No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning

2026-04-16

AI Summary

This work addresses the challenge of verifying the correctness of reconstructed samples in gradient inversion attacks within federated learning, particularly the lack of reliable evaluation metrics for tabular data. The authors propose a verifiable gradient inversion attack that constructs a geometric hyperplane model based on ReLU activation boundaries and employs a subspace algebraic verification mechanism to determine whether the input space contains only a single record. Leveraging this guarantee, the method analytically recovers feature vectors followed by lightweight optimization. It provides the first explicit correctness certificate for gradient inversion attacks, overcoming the limitations of existing approaches that rely on manual inspection or lack quantifiable fidelity measures. Experiments demonstrate that the method achieves accurate and verifiable reconstruction of original records on large-batch tabular data, significantly outperforming state-of-the-art attacks—especially in scenarios where prior methods fail or produce unverifiable results.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

Gradient inversion attacks threaten client privacy in federated learning by reconstructing training samples from clients' shared gradients. Gradients aggregate contributions from multiple records and existing attacks may fail to disentangle them, yielding incorrect reconstructions with no intrinsic way to certify success. In vision and language, attackers may fall back on human inspection to judge reconstruction plausibility, but this is far less feasible for numerical tabular records, fueling the impression that tabular data is less vulnerable. We challenge this perception by proposing a verifiable gradient inversion attack (VGIA) that provides an explicit certificate of correctness for reconstructed samples. Our method adopts a geometric view of ReLU leakage: the activation boundary of a fully connected layer defines a hyperplane in input space. VGIA introduces an algebraic, subspace-based verification test that detects when a hyperplane-delimited region contains exactly one record. Once isolation is certified, VGIA recovers the corresponding feature vector analytically and reconstructs the target via a lightweight optimization step. Experiments on tabular benchmarks with large batch sizes demonstrate exact record and target recovery in regimes where existing state-of-the-art attacks either fail or cannot assess reconstruction fidelity. Compared to prior geometric approaches, VGIA allocates hyperplane queries more effectively, yielding faster reconstructions with fewer attack rounds.

Problem

• gradient inversion attack
• federated learning
• privacy
• tabular data
• verifiable reconstruction

Innovation

• verifiable gradient inversion
• federated learning privacy
• ReLU leakage
• geometric attack
• tabular data reconstruction