Practical Attribute Reconstruction Attack Against Federated Learning
Abstract
Existing federated learning (FL) designs have been shown to exhibit vulnerabilities which can be exploited by adversaries to compromise data privacy. However, most current works conduct attacks by leveraging gradients calculated on a small batch of data. This setting is not realistic as gradients are normally shared after at least 1 epoch of local training on each participant's local data in FL for communication efficiency. In this work, we conduct a unique systematic evaluation of attribute reconstruction attack (ARA) launched by the malicious server in the FL system, and empirically demonstrate that the shared local model gradients after 1 epoch of local training can still reveal sensitive attributes of local training data. To demonstrate this leakage, we develop a more effective and efficient gradient matching based method called cos-matching to reconstruct the sensitive attributes of any victim participant's training data. Based on the reconstructed training data attributes, we further show that an attacker can even reconstruct the sensitive attributes of any records that are not included in any participant's training data, thus opening a new attack surface in FL. Extensive experiments show that the proposed method achieves better attribute attack performance than existing state-of-the-art methods.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Recent studies have shown that FL is also vulnerable to well-crafted adversarial examples.
“In terms of the robustness vulnerability, recent studies [175], [176], [177] have shown that FL is also vulnerable to well-crafted adversarial examples.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [177]
The training of all federated adversarial training works is unstable, which potentially hurts convergence and performance.
“The training of all the above FAT works are unstable, which potentially hurts the convergence and performance.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [177]
During inference time, attackers can add a very small perturbation to the test data, making the test data almost indistinguishable from natural data and yet classified incorrectly by the global model.
“During inference time, the attackers can add a very small perturbation to the test data, making the test data almost indistinguishable from natural data and yet classified incorrectly by the global model.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [177]
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956 · see citing works
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Understanding deep learning (still) requires rethinking generalization
Zhang, C., Bengio, S., Hardt, M., Recht, B., & Vinyals, O. (2021) · Communications of the ACM · doi:10.1145/3446776 · Cited by 2,400 · see citing works
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906 · see citing works
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760 · see citing works
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734 · see citing works
Privacy-Preserving Deep Learning via Additively Homomorphic Encryption
Phong, L. T., Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2787987 · Cited by 1,662 · see citing works
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377 · see citing works
Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Training
Lin, Y., Han, S., Mao, H., Wang, Y., & Dally, W. J. (2017) · arXiv · doi:10.48550/arxiv.1712.01887 · Cited by 1,134 · see citing works
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001 · see citing works
Kang, J., Xiong, Z., Niyato, D. T., Xie, S., & Zhang, J. (2019) · IEEE Internet of Things Journal · doi:10.1109/jiot.2019.2940820 · Cited by 961 · see citing works
Personalized Cross-Silo Federated Learning on Non-IID Data
Huang, Y., Chu, L., Zhou, Z., Wang, L., Liu, J., Pei, J., & Zhang, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16960 · Cited by 749 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
Liu, Y., Garg, S., Nie, J., Zhang, Y., Xiong, Z., Kang, J., & Hossain, M. S. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3011726 · Cited by 595 · see citing works
Artificial-Intelligence-Enabled Intelligent 6G Networks
Yang, H., Alphones, A., Xiong, Z., Niyato, D. T., Zhao, J., & Wu, K. (2020) · IEEE Network · doi:10.1109/mnet.011.2000195 · Cited by 592 · see citing works
iDLG: Improved Deep Leakage from GradientsPreprint
Zhao, B., Mopuri, K. R., & Bilen, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.02610 · Cited by 575 · see citing works
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Self-citationThe Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks
Zhang, Y., Jia, R., Pei, H., Wang, W., Li, B., & Song, D. X. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00033 · Cited by 481 · see citing works
Lyu, L., Yu, H., Zhao, J., & Yang, Q. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_1 · Cited by 444 · see citing works
Self-citationInformation Leakage in Embedding Models
Song, C., & Raghunathan, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417270 · Cited by 245 · see citing works
Privacy Risks of General-Purpose Language Models
Pan, X., Zhang, M., Ji, S., & Yang, M. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00095 · Cited by 188 · see citing works
Towards Robust and Privacy-preserving Text Representations
Li, Y., Baldwin, T., & Cohn, T. (2018) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/p18-2005 · Cited by 158 · see citing works
What Can Be Transferred: Unsupervised Domain Adaptation for Endoscopic Lesions Segmentation
Dong, J., Cong, Y., Sun, G., Zhong, B., & Xu, X. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00408 · Cited by 149 · see citing works
Dong, J., Cong, Y., Sun, G., Fang, Z., & Ding, Z. (2021) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2021.3128560 · Cited by 147 · see citing works
Federated Model Distillation with Noise-Free Differential Privacy
Sun, L., & Lyu, L. (2021) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/216 · Cited by 117 · see citing works
Self-citationDwork, C., & Naor, M. (2010) · Journal of Privacy and Confidentiality · doi:10.29012/jpc.v2i1.585 · Cited by 115 · see citing works
User Review Sites as a Resource for Large-Scale Sociolinguistic Studies
Hovy, D., Johannsen, A., & Søgaard, A. (2015) · International World Wide Web Conference (WWW) · doi:10.1145/2736277.2741141 · Cited by 98 · see citing works
Privacy-preserving Neural Representations of Text
Coavoux, M., Narayan, S., & Cohen, S. B. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1001 · Cited by 98 · see citing works
Overlearning Reveals Sensitive AttributesPreprint
Song, C., & Shmatikov, V. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.11742 · Cited by 96 · see citing works
Personal privacy vs population privacy
Cormode, G. (2011) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2020408.2020598 · Cited by 94 · see citing works
Lyu, L., He, X., & Li, Y. (2020) · Findings of the Association for Computational Linguistics: EMNLP 2020 · doi:10.18653/v1/2020.findings-emnlp.213 · Cited by 51 · see citing works
Self-citationHow to Democratise and Protect AI: Fair and Differentially Private Decentralised Deep Learning
Lyu, L., Li, Y., Nandakumar, K., Yu, J., & Ma, X. (2024) · Figshare · Cited by 38 · see citing works
Self-citationHow to Democratise and Protect AI: Fair and Differentially Private Decentralised Deep Learning
Lyu, L., Li, Y., Nandakumar, K., Yu, J., & Ma, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3006287 · Cited by 31 · see citing works
Self-citationRobust Federated Recommendation SystemPreprint
Chen, C., Zhang, J., Tung, A. K. H., Kankanhalli, M., & Chen, G. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.08259 · Cited by 23 · see citing works
Self-citationDataset-Level Attribute Leakage in Collaborative Learning.Preprint
Zhang, W., Tople, S., & Ohrimenko, O. (2020) · arXiv (Cornell University) · Cited by 8 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Self-citationLocal differential privacy and its applications: A comprehensive survey
Yang, M., Guo, T., Zhu, T., Tjuawinata, I., Zhao, J., & Lam, K. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103827 · Cited by 270 · see citing works
The Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 191 · see citing works
Federated Learning on Non-IID Graphs via Structural Knowledge Sharing
Tan, Y., Liu, Y., Long, G., Jiang, J., Lu, Q., & Zhang, C. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i8.26187 · Cited by 181 · see citing works
Myrzashova, R., Alsamhi, S. H., Shvetsov, A. V., Hawbani, A., & Wei, X. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3263598 · Cited by 178 · see citing works
Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metrics
Romandini, N., Mora, A., Mazzocca, C., Montanari, R., & Bellavista, P. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3478334 · Cited by 76 · see citing works
Open challenges and opportunities in federated foundation models towards biomedical healthcare
Li, X., Peng, L., Wang, Y., & Zhang, W. (2025) · BioData Mining · doi:10.1186/s13040-024-00414-9 · Cited by 71 · see citing works
Liu, J., Zhang, J., Jan, M. A., Sun, R. X., Liu, L., Verma, S., & Chatterjee, P. (2023) · IEEE Journal of Biomedical and Health Informatics · doi:10.1109/jbhi.2023.3304361 · Cited by 47 · see citing works
Federated Learning in Computer Vision
Shenaj, D., Rizzoli, G., & Zanuttigh, P. (2023) · IEEE Access · doi:10.1109/access.2023.3310400 · Cited by 45 · see citing works
FedShare: Secure Aggregation based on Additive Secret Sharing in Federated Learning
Khojir, H. F., Alhadidi, D., Rouhani, S., & Mohammed, N. (2023) · International Database Engineering and Applications Symposium (IDEAS) · doi:10.1145/3589462.3589504 · Cited by 22 · see citing works
Laidi, R., Merabtine, N., Djenouri, D., Latif, S., Qadir, H. A., Djenouri, Y., & Balasingham, I. (2025) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2025.3557475 · Cited by 16 · see citing works
LDIA: Label distribution inference attack against federated learning in edge computing
Gu, Y., & Bai, Y. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103475 · Cited by 11 · see citing works
Secure Federated Learning for Multi-Party Network Monitoring
Lytvyn, O., & Nguyen, G. (2024) · IEEE Access · doi:10.1109/access.2024.3486810 · Cited by 10 · see citing works
Feng, S., Mohammady, M., Hong, H., Yan, S., Kundu, A., Wang, B., & Hong, Y. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726517 · Cited by 7 · see citing works
A Cost Optimization Method Based on Adam Algorithm for Integrated Demand Response
Cheng, H., & Ai, Q. (2023) · Electronics · doi:10.3390/electronics12234731 · Cited by 6 · see citing works
Borazjani, K., Khosravan, N., Sahay, R., Akram, B., & Hosseinalipour, S. (2025) · Frontiers in Artificial Intelligence · doi:10.3389/frai.2025.1683960 · Cited by 5 · see citing works
Digital Privacy Under Attack: Challenges and Enablers
Song, B., Pokhrel, S. R., Deng, M., Lan, Q., Doss, R., Zhu, T., & Li, G. (2025) · ACM Computing Surveys · doi:10.1145/3770853 · Cited by 5 · see citing works
Wang, H., Gu, R., Wang, J., Zhang, X., & Wei, H. (2025) · IEEE Access · doi:10.1109/access.2025.3536001 · Cited by 4 · see citing works
Melhem, A., AlEroud, A. F., Al-Mamun, A., & Ibrahem, M. I. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3658441 · Cited by 4 · see citing works
Efficient Privacy-Preserving Federated Learning With Integrity in Fog Computing
Li, X.-Y., Liang, Y., Zhou, Z., & Zhang, W. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3584157 · Cited by 3 · see citing works
Hasan, S. M., Imteaj, A., & Shahid, A. R. (2025) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2025.3633995 · Cited by 3 · see citing works
ASDIA: An Adversarial Sample to Preserve Privacy Program in Federated Learning
Tian, S., Tan, Y., Wang, H., Liu, H., & Li, Z. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3545599 · Cited by 3 · see citing works
Efficient DP-FL: Efficient Differential Privacy Federated Learning Based on Early Stopping Mechanism
Jiao, S., Cai, L., Meng, J., Zhao, Y., & Cheng, K. (2024) · Computer Systems Science and Engineering · doi:10.32604/csse.2023.040194 · Cited by 2 · see citing works
Efficient privacy-preserving federated logistic regression with poor-quality users
Zheng, T., Li, X.-Y., Chen, X., Ren, H., & Shen, C. (2024) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01840-6 · Cited by 2 · see citing works
DECML: Distributed Edge Consensus Machine Learning Framework
Verdeyen, C., Shepherd, C., Markantonakis, K., Akram, R. N., Milroy, R., Ghazalah, S. A., & Sauveron, D. (2024) · IEEE Global Conference on Artificial Intelligence and Internet of Things (GCAIoT) · doi:10.1109/gcaiot63427.2024.10833588 · Cited by 1 · see citing works
Boar, P. E., Sharma, P. K., Akram, R. N., & Li, W. (2025) · SN Computer Science · doi:10.1007/s42979-025-04482-4 · Cited by 1 · see citing works
Inferring Communities of Interest in Collaborative Learning-based Recommender Systems
Belal, Y., Maouche, M., Mokhtar, S. B., & Simonet, A. (2025) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs63083.2025.00056 · Cited by 1 · see citing works
Securing FL-Enabled NWDAF in Private 5G Networks Against Hybrid Attacks
Xiong, R., Xiong, M., Ren, Y. C., Ren, W., & Parr, G. P. (2026) · IEEE Transactions on Green Communications and Networking · doi:10.1109/tgcn.2026.3735240
Split to Spot: Multi-Reference Byzantine Detection via Gradient Splitting in Federated Learning
Yu, Z., Ai, Z., Su, Y., Yu, D., Chen, Y., & Wang, J. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11729493
- Authors
- Chen, C., Lyu, L., Yu, H., & Chen, G.
- Affiliations
- Zhejiang University (CN)
- National University of Singapore (SG)
- Nanyang Technological University (SG)
- Venue
- IEEE Transactions on Big Data
- Published
- 2024-12
- Volume
- 10
- Issue
- 6
- Pages
- 851-863
- ISSN
- 2332-7790 (ISSN-L)
- 2372-2096
- OpenAlex
- W4226036112
- Cited by
- 30
- References
- 38
- Citations by year
- 2026: 3 · 2025: 10 · 2024: 6 · 2023: 10 · 2022: 1
- FWCI
- 2.22
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Big Data (publishedVersion)
- DR-NTU (Nanyang Technological University) (acceptedVersion)
- Funders
- Key Research and Development Program of Zhejiang Province of China (2020C01024)
- National Research Foundation Singapore
- AI Singapore Programme (AISG2-RP-2020-019)
- Joint NTU-WeBank Research Centre on Fintech (NWJ-2020-008)
- Nanyang Assistant Professorships
- RIE 2020 Advanced Manufacturing and Engineering Programmatic Fund (A20G8b0102)
- SDU-NTU Centre for AI Research
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Keywords
- federated learning, data privacy, malicious server, gradient matching, sensitive attribute inference, data leakage, privacy attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
