{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/surrogate-model-extension-sme-a-fast-and","title":"Surrogate Model Extension (SME): A Fast and Accurate Weight Update Attack on Federated Learning","arxiv_id":"2306.00127","date":"2023-05-31","proceeding":null,"authors":["Junyi Zhu","Ruicong Yao","Matthew B. Blaschko"],"abstract":"In Federated Learning (FL) and many other distributed training frameworks, collaborators can hold their private data locally and only share the network weights trained with the local data after multiple iterations. Gradient inversion is a family of privacy attacks that recovers data from its generated gradients. Seemingly, FL can provide a degree of protection against gradient inversion attacks on weight updates, since the gradient of a single step is concealed by the accumulation of gradients over multiple local iterations. In this work, we propose a principled way to extend gradient inversion attacks to weight updates in FL, thereby better exposing weaknesses in the presumed privacy protection inherent in FL. In particular, we propose a surrogate model method based on the characteristic of two-dimensional gradient flow and low-rank property of local updates. Our method largely boosts the ability of gradient inversion attacks on weight updates containing many iterations and achieves state-of-the-art (SOTA) performance. Additionally, our method runs up to $100\\times$ faster than the SOTA baseline in the common FL scenario. Our work re-evaluates and highlights the privacy risk of sharing network weights. Our code is available at https://github.com/JunyiZhu-AI/surrogate_model_extension.","url_abs":"https://arxiv.org/abs/2306.00127v1","url_pdf":"https://arxiv.org/pdf/2306.00127v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"surrogate-model-extension-sme-a-fast-and","repo_url":"https://github.com/junyizhu-ai/surrogate_model_extension","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2306.00127","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2306.00127"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/eth-sri/fedavg_leakage","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/junyizhu-ai/surrogate_model_extension","reach":null}],"summary":{"ran":2,"ran_honours":1,"ran_fixture":2,"unverified":4},"by_repo_kind":{"official":{"samples":5,"ran":3,"repositories":1},"found_in_text":{"samples":4,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"f83a503893df1e24","entry":"IWU","repo":"junyizhu-ai/surrogate_model_extension","repo_kind":"official","path":"sme/Adversary/adversary.py","file_url":"https://github.com/junyizhu-ai/surrogate_model_extension/blob/HEAD/sme/Adversary/adversary.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f83a503893df1e24"}},{"code_sha256_prefix":"0889102a88546b82","entry":"compute_matching","repo":"eth-sri/fedavg_leakage","repo_kind":"found_in_text","path":"fedavg/attacks/grad_attack.py","file_url":"https://github.com/eth-sri/fedavg_leakage/blob/HEAD/fedavg/attacks/grad_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0889102a88546b82"}},{"code_sha256_prefix":"c815819da7d3f742","entry":"compute_norm","repo":"junyizhu-ai/surrogate_model_extension","repo_kind":"official","path":"sme/Adversary/adversary.py","file_url":"https://github.com/junyizhu-ai/surrogate_model_extension/blob/HEAD/sme/Adversary/adversary.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c815819da7d3f742"}},{"code_sha256_prefix":"8b672039c1c6718a","entry":"generate_init_img","repo":"eth-sri/fedavg_leakage","repo_kind":"found_in_text","path":"fedavg/attacks/grad_attack.py","file_url":"https://github.com/eth-sri/fedavg_leakage/blob/HEAD/fedavg/attacks/grad_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8b672039c1c6718a"}},{"code_sha256_prefix":"751c3b578dca1309","entry":"total_variation","repo":"junyizhu-ai/surrogate_model_extension","repo_kind":"official","path":"sme/Adversary/adversary.py","file_url":"https://github.com/junyizhu-ai/surrogate_model_extension/blob/HEAD/sme/Adversary/adversary.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"751c3b578dca1309"}},{"code_sha256_prefix":"554cc2806b81818b","entry":"attack_via_grad_opt_flax","repo":"eth-sri/fedavg_leakage","repo_kind":"found_in_text","path":"fedavg/attacks/grad_attack.py","file_url":"https://github.com/eth-sri/fedavg_leakage/blob/HEAD/fedavg/attacks/grad_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"554cc2806b81818b"}},{"code_sha256_prefix":"8bce02582e5fa957","entry":"prior_boundary","repo":"junyizhu-ai/surrogate_model_extension","repo_kind":"official","path":"sme/Adversary/adversary.py","file_url":"https://github.com/junyizhu-ai/surrogate_model_extension/blob/HEAD/sme/Adversary/adversary.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8bce02582e5fa957"}},{"code_sha256_prefix":"a5e33466fcb446bc","entry":"require_grad","repo":"junyizhu-ai/surrogate_model_extension","repo_kind":"official","path":"sme/Adversary/adversary.py","file_url":"https://github.com/junyizhu-ai/surrogate_model_extension/blob/HEAD/sme/Adversary/adversary.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a5e33466fcb446bc"}},{"code_sha256_prefix":"0161a159399d1e19","entry":"visualize","repo":"eth-sri/fedavg_leakage","repo_kind":"found_in_text","path":"fedavg/attacks/grad_attack.py","file_url":"https://github.com/eth-sri/fedavg_leakage/blob/HEAD/fedavg/attacks/grad_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0161a159399d1e19"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}