mlsanityData to 14 Oct 2026

DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems

arXiv 2506.01777 ↗First posted 2 Jun 2025cs.LGcited by 0

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

Federated Unlearning (FU) enables clients to remove the influence of specific data from a collaboratively trained shared global model, addressing regulatory requirements such as GDPR and CCPA. However, this unlearning process introduces a new privacy risk: A malicious server may exploit unlearning updates to reconstruct the data requested for removal, a form of Data Reconstruction Attack (DRA). While DRAs for machine unlearning have been studied extensively in centralized Machine Learning-as-a-Service (MLaaS) settings, their applicability to FU remains unclear due to the decentralized, client-driven nature of FU. This work presents DRAUN, the first attack framework to reconstruct unlearned data in FU systems. DRAUN targets optimization-based unlearning methods, which are widely adopted for their efficiency. We theoretically demonstrate why existing DRAs targeting machine unlearning in MLaaS fail in FU and show how DRAUN overcomes these limitations. We validate our approach through extensive experiments on four datasets and four model architectures, evaluating its performance against five popular unlearning methods, effectively demonstrating that state-of-the-art FU methods remain vulnerable to DRAs.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 43 of its 59 references that are in the map. First posted on arXiv 2 Jun 2025.

Builds on

43 of 59 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directions31 Oct
  2. 2023FRAMU: Attention-based Machine Unlearning using Federated Reinforcement Learning19 Sep
  3. 2022Federated Unlearning: How to Efficiently Erase a Client in FL?12 Jul

Other references · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  4. 2022Generative Adversarial Networkscited by 5,627
  5. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,621
  6. 2019Deep Leakage from Gradientscited by 1,021
  7. 2018LEAF: A Benchmark for Federated Settingscited by 792
  8. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  9. 2017Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Trainingcited by 478
  10. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  11. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 334
  12. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
28 more
  1. 2019Gradient Descent Maximizes the Margin of Homogeneous Neural Networkscited by 320
  2. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  3. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  4. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  5. 2020Directional convergence and alignment in deep learningcited by 178
  6. 2022Reconstructing Training Data with Informed Adversariescited by 148
  7. 2022Reconstructing Training Data from Trained Neural Networkscited by 133
  8. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 127
  9. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 122
  10. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 108
  11. 2021Gradient Inversion with Generative Image Priorcited by 101
  12. 2020R-GAP: Recursive Gradient Attack on Privacycited by 97
  13. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  14. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 73
  15. 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearningcited by 48
  16. 2021Towards General Deep Leakage in Federated Learningcited by 40
  17. 2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 36
  18. 2021Bayesian Framework for Gradient Leakagecited by 34
  19. 2020Privacy-preserving Collaborative Learning with Automatic Transformation Searchcited by 31
  20. 2021PRECODE - A Generic Model Extension to Prevent Deep Gradient Leakagecited by 28
  21. 2022Reconstructing Training Data from Model Gradient, Provablycited by 27
  22. 2022Data Leakage in Federated Averagingcited by 26
  23. 2024Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerablecited by 25
  24. 2024SPEAR:Exact Gradient Inversion of Batches in Federated Learningcited by 15
  25. 2023Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learningcited by 13
  26. 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attackscited by 13
  27. 2023Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learningcited by 9
  28. 2024HyperINF: Unleashing the HyperPower of the Schulz's Method for Data Influence Estimationcited by 7

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025FedMUA: Exploring the Vulnerabilities of Federated Learning to Malicious Unlearning Attacks
  2. 2025EFU: Enforcing Federated Unlearning via Functional Encryption
  3. 2025DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences
  4. 2025Data Duplication: A Novel Multi-Purpose Attack Paradigm in Machine Unlearning
  5. 2025Dual-Phase Federated Deep Unlearning via Weight-Aware Rollback and Reconstruction
  6. 2024Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metrics
  7. 2025BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning
  8. 2024Survey of Security and Data Attacks on Machine Unlearning In Financial and E-Commerce