mlsanityData to 14 Oct 2026

Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learning

arXiv 2406.15731 ↗First posted 22 Jun 2024cs.CR cs.AIcited by 6

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) exhibits privacy vulnerabilities under gradient inversion attacks (GIAs), which can extract private information from individual gradients. To enhance privacy, FL incorporates Secure Aggregation (SA) to prevent the server from obtaining individual gradients, thus effectively resisting GIAs. In this paper, we propose a stealthy label inference attack to bypass SA and recover individual clients' private labels. Specifically, we conduct a theoretical analysis of label inference from the aggregated gradients that are exclusively obtained after implementing SA. The analysis results reveal that the inputs (embeddings) and outputs (logits) of the final fully connected layer (FCL) contribute to gradient disaggregation and label restoration. To preset the embeddings and logits of FCL, we craft a fishing model by solely modifying the parameters of a single batch normalization (BN) layer in the original model. Distributing client-specific fishing models, the server can derive the individual gradients regarding the bias of FCL by resolving a linear system with expected embeddings and the aggregated gradients as coefficients. Then the labels of each client can be precisely computed based on preset logits and gradients of FCL's bias. Extensive experiments show that our attack achieves large-scale label recovery with 100% accuracy on various datasets and model architectures.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Builds on 26 of its 42 references that are in the map. First posted on arXiv 22 Jun 2024.

Builds on

26 of 42 references.

References · 26

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  4. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  5. 2019Advances and Open Problems in Federated Learningcited by 3,046
  6. 2018Federated Learning with Non-IID Datacited by 1,108
  7. 2019Deep Leakage from Gradientscited by 1,021
  8. 2019Towards Federated Learning at Scale: System Designcited by 832
  9. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  10. 2018Federated Learning for Mobile Keyboard Predictioncited by 572
  11. 2017Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Trainingcited by 478
  12. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
14 more
  1. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
  2. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  3. 2021Federated Learning for Open Bankingcited by 141
  4. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 127
  5. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 108
  6. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 73
  7. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 67
  8. 2021LightSecAgg: a Lightweight and Versatile Design for Secure Aggregation in Federated Learningcited by 64
  9. 2020FastSecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learningcited by 61
  10. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  11. 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
  12. 2021User-Level Label Leakage from Gradients in Federated Learningcited by 21
  13. 2023The Resource Problem of Using Linear Layer Leakage Attack in Federated Learningcited by 9
  14. 2023SRATTA : Sample Re-ATTribution Attack of Secure Aggregation in Federated Learningcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 6.

6 papers.

  1. 2026Fed-Listing: Federated Label Distribution Inference in Graph Neural Networkscited by 0
  2. 2026Echelon: Auditable Aggregate-Only Language-Model Adaptation Across Privacy Boundariescited by 0
  3. 2026Leaking Circuit Secrets: Gradient Leakage Attacks on Graph Neural Networkscited by 0
  4. 2026When the Aggregator Cheats: Data-Free Backdoors in Federated LLM-based QA Systemscited by 0
  5. 2026PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learningcited by 0
  6. 2026Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunitiescited by 0