Deep Leakage with Generative Flow Matching Denoiser

TL;DR

This work addresses deep leakage in federated learning by introducing a Generative Flow Matching (FM) denoiser as a learned prior to guide data reconstruction from weight updates. By formulating flow matching as an ODE-based transport and combining it with interpolation-based gradient matching between the initial and final weights, the approach regularizes reconstructions toward the natural image distribution while preserving fidelity to gradient information. Experiments on CIFAR-10 and Tiny-ImageNet show consistent improvements over state-of-the-art attacks across pixel- and perceptual-based metrics, maintaining robustness under larger client batches and common defenses such as noise, clipping, and sparsification. The results highlight the risk posed by powerful generative priors and motivate the development of distribution-aware defenses in FL.

Abstract

Federated Learning (FL) has emerged as a powerful paradigm for decentralized model training, yet it remains vulnerable to deep leakage (DL) attacks that reconstruct private client data from shared model updates. While prior DL methods have demonstrated varying levels of success, they often suffer from instability, limited fidelity, or poor robustness under realistic FL settings. We introduce a new DL attack that integrates a generative Flow Matching (FM) prior into the reconstruction process. By guiding optimization toward the distribution of realistic images (represented by a flow matching foundation model), our method enhances reconstruction fidelity without requiring knowledge of the private data. Extensive experiments on multiple datasets and target models demonstrate that our approach consistently outperforms state-of-the-art attacks across pixel-level, perceptual, and feature-based similarity metrics. Crucially, the method remains effective across different training epochs, larger client batch sizes, and under common defenses such as noise injection, clipping, and sparsification. Our findings call for the development of new defense strategies that explicitly account for adversaries equipped with powerful generative priors.

Figures (5)

• Figure 1: Left: Traditional deep leakage attacks rely on denoising, which oversmooth and remove fine details. Right: Our method leverages a flow-matching prior to denoise while preserving realism and guiding reconstructions toward natural image distributions.
• Figure 2: Effect of noise on the Mean Squared Flow (MSF) of a Flow Matching model. As the noise level decreases, the MSF correspondingly decreases, indicating that Flow Matching can serve as an effective denoising prior.
• Figure 3: Effect of batch size on reconstruction error (MSE) at Epoch 1 of global training.
• Figure 4: Reconstruction quality (SSIM) and model accuracy across training epochs. Batch Size 8
• Figure 5: Qualitative reconstruction comparisons across multiple attack and defense methods. SSIM scores from Table \ref{['tab:deep_leakage_metrics']} and \ref{['tab:deep_leakage_def_metrics']} included below.

Theorems & Definitions (2)

• Proposition 1
• proof