Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction

TL;DR

Scale-MIA exposes a critical privacy vulnerability in secure federated learning by showing that the latent space of common models is a bottleneck through which whole client data batches can be reconstructed from aggregated updates. It consists of offline adversarial model generation and an in-round two-phase reconstruction: a closed-form linear leakage step to recover latent-space representations, followed by decoding with a fine-tuned generative decoder to recover input batches. The attack achieves high reconstruction rates and efficiency across multiple datasets and model families, and remains effective under DP and SA, highlighting significant practical privacy risks. The work motivates strengthened defenses such as robust masking, data-synthesized masking, or alternative privacy-preserving mechanisms to counter latent-space leakage in FL systems.

Abstract

Federated learning is known for its capability to safeguard the participants' data privacy. However, recently emerged model inversion attacks (MIAs) have shown that a malicious parameter server can reconstruct individual users' local data samples from model updates. The state-of-the-art attacks either rely on computation-intensive iterative optimization methods to reconstruct each input batch, making scaling difficult, or involve the malicious parameter server adding extra modules before the global model architecture, rendering the attacks too conspicuous and easily detectable. To overcome these limitations, we propose Scale-MIA, a novel MIA capable of efficiently and accurately reconstructing local training samples from the aggregated model updates, even when the system is protected by a robust secure aggregation (SA) protocol. Scale-MIA utilizes the inner architecture of models and identifies the latent space as the critical layer for breaching privacy. Scale-MIA decomposes the complex reconstruction task into an innovative two-step process. The first step is to reconstruct the latent space representations (LSRs) from the aggregated model updates using a closed-form inversion mechanism, leveraging specially crafted linear layers. Then in the second step, the LSRs are fed into a fine-tuned generative decoder to reconstruct the whole input batch. We implemented Scale-MIA on commonly used machine learning models and conducted comprehensive experiments across various settings. The results demonstrate that Scale-MIA achieves excellent performance on different datasets, exhibiting high reconstruction rates, accuracy, and attack efficiency on a larger scale compared to state-of-the-art MIAs. Our code is available at https://github.com/unknown123489/Scale-MIA.

Figures (14)

• Figure 1: Scale-MIA threat model.
• Figure 2: The model architecture of machine-learning classifiers.
• Figure 3: Scale-MIA is a two-phase attack. The first phase is performed locally to produce essential information to conduct the second phase. The second is the actual attack phase for the attacker to interact with the clients and reconstruct their local training samples.
• Figure 4: Reconstruction examples. These examples are taken from large reconstruction batches. Full reconstructed batches and more discussions can be found in the Appendix.
• Figure 5: Scale-MIA's attack performance over different federated learning settings.