No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning

TL;DR

This paper introduces VGIA, a verifiable gradient inversion attack in federated learning that can precisely reconstruct individual training samples from shared gradients, especially in tabular data.

Contribution

VGIA provides an explicit correctness certificate for reconstructed samples using a geometric and algebraic approach, improving accuracy and efficiency over prior methods.

Findings

VGIA achieves exact recovery of training records in tabular data benchmarks.

VGIA outperforms existing attacks in speed and query efficiency.

VGIA can verify when a reconstruction is correct, unlike previous methods.

Abstract

Gradient inversion attacks threaten client privacy in federated learning by reconstructing training samples from clients' shared gradients. Gradients aggregate contributions from multiple records and existing attacks may fail to disentangle them, yielding incorrect reconstructions with no intrinsic way to certify success. In vision and language, attackers may fall back on human inspection to judge reconstruction plausibility, but this is far less feasible for numerical tabular records, fueling the impression that tabular data is less vulnerable. We challenge this perception by proposing a verifiable gradient inversion attack (VGIA) that provides an explicit certificate of correctness for reconstructed samples. Our method adopts a geometric view of ReLU leakage: the activation boundary of a fully connected layer defines a hyperplane in input space. VGIA introduces an algebraic, subspace-based verification test that detects when a hyperplane-delimited region contains exactly one record. Once isolation is certified, VGIA recovers the corresponding feature vector analytically and reconstructs the target via a lightweight optimization step. Experiments on tabular benchmarks with large batch sizes demonstrate exact record and target recovery in regimes where existing state-of-the-art attacks either fail or cannot assess reconstruction fidelity. Compared to prior geometric approaches, VGIA allocates hyperplane queries more effectively, yielding faster reconstructions with fewer attack rounds.