Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction
Shanghao Shi, Ning Wang, Xiao Yang, Chaoyu Zhang, Yi Shi, Y. Thomas Hou, Wenjing Lou · 2025
Federated learning is known for its capability to safeguard the participants' data privacy.However, recently emerged model inversion attacks (MIAs) have shown that a malicious parameter server can reconstruct individual users' local data samples from model updates.The state-of-the-art attacks either rely on computation-intensive iterative optimization methods to reconstruct each input batch, making scaling difficult, or involve the malicious parameter server adding extra modules before the global model architecture, rendering the attacks too conspicuous and easily detectable.To overcome these limitations, we propose Scale-MIA, a novel MIA capable of efficiently and accurately reconstructing local training samples from the aggregated model updates, even when the system is protected by a robust secure aggregation (SA) protocol.Scale-MIA utilizes the inner architecture of models and identifies the latent space as the critical layer for breaching privacy.Scale-MIA decomposes the complex reconstruction task into an innovative two-step process.The first step is to reconstruct the latent space representations (LSRs) from the aggregated model updates using a closed-form inversion mechanism, leveraging specially crafted linear layers.Then in the second step, the LSRs are fed into a fine-tuned generative decoder to reconstruct the whole input batch.We implemented Scale-MIA on commonly used machine learning models and conducted comprehensive experiments across various settings.The results demonstrate that Scale-MIA achieves excellent performance on different datasets, exhibiting high reconstruction rates, accuracy, and attack efficiency on a larger scale compared to state-of-the-art MIAs.Our code is available at https://github.com/unknown123489/Scale-MIA.Break Secure Attacker's Attack Attack Need Auxiliary Model Attack Aggregation?Capability Overhead Scale Dataset?Agnostic?DLG [3], iDLG [4] No Weak (Curious) Large Single image No Yes Inverting Grad [5] No Weak (Curious) Large 8 No Yes GradInversion [7] No Weak (Curious) Large 48 No No (ResNet) GradViT [9] No Weak (Curious) Large 8 No No (ViT) APRIL-Optim [8] No Weak (Curious) Large Single-image No No (ViT) APRIL-Analytic [8] No Weak (Curious) Small Single-image No No (ViT) R-GAP [6] No Weak (Curious) Small Single-image No Yes Leak in FA [25] No Weak (Curious) Small 50 No Yes Fishing for data [17] Yes Medium (Modify params) Large 256 Yes Yes Eluding SecureAgg [16] Yes Medium (Modify params) Large 512 Yes Yes Robbing the fed [18] Yes Strong (Change architect) Small 1024+ Yes Yes LOKI [19] Yes Strong (Change architect) Small 1024+ Yes Yes