{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/scale-mia-a-scalable-model-inversion-attack","title":"Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction","arxiv_id":"2311.05808","date":"2023-11-10","proceeding":null,"authors":["Shanghao Shi","Ning Wang","Yang Xiao","Chaoyu Zhang","Yi Shi","Y. Thomas Hou","Wenjing Lou"],"abstract":"Federated learning is known for its capability to safeguard the participants' data privacy. However, recently emerged model inversion attacks (MIAs) have shown that a malicious parameter server can reconstruct individual users' local data samples from model updates. The state-of-the-art attacks either rely on computation-intensive iterative optimization methods to reconstruct each input batch, making scaling difficult, or involve the malicious parameter server adding extra modules before the global model architecture, rendering the attacks too conspicuous and easily detectable. To overcome these limitations, we propose Scale-MIA, a novel MIA capable of efficiently and accurately reconstructing local training samples from the aggregated model updates, even when the system is protected by a robust secure aggregation (SA) protocol. Scale-MIA utilizes the inner architecture of models and identifies the latent space as the critical layer for breaching privacy. Scale-MIA decomposes the complex reconstruction task into an innovative two-step process. The first step is to reconstruct the latent space representations (LSRs) from the aggregated model updates using a closed-form inversion mechanism, leveraging specially crafted linear layers. Then in the second step, the LSRs are fed into a fine-tuned generative decoder to reconstruct the whole input batch. We implemented Scale-MIA on commonly used machine learning models and conducted comprehensive experiments across various settings. The results demonstrate that Scale-MIA achieves excellent performance on different datasets, exhibiting high reconstruction rates, accuracy, and attack efficiency on a larger scale compared to state-of-the-art MIAs. Our code is available at https://github.com/unknown123489/Scale-MIA.","url_abs":"https://arxiv.org/abs/2311.05808v3","url_pdf":"https://arxiv.org/pdf/2311.05808v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"scale-mia-a-scalable-model-inversion-attack","repo_url":"https://github.com/unknown123489/scale-mia","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2311.05808","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2311.05808"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/unknown123489/scale-mia","reach":{"status":"ok","spdx":"NOASSERTION"}}],"summary":{"ran_draft_wrong":2,"ran":3,"unverified":1},"by_repo_kind":{"official":{"samples":6,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"d5378222c82c7a79","entry":"PSNR_cal","repo":"unknown123489/scale-mia","repo_kind":"official","path":"fedavg-cifar/multimodel-recover-attack.py","file_url":"https://github.com/unknown123489/scale-mia/blob/HEAD/fedavg-cifar/multimodel-recover-attack.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d5378222c82c7a79"}},{"code_sha256_prefix":"cf1d0423e8676e0b","entry":"batch_retrival","repo":"unknown123489/scale-mia","repo_kind":"official","path":"fedavg-tinyimagenet/fedavg-recover-attack.py","file_url":"https://github.com/unknown123489/scale-mia/blob/HEAD/fedavg-tinyimagenet/fedavg-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"cf1d0423e8676e0b"}},{"code_sha256_prefix":"c52017c220b310d4","entry":"batch_retrival","repo":"unknown123489/scale-mia","repo_kind":"official","path":"dp-cifar/dp-recover-attack.py","file_url":"https://github.com/unknown123489/scale-mia/blob/HEAD/dp-cifar/dp-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"c52017c220b310d4"}},{"code_sha256_prefix":"315b5ee37bf1681f","entry":"get_activation","repo":"unknown123489/scale-mia","repo_kind":"official","path":"fedavg-tinyimagenet/fedavg-para-gen.py","file_url":"https://github.com/unknown123489/scale-mia/blob/HEAD/fedavg-tinyimagenet/fedavg-para-gen.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"315b5ee37bf1681f"}},{"code_sha256_prefix":"91af7b3d122c48f0","entry":"get_activation","repo":"unknown123489/scale-mia","repo_kind":"official","path":"fedavg-tinyimagenet/fedavg-recover-attack.py","file_url":"https://github.com/unknown123489/scale-mia/blob/HEAD/fedavg-tinyimagenet/fedavg-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"91af7b3d122c48f0"}},{"code_sha256_prefix":"3ea67ede1cd642f3","entry":"batch_retrival","repo":"unknown123489/scale-mia","repo_kind":"official","path":"fedavg-cifar/multimodel-recover-attack.py","file_url":"https://github.com/unknown123489/scale-mia/blob/HEAD/fedavg-cifar/multimodel-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"3ea67ede1cd642f3"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}