Abstract:Federated Learning (FL) has emerged as a popular paradigm for collaborative learning among multiple parties. It is considered privacy-friendly because local data remains on personal devices, and only intermediate parameters -- such as gradients or model updates -- are shared. Although gradient inversion is widely viewed as a common attack method in FL, analytical research on reconstructing input training samples from shared gradients remains limited and is typically confined to constrained settings like small batch sizes. In this paper, we aim to overcome these limitations by addressing the problem from a cryptographic perspective. We mathematically formulate the input reconstruction problem using the gradient information shared in FL as the Hidden Subset Sum Problem (HSSP), an extension of the well-known NP-complete Subset Sum Problem (SSP). Leveraging this formulation allows us to achieve perfect input reconstruction, thereby mitigating issues such as dependence on label diversity and underperformance with large batch sizes that hinder existing empirical gradient inversion attacks. Moreover, our analysis provides insights into why empirical input reconstruction attacks degrade with larger batch sizes. By modeling the problem as HSSP, we demonstrate that the batch size \( B \) significantly affects attack complexity, with time complexity reaching \( \mathcal{O}(B^9) \). We further show that applying secure data aggregation techniques -- such as homomorphic encryption and secure multiparty computation -- provides a strong defense by increasing the time complexity to \( \mathcal{O}(N^9 B^9) \), where \( N \) is the number of local clients in FL. To the best of our knowledge, this is the first work to rigorously analyze privacy issues in FL by modeling them as HSSP, providing a concrete analytical foundation for further exploration and development of defense strategies.

Stealing Secrecy from Outside: A Novel Gradient Inversion Attack in Federated Learning

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

Evaluating Gradient Inversion Attacks and Defenses in Federated Learning

Quantification of the Leakage in Federated Learning

EGIA: an External Gradient Inversion Attack in Federated Learning.

Gradient Inversion Attack on Graph Neural Networks

Recover User's Private Training Image Data by Gradient in Federated Learning

Gradient leakage attacks in federated learning

Concealing Sensitive Samples against Gradient Leakage in Federated Learning

GI-SMN: Gradient Inversion Attack against Federated Learning without Prior Knowledge

Defense Against Gradient Leakage Attacks via Learning to Obscure Data

Enhancing Privacy of Spatiotemporal Federated Learning against Gradient Inversion Attacks

Gradient Leakage Defense with Key-Lock Module for Federated Learning

Hidden Data Privacy Breaches in Federated Learning

Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learning

Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomy

Gradients Stand-in for Defending Deep Leakage in Federated Learning

Client-Side Gradient Inversion Attack in Federated Learning Using Secure Aggregation

Federated Learning under Attack: Improving Gradient Inversion for Batch of Images

Gradient Obfuscation Gives a False Sense of Security in Federated Learning

Perfect Gradient Inversion in Federated Learning: A New Paradigm from the Hidden Subset Sum Problem