Search papers, labs, and topics across Lattice.
This paper introduces a Verifiable Gradient Inversion Attack (VGIA) for federated learning that reconstructs training samples from shared gradients with a certificate of correctness. VGIA leverages a geometric view of ReLU leakage, using activation boundaries to define hyperplanes and a subspace-based test to certify when a region contains exactly one record. Experiments on tabular benchmarks demonstrate exact record and target recovery in scenarios where existing attacks fail, challenging the notion that tabular data is less vulnerable to gradient inversion.
Tabular data, often considered less vulnerable, can be exactly reconstructed from shared gradients in federated learning, thanks to a new attack that certifies its own success.
Gradient inversion attacks threaten client privacy in federated learning by reconstructing training samples from clients'shared gradients. Gradients aggregate contributions from multiple records and existing attacks may fail to disentangle them, yielding incorrect reconstructions with no intrinsic way to certify success. In vision and language, attackers may fall back on human inspection to judge reconstruction plausibility, but this is far less feasible for numerical tabular records, fueling the impression that tabular data is less vulnerable. We challenge this perception by proposing a verifiable gradient inversion attack (VGIA) that provides an explicit certificate of correctness for reconstructed samples. Our method adopts a geometric view of ReLU leakage: the activation boundary of a fully connected layer defines a hyperplane in input space. VGIA introduces an algebraic, subspace-based verification test that detects when a hyperplane-delimited region contains exactly one record. Once isolation is certified, VGIA recovers the corresponding feature vector analytically and reconstructs the target via a lightweight optimization step. Experiments on tabular benchmarks with large batch sizes demonstrate exact record and target recovery in regimes where existing state-of-the-art attacks either fail or cannot assess reconstruction fidelity. Compared to prior geometric approaches, VGIA allocates hyperplane queries more effectively, yielding faster reconstructions with fewer attack rounds.
