Federated Model Inversion Attack

The attack exploits the mathematical relationship between a model's loss gradient and its input data. In a federated round, clients share parameter updates (gradients) with the server. An honest-but-curious server can optimize a dummy input to produce gradients that match the received updates. Through iterative gradient descent on this dummy input, the attacker reconstructs a close approximation of the original private data.

• Attack vector: Shared model gradients or parameter updates
• Optimization target: Minimize distance between dummy and true gradients
• Convergence signal: Visual similarity to training samples emerges rapidly

This attack operates under a specific threat model where the aggregation server is honest-but-curious—it faithfully executes the protocol but attempts to infer private information. The adversary has white-box access to the model architecture and receives individual client gradients before aggregation. This scenario is realistic in cross-silo federated learning where a central coordinator manages training.

• Adversary type: Honest-but-curious server or malicious participant
• Access level: Full visibility into unaggregated gradients
• Target data: Training samples, not just membership information

Model inversion attacks manifest in multiple forms depending on the target. Label inference reconstructs the ground-truth labels from gradients of the classification layer. Feature reconstruction recovers input pixels or embeddings. Batch reconstruction attempts to separate and recover multiple samples from a single aggregated gradient update. The attack is most potent against low-batch-size training and models with large input dimensions relative to batch size.

• Label recovery: Exploit classification layer gradient structure
• Image reconstruction: Optimize dummy inputs to match gradient signatures
• Text recovery: Reconstruct token embeddings from language model gradients

Multiple defense strategies mitigate inversion risk. Gradient perturbation via differential privacy adds calibrated noise to updates, trading model accuracy for privacy guarantees. Secure aggregation cryptographically ensures the server only sees the summed update, not individual contributions. Gradient compression reduces information content through sparsification or quantization. Large batch sizes naturally increase the difficulty of isolating individual samples.

• Differential privacy: Add noise with a bounded privacy budget (epsilon)
• Secure aggregation: Use multi-party computation to hide individual updates
• Gradient pruning: Transmit only the top-k largest gradient values

Quantifying the success of an inversion attack requires specific metrics. Mean Squared Error (MSE) measures pixel-level reconstruction accuracy. Structural Similarity Index (SSIM) assesses perceptual similarity to original images. Peak Signal-to-Noise Ratio (PSNR) evaluates reconstruction quality in decibels. For text data, token-level accuracy and BLEU scores measure semantic recovery. These metrics establish baselines for privacy auditing.

• MSE: Lower values indicate better reconstruction
• SSIM: Values near 1.0 indicate near-perfect recovery
• PSNR: Values above 30 dB suggest high-fidelity reconstruction

Model inversion is distinct from but related to other privacy attacks. Unlike membership inference, which only determines if a sample was in the training set, inversion reconstructs actual features. It differs from attribute inference, which targets specific sensitive attributes rather than full samples. Inversion is more severe than property inference, which reveals dataset-level statistics. Together, these attacks form a comprehensive privacy evaluation framework.

• Membership inference: Binary determination of training set presence
• Attribute inference: Recovery of specific sensitive features
• Property inference: Extraction of global dataset characteristics

A finite, quantifiable measure of the total privacy loss permitted over a series of queries or training rounds in a differentially private system. Each model update leaks a small amount of information; the budget tracks cumulative exposure to inversion-style attacks.

• Once the budget is exhausted, no further queries are allowed
• Privacy accountants track spending using moments accountant or Rényi DP
• Budget allocation must balance model convergence speed against long-term privacy guarantees

A technique for embedding a unique, verifiable identifier into a federated model's weights during training. While not a direct defense against inversion, watermarking provides intellectual property protection and forensic traceability if a model is stolen and subjected to inversion attacks.

• Watermarks survive model compression and fine-tuning
• Enables proof of ownership in collaborative multi-institutional training
• Can be embedded via backdoor triggers or weight quantization patterns