When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
Wenrui Yu, Changlong Ji, Johannes Bjerva, Qiongxiu Li
cs.CR · cs.LG
Quick verdict
Reduces DFL secure-aggregation leakage to lattice HSSP/HLCP; attack recovers updates in small sparse graphs, but only first round and heavy collusion.
Summary
The paper shows that Secure Aggregation (SA) in Decentralized Federated Learning (DFL) leaks private model states when sparse topologies give colluding semi-honest nodes asymmetric aggregate views. The authors formalize neighborhood aggregation as a multidimensional Hidden Subset Sum / Hidden Linear Combination Problem (mHSSP/mHLCP): after integer scaling of rational weights (factor beta) and states (precision gamma), the colluders' observation system becomes a modular hidden-coefficient problem solved with a Nguyen-Stern lattice attack (LLL, then BKZ), topology-based filtering under three awareness levels (neighbor identities, degrees, or none), and a noise-tolerant augmented lattice for finite precision. On Erdos-Renyi graphs (n=10-20, corruption fractions eta=0.6-0.8), weight-matrix recall ranges 72-100% (Table 1), degrading as the honest share grows. End-to-end experiments on CIFAR-10, Purchase, and Sentiment140 show that gradient inversion driven by recovered updates achieves fidelity nearly identical to attacking the true gradient (Table 6); even spurious candidate solutions leak recognizable content. The attack tolerates truncation at about 8 decimal places (Table 3). Local DP leaves the algebraic structure intact, while aggregation-level DP disrupts the exact attack. Main limitations, acknowledged in Section 9: exact recovery is shown only for the first round with known initialization, requires at least as many corrupted as honest nodes per core, needs topological priors, and is tested only on small cores with 60-80% corruption.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Sparse DFL topologies give colluding semi-honest nodes asymmetric aggregate views that expose multiple hidden linear combinations of honest nodes' private states.
- Reconstructing honest states from these aggregates reduces to the multidimensional Hidden Subset Sum / Hidden Linear Combination Problem (Theorem 1), solvable via Nguyen-Stern lattice reduction with topology-based filtering.
- In the first training round with known initialization, when each core sub-graph contains at least as many corrupted as honest nodes, the attack recovers honest updates exactly, enabling downstream gradient inversion with fidelity nearly identical to attacking the true gradient (Table 6).
- A noise-tolerant augmented-lattice variant keeps the attack effective under finite-precision truncation down to about 8 decimal places (Table 3).
- Local DP does not break the algebraic structure the attack exploits, whereas aggregation-level DP disrupts the exact attack in their experiments (Section 7.6).
Strengths
Clean formal reduction with positioning against prior art
Theorem 1 (proof in Appendix D) rigorously maps the post-pruning observation system Y = W_ch X_h onto mHSSP/mHLCP via integer scaling (beta for rational weights, gamma for state precision) modulo a large prime Q; Proposition 1 (Appendix C) shows the multi-round system decouples into per-round instances, and Appendix F case studies subsume Mrini et al. and Dekker et al. as special cases. Table 4 correctly positions this as the first DFL attack handling unknown weights under SA in a single round.
Sparsity-aware decomposition makes an exponential attack practical
Topological pruning (Section 4.2) strips trivial links so that even 100-200-node sparse graphs decompose into core sub-graphs of size mostly 0-10 (Figures 6-7, across ER, ring, small-world and scale-free families), keeping the 2^Omega(N) Step 2 of Nguyen-Stern cheap; directed graphs and Push-Sum are handled in the same linear-mixing frame (Appendix A).
Realistic attack engineering beyond textbook HSSP
Paired end-to-end validation across three modalities
Candid limitations and defense analysis
Weaknesses
Narrow operating regime relative to the abstract's framing
Thin statistical reporting
Text-modality leakage is much weaker than the headline
Unexamined sensitivity to adversary protocol knowledge
No code-availability statement visible
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This CCS '26 paper attacks Secure Aggregation (SA) as instantiated in Decentralized Federated Learning, where each node receives only a weighted aggregate over its neighbors. The claimed contributions are threefold: (1) sparse DFL topologies give colluding semi-honest nodes asymmetric aggregate views exposing multiple hidden linear combinations of honest states; (2) reconstruction formally reduces to the multidimensional Hidden Subset Sum / Hidden Linear Combination Problem (mHSSP/mHLCP) - Theorem 1, proved in Appendix D via integer scaling of rational weights (factor beta) and states (precision gamma), then reduction modulo a large prime Q; (3) a Nguyen-Stern lattice attack (Section 5.2: orthogonal-lattice LLL in Step 1, BKZ plus binary-combination search in Step 2) with topology-driven filtering (Section 6) and a noise-tolerant augmented lattice (Section 5.5) makes the problem tractable in realistic cores. The threat model (Section 3) is honest-but-curious collusion under three awareness priors: neighbor identities (Case 1), in-degrees (Case 2), or no metadata (Case 3). Section 9 scopes the claims honestly; the abstract states them without those qualifiers.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does secure aggregation actually protect privacy in decentralized federated learning?
According to this paper, not by itself. In decentralized FL, each node receives a weighted aggregate of its neighbors' updates. In sparse networks, several colluding semi-honest nodes together observe multiple hidden linear combinations of honest nodes' states, and the authors show these can be untangled with lattice-based algorithms (hidden subset sum style), recovering honest updates at least in the first training round, when each small neighborhood contains at least as many corrupted as honest nodes (their tests use 60-80% corruption).
What is the Hidden Subset Sum Problem and how is it used in this attack?
The Hidden Subset Sum Problem (HSSP) asks you to recover unknown binary coefficient vectors from a modular weighted sum of them. The paper maps each neighborhood aggregate in decentralized FL to a multidimensional HSSP/HLCP instance - aggregation weights become hidden coefficients, model states become secrets - and solves it with the Nguyen-Stern lattice attack using LLL and BKZ reduction, plus filters based on network topology to remove wrong candidate solutions.
Can differential privacy defend against this lattice attack?
Partly, and it depends where the noise is added. The paper finds local DP (noise on each node's update before aggregation) does not break the algebraic structure the attack exploits, though noise magnitude still limits what can be reconstructed about the data. Aggregation-level DP (noise added to the aggregate) disrupts the exact attack in their experiments; a noise-tolerant lattice variant still recovered 25-50% of the hidden weight vectors, which the authors themselves flag as a preliminary result.
Is the attack practical against large federated networks?
Within the paper's regime, plausibly yes: the authors show that large sparse graphs (100-200 nodes) decompose into small core sub-problems (mostly 10 nodes or fewer), where the lattice attack runs in sub-second to a few seconds. However, demonstrated success requires the first training round with known initialization, at least as many corrupted as honest nodes in a core, topology side information, and tested corruption fractions of 60-80%.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The provided text is a sampled excerpt with marked [...sampling gap...] regions (parts of Sections 3-4.1, most of Section 6, Sections 7.1-7.3, references 20-63, and parts of Appendices J-L); judgments above avoid relying on skipped content.
- The excerpt ends mid-way through the Appendix L candidate reconstruction tables; content after that point was not provided.
- Figures appear only as captions (image content not extractable); numeric assessments rely on in-text tables and stated values.
- No code-availability statement is visible in the provided text; one could exist in a skipped section.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.