal proof.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 31 of its 55 references that are in the map. First posted on arXiv 24 May 2024.

Builds on

31 of 55 references.

References · 31

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  4. 2016Deep Learning with Differential Privacycited by 2,728
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  6. 2018Federated Learning with Non-IID Datacited by 1,108
  7. 2019Skin Lesion Analysis Toward Melanoma Detection 2018: A Challenge Hosted by the International Skin Imaging Collaboration (ISIC)cited by 669
  8. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  9. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  10. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  11. 2020Label-Only Membership Inference Attackscited by 388
  12. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
19 more
  1. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 334
  2. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  3. 2019Robust Aggregation for Federated Learningcited by 317
  4. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  5. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  6. 2020Membership Leakage in Label-Only Exposurescited by 168
  7. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  8. 2020Privacy-preserving Traffic Flow Prediction: A Federated Learning Approachcited by 83
  9. 2021FedAUX: Leveraging Unlabeled Auxiliary Data in Federated Learningcited by 69
  10. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 58
  11. 2022Label-Only Model Inversion Attacks via Boundary Repulsioncited by 56
  12. 2020Dynamic Fusion based Federated Learning for COVID-19 Detectioncited by 36
  13. 2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 36
  14. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 31
  15. 2022Group Property Inference Attacks Against Graph Neural Networkscited by 21
  16. 2021Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputscited by 18
  17. 2022PPA: Preference Profiling Attack Against Federated Learningcited by 9
  18. 2020A Novel Privacy-Preserved Recommender System Framework based on Federated Learningcited by 6
  19. 2017Relationship Profiling over Social Networks: Reverse Smoothness from Similarity to Closenesscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 2; 2025: 1; 2026: 1.

4 papers.

  1. 2024FLARE: Toward Universal Dataset Purification against Backdoor Attackscited by 7
  2. 2024FRIDA: Free-Rider Detection using Privacy Attackscited by 0
  3. 2025FedThief: Harming Others to Benefit Oneself in Self-Centered Federated Learningcited by 0
  4. 2026Fed-Listing: Federated Label Distribution Inference in Graph Neural Networkscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Evaluating Differential Privacy Against Membership Inference in Federated Learning: Insights from the NIST Genomics Red Team Challenge
  2. 2024Defending against Data Poisoning Attacks in Federated Learning via User Elimination
  3. 2026FedXDS: Leveraging Model Attribution Methods to counteract Data Heterogeneity in Federated Learning
  4. 2024DarkFed: A Data-Free Backdoor Attack in Federated Learning
  5. 2025An Efficient Gradient-Based Inference Attack for Federated Learning
  6. 2023Privacy Inference-Empowered Stealthy Backdoor Attack on Federated Learning under Non-IID Scenarios
  7. 2022Subject Membership Inference Attacks in Federated Learning
  8. 2025FuSeFL: Fully Secure and Scalable Federated Learning