Search papers, labs, and topics across Lattice.
The authors uncover a structural privacy flaw in decentralized federated learning (DFL), revealing that sparse neighborhood aggregation provides colluding semi-honest nodes with asymmetric views that leak hidden linear combinations of honest participants' states. To bypass the fact that both the model weights and mixing coefficients are unknown, they cast the state recovery task as a cryptographic Hidden Subset Sum Problem (HSSP). Across image, tabular, and text benchmarks, their lattice-based attack successfully reconstructs the exact local updates of honest nodes, directly enabling downstream private data extraction despite secure aggregation.
Network topology alone can completely compromise secure aggregation in decentralized learning, enabling colluding nodes to crack private weights and extract training data using lattice reduction.
Secure Aggregation (SA) is widely regarded as a strong defense against model-update leakage in Federated Learning (FL), as it reveals only aggregate results while hiding individual updates. In Decentralized Federated Learning (DFL), SA is commonly instantiated as local neighborhood aggregation, where each node obtains a weighted aggregate over its neighbors. We show that this locality creates a structural leakage surface: sparse decentralized topologies provide colluding semi-honest nodes with asymmetric aggregate views, exposing multiple hidden linear combinations of honest participants'private states. Reconstructing private states from these aggregate views is fundamentally challenging, as both the private states and the aggregation coefficients are hidden. We tackle this challenge by establishing a formal connection to the Hidden Subset Sum Problem, a long-studied problem in cryptography. Building on this formulation, we design a lattice-based reconstruction approach that combines lattice reduction with structural filtering to reconstruct protected model states. We evaluate our attack on image, tabular, and text tasks under sparse DFL topologies. Our results show that colluding semi-honest nodes can recover the original local updates of honest nodes, enabling downstream reconstruction of private training data. These findings demonstrate that SA alone does not guarantee privacy in DFL when local aggregation induces asymmetric observations.
