Abstract:Decentralised learning has recently gained traction as an alternative to federated learning in which both data and coordination are distributed. To preserve the confidentiality of users' data, decentralised learning relies on differential privacy, multi-party computation, or both. However, running multiple privacy-preserving summations in sequence may allow adversaries to perform reconstruction attacks. Current reconstruction countermeasures either cannot trivially be adapted to the distributed setting, or add excessive amounts of noise. In this work, we first show that passive honest-but-curious adversaries can infer other users' private data after several privacy-preserving summations. For example, in subgraphs with 18 users, we show that only three passive honest-but-curious adversaries succeed at reconstructing private data 11.0% of the time, requiring an average of 8.8 summations per adversary. The success rate depends only on the adversaries' direct neighbourhood, and is independent of the size of the full network. We consider weak adversaries that do not control the graph topology, cannot exploit the summation's inner workings, and do not have auxiliary knowledge; and show that these adversaries can still infer private data. We analyse how reconstruction relates to topology and propose the first topology-based decentralised defence against reconstruction attacks. We show that reconstruction requires a number of adversaries linear in the length of the network's shortest cycle. Consequently, exact attacks over privacy-preserving summations are impossible in acyclic networks. Our work is a stepping stone for a formal theory of topology-based decentralised reconstruction defences. Such a theory would generalise our countermeasure beyond summation, define confidentiality in terms of entropy, and describe the interactions with (topology-aware) differential privacy.

Data Reconstruction: When You See It and When You Don't

Data Reconstruction Attacks and Defenses: A Systematic Evaluation

Bounding Reconstruction Attack Success of Adversaries Without Data Priors

Exploring the Security Boundary of Data Reconstruction via Neuron Exclusivity Analysis

Understanding Data Reconstruction Leakage in Federated Learning from a Theoretical Perspective

On the Reconstruction of Training Data from Group Invariant Networks

Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System.

Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable

Topology-Based Reconstruction Prevention for Decentralised Learning

Defending against Reconstruction Attacks with Rényi Differential Privacy

Understanding Reconstruction Attacks with the Neural Tangent Kernel and Dataset Distillation

Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy

Deconstructing Classifiers: Towards A Data Reconstruction Attack Against Text Classification Models

Training Data Reconstruction: Privacy due to Uncertainty?

Bounding Training Data Reconstruction in DP-SGD

Defending Against Data Reconstruction Attacks in Federated Learning: An Information Theory Approach

Randomization Resilient To Sensitive Reconstruction

Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems

Detecting Adversarial Examples Via Reconstruction-based Semantic Inconsistency

Reconstructing training data from document understanding models

Database Reconstruction Is Not So Easy and Is Different from Reidentification