We show that aggregated model updates in federated learning may be insecure.
An untrusted central server may disaggregate user updates from sums of updates
across participants given repeated observations, enabling the server to recover
privileged information about individual users' private training data via
traditional gradient inference attacks. Our method revolves around
reconstructing participant information (e.g: which rounds of training users
participated in) from aggregated model updates by leveraging summary
information from device analytics commonly used to monitor, debug, and manage
federated learning systems. Our attack is parallelizable and we successfully
disaggregate user updates on settings with up to thousands of participants. We
quantitatively and qualitatively demonstrate significant improvements in the
capability of various inference attacks on the disaggregated updates. Our
attack enables the attribution of learned properties to individual users,
violating anonymity, and shows that a determined central server may undermine
the secure aggregation protocol to break individual users' data privacy in
federated learning.

通过聚合模型更新，掌握联邦学习中的用户隐私信息可能存在风险，破坏了联邦学习的数据安全，研究展示了一种攻击方法，通过聚合的模型更新重建用户和其私有训练数据之间的联系，属于一种细致入微、平行操作并具有较高灵敏度的推断攻击。