Papers › Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learning

Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learning

5 Jun 2023arXiv:2306.03013archive 2025-07-28

Kostadin Garov, Dimitar I. Dimitrov, Nikola Jovanović, Martin Vechev

Malicious server (MS) attacks have enabled the scaling of data stealing in federated learning to large batch sizes and secure aggregation, settings previously considered private. However, many concerns regarding the client-side detectability of MS attacks were raised, questioning their practicality. In this work, for the first time, we thoroughly study client-side detectability. We first demonstrate that all prior MS attacks are detectable by principled checks, and formulate a necessary set of requirements that a practical MS attack must satisfy. Next, we propose SEER, a novel attack framework that satisfies these requirements. The key insight of SEER is the use of a secret decoder, jointly trained with the shared model. We show that SEER can steal user data from gradients of realistic networks, even for large batch sizes of up to 512 and under secure aggregation. Our work is a promising step towards assessing the true vulnerability of federated learning in real-world settings.

PaperPDFCode

Code

insait-institute/seer officialmentioned in paperpytorch report
eth-sri/tableak mentioned on GitHubpytorchMIT report

Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.

Code Syntology ran Syntology

Not run by Syntology. Nothing on this page verifies that the listed code works.

Tasks

DecoderFederated Learning

Results from the paper archive 2025-07-28

No leaderboard rows for this paper in the archive.

Methods

1x1 ConvolutionAverage PoolingBatch NormalizationConvolutionCosine AnnealingDense ConnectionsGlobal Average PoolingGrouped ConvolutionLARSReLURegNetYSEERSigmoid ActivationSqueeze-and-Excitation BlockSwAV

Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections