@INPROCEEDINGS{curious,

  author={Boenisch, Franziska and Dziedzic, Adam and Schuster, Roei and Shamsabadi, Ali Shahin and Shumailov, Ilia and Papernot, Nicolas},

  booktitle={2023 IEEE 8th European Symposium on Security and Privacy (EuroS\&P)}, 

  title={When the Curious Abandon Honesty: Federated Learning Is Not Private}, 

  year={2023},

  volume={},

  number={},

  pages={175-199},

  keywords={Training;Privacy;Sentiment analysis;Federated learning;Computational modeling;Training data;Data models;privacy;federated learning;attack},

  doi={10.1109/EuroSP57164.2023.00020}}


@article{REITZNER2005178,
title = {The combinatorial structure of random polytopes},
journal = {Advances in Mathematics},
volume = {191},
number = {1},
pages = {178-208},
year = {2005},
issn = {0001-8708},
doi = {https://doi.org/10.1016/j.aim.2004.03.006},
url = {https://www.sciencedirect.com/science/article/pii/S0001870804000775},
author = {Matthias Reitzner},
keywords = {Convex hulls, Random points, -vector, Random polytopes, Approximation of convex bodies},
abstract = {Choose n random points in Rd, let Pn be their convex hull, and denote by fi(Pn) the number of i-dimensional faces of Pn. A general method for computing the expectation of fi(Pn), i=0,…,d−1, is presented. This generalizes classical results of Efron (in the case i=0) and Rényi and Sulanke (in the case i=d−1) to arbitrary i. For random points chosen in a smooth convex body a limit law for fi(Pn) is proved as n→∞. For random points chosen in a polytope the expectation of fi(Pn) is determined as n→∞. This implies an extremal property for random points chosen in a simplex.}
}
@phdthesis{thomasse:tel-01252937,
  TITLE = {{Complexity analysis of random convex hulls}},
  AUTHOR = {Thomasse, R{\'e}my},
  URL = {https://inria.hal.science/tel-01252937},
  NUMBER = {2015NICE4116},
  SCHOOL = {{Universit{\'e} Nice Sophia Antipolis}},
  YEAR = {2015},
  MONTH = Dec,
  KEYWORDS = {Convex hull ; Smoothed analysis ; Complexity ; Enveloppe convexe ; Analyse liss{\'e}e ; Complexit{\'e}},
  TYPE = {Theses},
  PDF = {https://inria.hal.science/tel-01252937v2/file/2015NICE4116.pdf},
  HAL_ID = {tel-01252937},
  HAL_VERSION = {v2},
}

@article{ZHANG2023119421,
title = {Compromise privacy in large-batch Federated Learning via model poisoning},
journal = {Information Sciences},
volume = {647},
pages = {119421},
year = {2023},
issn = {0020-0255},
doi = {https://doi.org/10.1016/j.ins.2023.119421},
url = {https://www.sciencedirect.com/science/article/pii/S002002552301006X},
author = {Shuaishuai Zhang and Jie Huang and Zeping Zhang and Peihao Li and Chunyang Qi},
keywords = {Privacy, Federated Learning, Gradient inversion, Model poisoning},
}

@inproceedings{
fowl2022robbing,
title={Robbing the Fed:  Directly Obtaining Private Data in Federated Learning with Modified Models},
author={Liam H Fowl and Jonas Geiping and Wojciech Czaja and Micah Goldblum and Tom Goldstein},
booktitle={International Conference on Learning Representations},
year={2022},
url={https://openreview.net/forum?id=fwzUgo0FM9v}
}

@inproceedings{wen2022fishing ,
  title={Fishing for User Data in Large-Batch Federated Learning via Gradient Magnification},
  author={Wen, Yuxin and Geiping, Jonas A and Fowl, Liam and Goldblum, Micah and Goldstein, Tom},
  booktitle={International Conference on Machine Learning},
  pages={23668--23684},
  year={2022},
  organization={PMLR}
}


@InProceedings{kariyappa23a_cocktail,
  title = 	 {Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning Using Independent Component Analysis},
  author =       {Kariyappa, Sanjay and Guo, Chuan and Maeng, Kiwan and Xiong, Wenjie and Suh, G. Edward and Qureshi, Moinuddin K and Lee, Hsien-Hsin S.},
  booktitle = 	 {Proceedings of the 40th International Conference on Machine Learning},
  pages = 	 {15884--15899},
  year = 	 {2023},
  editor = 	 {Krause, Andreas and Brunskill, Emma and Cho, Kyunghyun and Engelhardt, Barbara and Sabato, Sivan and Scarlett, Jonathan},
  volume = 	 {202},
  series = 	 {Proceedings of Machine Learning Research},
  month = 	 {23--29 Jul},
  publisher =    {PMLR},
  pdf = 	 {https://proceedings.mlr.press/v202/kariyappa23a/kariyappa23a.pdf},
  url = 	 {https://proceedings.mlr.press/v202/kariyappa23a.html},
  abstract = 	 {Federated learning (FL) aims to perform privacy-preserving machine learning on distributed data held by multiple data owners. To this end, FL requires the data owners to perform training locally and share the gradients or weight updates (instead of the private inputs) with the central server, which are then securely aggregated over multiple data owners. Although aggregation by itself does not offer provable privacy protection, prior work suggested that if the batch size is sufficiently large the aggregation may be secure enough. In this paper, we propose the Cocktail Party Attack (CPA) that, contrary to prior belief, is able to recover the private inputs from gradients/weight updates aggregated over as many as 1024 samples. CPA leverages the crucial insight that aggregate gradients from a fully connected (FC) layer is a linear combination of its inputs, which allows us to frame gradient inversion as a blind source separation (BSS) problem. We adapt independent component analysis (ICA)—a classic solution to the BSS problem—to recover private inputs for FC and convolutional networks, and show that CPA significantly outperforms prior gradient inversion attacks, scales to ImageNet-sized inputs, and works on large batch sizes of up to 1024.}
}

@article{
dimitrov2022data,
title={Data Leakage in Federated Averaging},
author={Dimitar Iliev Dimitrov and Mislav Balunovic and Nikola Konstantinov and Martin Vechev},
journal={Transactions on Machine Learning Research},
issn={2835-8856},
year={2022},
url={https://openreview.net/forum?id=e7A0B99zJf},
note={}
}

@inproceedings{10.1145/3548606.3560557,
author = {Pasquini, Dario and Francati, Danilo and Ateniese, Giuseppe},
title = {Eluding Secure Aggregation in Federated Learning via Model Inconsistency},
year = {2022},
isbn = {9781450394505},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3548606.3560557},
doi = {10.1145/3548606.3560557},
abstract = {Secure aggregation is a cryptographic protocol that securely computes the aggregation of its inputs. It is pivotal in keeping model updates private in federated learning. Indeed, the use of secure aggregation prevents the server from learning the value and the source of the individual model updates provided by the users, hampering inference and data attribution attacks.In this work, we show that a malicious server can easily elude secure aggregation as if the latter were not in place. We devise two different attacks capable of inferring information on individual private training datasets, independently of the number of users participating in the secure aggregation. This makes them concrete threats in large-scale, real-world federated learning applications.The attacks are generic and equally effective regardless of the secure aggregation protocol used They exploit a vulnerability of the federated learning protocol caused by incorrect usage of secure aggregation and lack of parameter validation. Our work demonstrates that current implementations of federated learning with secure aggregation offer only a ''false sense of security.''},
booktitle = {Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security},
pages = {2429–2443},
numpages = {15},
keywords = {secure aggregation, model inconsistency, federated learning},
location = {Los Angeles, CA, USA},
series = {CCS '22}
}

@inproceedings{
garov2024hiding,
title={Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learning},
author={Kostadin Garov and Dimitar Iliev Dimitrov and Nikola Jovanovi{\'c} and Martin Vechev},
booktitle={The Twelfth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=krx55l2A6G}
}

@ARTICLE{10793076,

  author={You, Zhichao and Dong, Xuewen and Li, Shujun and Ma, Siqi and Shen, Yulong},

  journal={IEEE Transactions on Information Forensics and Security}, 

  title={Local Differential Privacy is Not Enough: A Sample Reconstruction Attack against Federated Learning with Local Differential Privacy}, 

  year={2024},

  volume={},

  number={},

  pages={1-1},

  keywords={Image reconstruction;Training;Noise;Accuracy;Privacy;Measurement;Generative adversarial networks;Complexity theory;Servers;Generators},

  doi={10.1109/TIFS.2024.3515793}}


@INPROCEEDINGS {loki,
author = { Zhao, Joshua C. and Sharma, Atul and Elkordy, Ahmed Roushdy and Ezzeldin, Yahya H. and Avestimehr, Salman and Bagchi, Saurabh },
booktitle = { 2024 IEEE Symposium on Security and Privacy (SP) },
title = {{ Loki: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulation }},
year = {2024},
volume = {},
ISSN = {},
pages = {1287-1305},
abstract = { Federated learning was introduced to enable machine learning over large decentralized datasets while promising privacy by eliminating the need for data sharing. Despite this, prior work has shown that shared gradients often contain private information and attackers can gain knowledge either through malicious modification of the architecture and parameters or by using optimization to approximate user data from the shared gradients.However, prior data reconstruction attacks have been limited in setting and scale, as most works target FedSGD and limit the attack to single-client gradients. Many of these attacks fail in the more practical setting of FedAVG or if updates are aggregated together using secure aggregation. Data reconstruction becomes significantly more difficult, resulting in limited attack scale and/or decreased reconstruction quality. When both FedAVG and secure aggregation are used, there is no current method that is able to attack multiple clients concurrently in a federated learning setting.In this work we introduce Loki, an attack that overcomes previous limitations and also breaks the anonymity of aggregation as the leaked data is identifiable and directly tied back to the clients they come from. Our design sends clients customized convolutional parameters, and the weight gradients of data points between clients remain separate even through aggregation. With FedAVG and aggregation across 100 clients, prior work can leak less than 1% of images on MNIST, CIFAR-100, and Tiny ImageNet. Using only a single training round, Loki is able to leak 76-86% of all data samples. },
keywords = {Training;Data privacy;Privacy;Federated learning;Data models;Servers;Security},
doi = {10.1109/SP54263.2024.00030},
url = {https://doi.ieeecomputersociety.org/10.1109/SP54263.2024.00030},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
month =May}


@INPROCEEDINGS{yin_gi,

  author={Yin, Hongxu and Mallya, Arun and Vahdat, Arash and Alvarez, Jose M. and Kautz, Jan and Molchanov, Pavlo},

  booktitle={2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)}, 

  title={See through Gradients: Image Batch Recovery via GradInversion}, 

  year={2021},

  volume={},

  number={},

  pages={16332-16341},

  keywords={Training;Deep learning;Data privacy;Image matching;Estimation;Collaborative work;Pattern recognition},

  doi={10.1109/CVPR46437.2021.01607}}

@inproceedings{
dimitrov2024spear,
title={{SPEAR}: Exact Gradient Inversion of Batches in Federated Learning},
author={Dimitar Iliev Dimitrov and Maximilian Baader and Mark Niklas Mueller and Martin Vechev},
booktitle={The Thirty-eighth Annual Conference on Neural Information Processing Systems},
year={2024},
url={https://openreview.net/forum?id=lPDxPVS6ix}
}

@article{imagenet,
  author = {Russakovsky, Olga and Deng, Jia and Su, Hao and Krause, Jonathan and Satheesh, Sanjeev and Ma, Sean and Huang, Zhiheng and Karpathy, Andrej and Khosla, Aditya and Bernstein, Michael and Berg, Alexander C. and Fei-Fei, Li},
  title = {ImageNet Large Scale Visual Recognition Challenge},
  journal = {International Journal of Computer Vision},
  year = {2015},
  volume = {115},
  number = {3},
  pages = {211--252},
  doi = {10.1007/s11263-015-0816-y},
  url = {https://doi.org/10.1007/s11263-015-0816-y},
  issn = {1573-1405},
  abstract = {The ImageNet Large Scale Visual Recognition Challenge is a benchmark in object category classification and detection on hundreds of object categories and millions of images. The challenge has been run annually from 2010 to present, attracting participation from more than fifty institutions. This paper describes the creation of this benchmark dataset and the advances in object recognition that have been possible as a result. We discuss the challenges of collecting large-scale ground truth annotation, highlight key breakthroughs in categorical object recognition, provide a detailed analysis of the current state of the field of large-scale image classification and object detection, and compare the state-of-the-art computer vision accuracy with human accuracy. We conclude with lessons learned in the 5 years of the challenge, and propose future directions and improvements.}
}


@inproceedings{harus,
  title={A Public Domain Dataset for Human Activity Recognition using Smartphones},
  author={D. Anguita and Alessandro Ghio and L. Oneto and Xavier Parra and Jorge Luis Reyes-Ortiz},
  booktitle={The European Symposium on Artificial Neural Networks},
  year={2013},
  url={https://api.semanticscholar.org/CorpusID:6975432}
}

@article{openproblems,
  title={Advances and open problems in federated learning},
  author={Kairouz, Peter and McMahan, H Brendan and Avent, Brendan and Bellet, Aur{\'e}lien and Bennis, Mehdi and Bhagoji, Arjun Nitin and Bonawitz, Kallista and Charles, Zachary and Cormode, Graham and Cummings, Rachel and others},
  journal={Foundations and Trends{\textregistered} in Machine Learning},
  volume={14},
  number={1--2},
  pages={1--210},
  year={2021},
  publisher={Now Publishers, Inc.}
}


@inproceedings{mcmahan2017communication,
  title={Communication-efficient learning of deep networks from decentralized data},
  author={McMahan, Brendan and Moore, Eider and Ramage, Daniel and Hampson, Seth and y Arcas, Blaise Aguera},
  booktitle={Artificial Intelligence and Statistics},
  pages={1273--1282},
  year={2017},
  organization={PMLR}
}

@article{bonawitz_privacy,
title	= {Federated Learning and Privacy},
author	= {Kallista Bonawitz and Peter Kairouz and Brendan McMahan and Daniel R Ramage},
year	= {2021},
URL	= {https://queue.acm.org/detail.cfm?id=3501293},
journal	= {ACM Queue},
volume	= {19}
}

@INPROCEEDINGS{melis_memb_inf,
  author={Melis, Luca and Song, Congzheng and De Cristofaro, Emiliano and Shmatikov, Vitaly},
  booktitle={2019 IEEE Symposium on Security and Privacy (SP)}, 
  title={Exploiting Unintended Feature Leakage in Collaborative Learning}, 
  year={2019},
  volume={},
  number={},
  pages={691-706},
  keywords={Training;Training data;Data models;Servers;Collaborative work;Task analysis;Computational modeling;privacy;collaborative-learning;deep-learning;security;inference-attacks},
  doi={10.1109/SP.2019.00029}}


@ARTICLE{aia_fl,
author={Chen, Chen and Lyu, Lingjuan and Yu, Han and Chen, Gang},
journal={ IEEE Transactions on Big Data },
title={{ Practical Attribute Reconstruction Attack Against Federated Learning }},
year={2024},
volume={10},
number={06},
ISSN={2332-7790},
pages={851-863},
keywords={Training;Training data;Data models;Image reconstruction;Servers;Data privacy;Task analysis},
doi={10.1109/TBDATA.2022.3159236},
url = {https://doi.ieeecomputersociety.org/10.1109/TBDATA.2022.3159236},
publisher={IEEE Computer Society},
address={Los Alamitos, CA, USA},
month=dec}

@inproceedings{geiping_gi,
author = {Geiping, Jonas and Bauermeister, Hartmut and Dr\"{o}ge, Hannah and Moeller, Michael},
title = {Inverting gradients - how easy is it to break privacy in federated learning?},
year = {2020},
isbn = {9781713829546},
publisher = {Curran Associates Inc.},
address = {Red Hook, NY, USA},
booktitle = {Proceedings of the 34th International Conference on Neural Information Processing Systems},
articleno = {1421},
numpages = {11},
location = {Vancouver, BC, Canada},
series = {NIPS '20}
}



@InProceedings{pmlr-v139-choquette-choo21a,
  title = 	 {Label-Only Membership Inference Attacks},
  author =       {Choquette-Choo, Christopher A. and Tramer, Florian and Carlini, Nicholas and Papernot, Nicolas},
  booktitle = 	 {Proceedings of the 38th International Conference on Machine Learning},
  pages = 	 {1964--1974},
  year = 	 {2021},
  editor = 	 {Meila, Marina and Zhang, Tong},
  volume = 	 {139},
  series = 	 {Proceedings of Machine Learning Research},
  month = 	 {18--24 Jul},
  publisher =    {PMLR},
  pdf = 	 {http://proceedings.mlr.press/v139/choquette-choo21a/choquette-choo21a.pdf},
  url = 	 {https://proceedings.mlr.press/v139/choquette-choo21a.html},
}

@INPROCEEDINGS{shokri_mia,
  author={Nasr, Milad and Shokri, Reza and Houmansadr, Amir},
  booktitle={2019 IEEE Symposium on Security and Privacy (SP)}, 
  title={Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning}, 
  year={2019},
  volume={},
  number={},
  pages={739-753},
  keywords={Data models;Computational modeling;Training;Deep learning;Training data;Inference algorithms;Privacy;Privacy;Inference-Attacks;Membership-Inference;Deep-Learning;Federated-Learning;Stochastic-Gradient-Descent},
  doi={10.1109/SP.2019.00065}
}

@inproceedings{dlg,
 author = {Zhu, Ligeng and Liu, Zhijian and Han, Song},
 booktitle = {Advances in Neural Information Processing Systems},
 editor = {H. Wallach and H. Larochelle and A. Beygelzimer and F. d\textquotesingle Alch\'{e}-Buc and E. Fox and R. Garnett},
 pages = {},
 publisher = {Curran Associates, Inc.},
 title = {Deep Leakage from Gradients},
 url = {https://proceedings.neurips.cc/paper_files/paper/2019/file/60a6c4002cc7b29142def8871531281a-Paper.pdf},
 volume = {32},
 year = {2019}
}

@misc{idlg,
      title={iDLG: Improved Deep Leakage from Gradients}, 
      author={Bo Zhao and Konda Reddy Mopuri and Hakan Bilen},
      year={2020},
      eprint={2001.02610},
      archivePrefix={arXiv},
      primaryClass={cs.LG},
      url={https://arxiv.org/abs/2001.02610}, 
}

    @inproceedings{sec_agg,
    author = {Bonawitz, Keith and Ivanov, Vladimir and Kreuter, Ben and Marcedone, Antonio and McMahan, H. Brendan and Patel, Sarvar and Ramage, Daniel and Segal, Aaron and Seth, Karn},
    title = {Practical Secure Aggregation for Privacy-Preserving Machine Learning},
    year = {2017},
    isbn = {9781450349468},
    publisher = {Association for Computing Machinery},
    address = {New York, NY, USA},
    url = {https://doi.org/10.1145/3133956.3133982},
    doi = {10.1145/3133956.3133982},
    pages = {1175–1191},
    numpages = {17},
    keywords = {federated learning, machine learning, privacy-preserving protocols, secure aggregation},
    location = {Dallas, Texas, USA},
    series = {CCS '17}
    }

      

@inproceedings{tableak,
author = {Vero, Mark and Balunovi\'{c}, Mislav and Dimitrov, Dimitar I. and Vechev, Martin},
title = {TabLeak: tabular data leakage in federated learning},
year = {2023},
publisher = {JMLR.org},
abstract = {While federated learning (FL) promises to preserve privacy, recent works in the image and text domains have shown that training updates leak private client data. However, most high-stakes applications of FL (e.g., in healthcare and finance) use tabular data, where the risk of data leakage has not yet been explored. A successful attack for tabular data must address two key challenges unique to the domain: (i) obtaining a solution to a high-variance mixed discrete-continuous optimization problem, and (ii) enabling human assessment of the reconstruction as unlike for image and text data, direct human inspection is not possible. In this work we address these challenges and propose TabLeak, the first comprehensive reconstruction attack on tabular data. TabLeak is based on two key contributions: (i) a method which leverages a softmax relaxation and pooled ensembling to solve the optimization problem, and (ii) an entropy-based uncertainty quantification scheme to enable human assessment. We evaluate TabLeak on four tabular datasets for both FedSGD and FedAvg training protocols, and show that it successfully breaks several settings previously deemed safe. For instance, we extract large subsets of private data at > 90\% accuracy even at the large batch size of 128. Our findings demonstrate that current high-stakes tabular FL is excessively vulnerable to leakage attacks.},
booktitle = {Proceedings of the 40th International Conference on Machine Learning},
articleno = {1460},
numpages = {33},
location = {Honolulu, Hawaii, USA},
series = {ICML'23}
}

@inproceedings{pasquini_sec_agg,
author = {Pasquini, Dario and Francati, Danilo and Ateniese, Giuseppe},
title = {Eluding Secure Aggregation in Federated Learning via Model Inconsistency},
year = {2022},
isbn = {9781450394505},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3548606.3560557},
doi = {10.1145/3548606.3560557},
abstract = {Secure aggregation is a cryptographic protocol that securely computes the aggregation of its inputs. It is pivotal in keeping model updates private in federated learning. Indeed, the use of secure aggregation prevents the server from learning the value and the source of the individual model updates provided by the users, hampering inference and data attribution attacks.In this work, we show that a malicious server can easily elude secure aggregation as if the latter were not in place. We devise two different attacks capable of inferring information on individual private training datasets, independently of the number of users participating in the secure aggregation. This makes them concrete threats in large-scale, real-world federated learning applications.The attacks are generic and equally effective regardless of the secure aggregation protocol used They exploit a vulnerability of the federated learning protocol caused by incorrect usage of secure aggregation and lack of parameter validation. Our work demonstrates that current implementations of federated learning with secure aggregation offer only a ''false sense of security.''},
booktitle = {Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security},
pages = {2429–2443},
numpages = {15},
keywords = {federated learning, model inconsistency, secure aggregation},
location = {Los Angeles, CA, USA},
series = {CCS '22}
}
@InProceedings{phong,
author="Phong, Le Trieu
and Aono, Yoshinori
and Hayashi, Takuya
and Wang, Lihua
and Moriai, Shiho",
editor="Batten, Lynn
and Kim, Dong Seong
and Zhang, Xuyun
and Li, Gang",
title="Privacy-Preserving Deep Learning: Revisited and Enhanced",
booktitle="Applications and Techniques in Information Security",
year="2017",
publisher="Springer Singapore",
address="Singapore",
pages="100--110",
}

@INPROCEEDINGS{mkor,
  author={Wang, Feng and Velipasalar, Senem and Gursoy, M. Cenk},
  booktitle={2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)}, 
  title={Maximum Knowledge Orthogonality Reconstruction with Gradients in Federated Learning}, 
  year={2024},
  volume={},
  number={},
  pages={3872-3881},
  keywords={Data privacy;Privacy;Federated learning;Computational modeling;Neural networks;Pressing;Reconstruction algorithms;Algorithms;Adversarial learning;adversarial attack and defense methods;Algorithms;Explainable;fair;accountable;privacy-preserving;ethical computer vision},
  doi={10.1109/WACV57701.2024.00384}}

@inproceedings{lu2022april,
  title={April: Finding the achilles' heel on privacy for vision transformers},
  author={Lu, Jiahao and Zhang, Xi Sheryl and Zhao, Tianli and He, Xiangyu and Cheng, Jian},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={10051--10060},
  year={2022}
}

@InProceedings{dp_dwork,
author="Dwork, Cynthia",
editor="Bugliesi, Michele
and Preneel, Bart
and Sassone, Vladimiro
and Wegener, Ingo",
title="Differential Privacy",
booktitle="Automata, Languages and Programming",
year="2006",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="1--12",
abstract="In 1977 Dalenius articulated a desideratum for statistical databases: nothing about an individual should be learnable from the database that cannot be learned without access to the database. We give a general impossibility result showing that a formalization of Dalenius' goal along the lines of semantic security cannot be achieved. Contrary to intuition, a variant of the result threatens the privacy even of someone not in the database. This state of affairs suggests a new measure, differential privacy, which, intuitively, captures the increased risk to one's privacy incurred by participating in a database. The techniques developed in a sequence of papers [8, 13, 3], culminating in those described in [12], can achieve any desired level of privacy under this measure. In many cases, extremely accurate information about the database can be provided while simultaneously ensuring very high levels of privacy.",
isbn="978-3-540-35908-1"
}

@misc{local_dp,
title = {Protection Against Reconstruction and Its Applications in Private Federated Learning},
author = {Abhishek Bhowmick and John Duchi and Julien Freudiger and Gaurav Kapoor and Ryan Rogers},
year = {2019},
URL = {https://arxiv.org/pdf/1812.00984}
}

@article{Raynaud_1970,
title={Sur L’enveloppe convexe des nuages de points aleatoires dans Rn. I},
volume={7},
DOI={10.2307/3212146},
number={1},
journal={Journal of Applied Probability},
author={Raynaud, H.},
year={1970},
pages={35–48}
}

@article{DBLP:journals/jacm/BentleyKST78,
  author       = {Jon Louis Bentley and
                  H. T. Kung and
                  Mario Schkolnick and
                  Clark D. Thompson},
  title        = {On the Average Number of Maxima in a Set of Vectors and Applications},
  journal      = {J. {ACM}},
  volume       = {25},
  number       = {4},
  pages        = {536--543},
  year         = {1978},
  url          = {https://doi.org/10.1145/322092.322095},
  doi          = {10.1145/322092.322095},
  timestamp    = {Sun, 19 Jan 2025 14:36:56 +0100},
  biburl       = {https://dblp.org/rec/journals/jacm/BentleyKST78.bib},
  bibsource    = {dblp computer science bibliography, https://dblp.org}
}

@inproceedings{cifar10,
  title={Learning Multiple Layers of Features from Tiny Images},
  author={Alex Krizhevsky},
  year={2009},
  url={https://api.semanticscholar.org/CorpusID:18268744}
}

@article{diana2024attributeinferenceattacksfederated, title={Attribute Inference Attacks for Federated Regression Tasks}, volume={39}, url={https://ojs.aaai.org/index.php/AAAI/article/view/33787}, DOI={10.1609/aaai.v39i15.33787}, abstractNote={Federated Learning (FL) enables multiple clients, such as mobile phones and IoT devices, to collaboratively train a global machine learning model while keeping their data localized. However, recent studies have revealed that the training phase of FL is vulnerable to reconstruction attacks, such as attribute inference attacks (AIA), where adversaries exploit exchanged messages and auxiliary public information to uncover sensitive attributes of targeted clients. While these attacks have been extensively studied in the context of classification tasks, their impact on regression tasks remains largely unexplored. In this paper, we address this gap by proposing novel model-based AIAs specifically designed for regression tasks in FL environments. Our approach considers scenarios where adversaries can either eavesdrop on exchanged messages or directly interfere with the training process. We benchmark our proposed attacks against state-of-the-art methods using real-world datasets. The results demonstrate a significant increase in reconstruction accuracy, particularly in heterogeneous client datasets, a common scenario in FL. The efficacy of our model-based AIAs makes them better candidates for empirically quantifying privacy leakage for federated regression tasks.}, number={15}, journal={Proceedings of the AAAI Conference on Artificial Intelligence}, author={Diana, Francesco and Marfoq, Othmane and Xu, Chuan and Neglia, Giovanni and Giroire, Frédéric and Thomas, Eoin}, year={2025}, month={Apr.}, pages={16271-16279} }

@inproceedings{Paverd2014ModellingAA,
  title={Modelling and Automatically Analysing Privacy Properties for Honest-but-Curious Adversaries},
  author={Andrew J. Paverd and Andrew C. Martin},
  year={2014},
  url={https://api.semanticscholar.org/CorpusID:211141069}
}

@inproceedings{45187,
title	= {Revisiting Distributed Synchronous SGD},
author	= {Jianmin Chen and Rajat Monga and Samy Bengio and Rafal Jozefowicz},
year	= {2016},
URL	= {https://arxiv.org/abs/1604.00981},
booktitle	= {International Conference on Learning Representations Workshop Track}}


@inproceedings{
brown2023verifying,
title={Verifying the Union of Manifolds Hypothesis for Image Data},
author={Bradley CA Brown and Anthony L. Caterini and Brendan Leigh Ross and Jesse C Cresswell and Gabriel Loaiza-Ganem},
booktitle={The Eleventh International Conference on Learning Representations },
year={2023},
url={https://openreview.net/forum?id=Rvee9CAX4fi}
}

@inproceedings{
pope2021the,
title={The Intrinsic Dimension of Images and Its Impact on Learning},
author={Phil Pope and Chen Zhu and Ahmed Abdelkader and Micah Goldblum and Tom Goldstein},
booktitle={International Conference on Learning Representations},
year={2021},
url={https://openreview.net/forum?id=XJk19XzGq2J}
}

@inproceedings{NIPS2010_8a1e808b,
 author = {Narayanan, Hariharan and Mitter, Sanjoy},
 booktitle = {Advances in Neural Information Processing Systems},
 editor = {J. Lafferty and C. Williams and J. Shawe-Taylor and R. Zemel and A. Culotta},
 pages = {},
 publisher = {Curran Associates, Inc.},
 title = {Sample Complexity of Testing the Manifold Hypothesis},
 url = {https://proceedings.neurips.cc/paper_files/paper/2010/file/8a1e808b55fde9455cb3d8857ed88389-Paper.pdf},
 volume = {23},
 year = {2010}
}

@inproceedings{chupanning,
  title={Panning for Gold in Federated Learning: Targeted Text Extraction under Arbitrarily Large-Scale Aggregation},
  author={Chu, Hong-Min and Geiping, Jonas and Fowl, Liam H and Goldblum, Micah and Goldstein, Tom},
  booktitle={The Eleventh International Conference on Learning Representations},
year={2023}
}

@inproceedings{fowldecepticons,
  title={Decepticons: Corrupted Transformers Breach Privacy in Federated Learning for Language Models},
  author={Fowl, Liam H and Geiping, Jonas and Reich, Steven and Wen, Yuxin and Czaja, Wojciech and Goldblum, Micah and Goldstein, Tom},
  booktitle={The Eleventh International Conference on Learning Representations},
year={2023}
}

