Verifiable Gradient Inversion Breaks Federated Tabular Privacy

Problem

This paper studies gradient inversion attacks in federated learning, focusing on the inability of prior methods to certify when a reconstructed record is actually correct. Shared gradients aggregate contributions from multiple records, so disentangling individual samples is hard; in image and text domains attackers may rely on human inspection to judge plausibility, but tabular data lacks such semantic cues, creating a false sense of safety. The work targets the malicious-server threat model in which the server can modify model parameters sent to clients, and asks whether an attacker can both isolate and verifiably recover exact client records, including continuous regression targets.

Approach

The authors introduce VGIA, a verifiable analytical gradient inversion attack that exploits the geometry of ReLU activations. A neuron in a fully connected ReLU layer defines a hyperplane that partitions input space; by translating that hyperplane (via bias changes) the server sweeps parallel hyperplanes to create slabs that may contain one or more samples. VGIA adds an algebraic, subspace-based verification test that detects when a slab contains exactly one record. To make gradients analytically tractable the attacker configures downstream layers so the network remains in a fixed linear region, ensuring certain Jacobian terms are constant. When a slice is certified to be singleton, the attacker recovers the input vector analytically from observed gradient ratios and computes the scalar scaling factor from bias gradients; the target value is then recovered by a lightweight univariate optimisation. VGIA allocates hyperplane queries adaptively, avoids futile refinements, and extends to multiclass classification by forcing the final layer to be rank 1 so the loss signal factorises like regression.

Key Findings

• VGIA provides an explicit certificate of correctness for reconstructed samples, eliminating reliance on heuristics or human inspection for tabular data.
• On a large-batch tabular benchmark (ACS Income, client dataset size 2048), VGIA recovered all 2048 samples within 11 attack rounds and could verify them by round 12; a baseline geometric method required about 2020 rounds in the same favourable setting.
• VGIA produced no spurious reconstructions in the reported ACS Income experiment, while the baseline produced many false reconstructions under comparable attack budgets.
• Across other datasets VGIA was faster and more robust: it fully recovered King County Housing within 10 rounds while the baseline was still attempting after 16 rounds; VGIA also demonstrated cross-domain applicability on HARUS and CIFAR10.
• Under FedAvg with local steps attack quality degrades but VGIA still achieved perfect reconstruction for at least 25% of records and above 50% in many settings; false positives remained below about 20% in most configurations.

Limitations

VGIA assumes a malicious central server that may alter parameters but cannot change architecture. The attacker requires bounds on input features, the ability to set downstream weights and biases to keep the network in a fixed linear region, and double precision to limit numerical error; numerical precision can still cause occasional incorrect reconstructions. Extending the technique to more expressive architectures and evaluating effectiveness under privacy mechanisms such as differential privacy or secure aggregation are left as future work.

Implications

Offensively, VGIA shows a malicious server can provably isolate and reconstruct individual client records, including continuous regression targets, even under large-batch aggregation and without auxiliary datasets. Crucially, the verifier allows the attacker to know which reconstructions are correct, greatly increasing practical privacy risk. This strengthens the case for stronger defensive measures in federated deployments, such as secure aggregation, differential privacy, and active leakage auditing.