DESIGN OF A STEALTHY DATA RECONSTRUCTION ATTACK FOR FEDERATED LEARNING

Federated Learning enables multiple clients to collaboratively train a machine learning model while keeping their training data locally stored. Although this paradigm reduces the need to centralize sensitive information, recent studies have demonstrated that the information exchanged during the training process can still expose clients to significant privacy risks. In particular, a malicious server may exploit the gradients shared by participating clients to infer or reconstruct their private training data. This work investigates analytical Gradient Inversion Attacks in Federated Learning under an actively malicious server threat model. The analysis of existing gradient inversion attacks reveals an empirical trade-off between reconstruction performance and detectability. Highly effective attacks may rely on pronounced modifications or structured patterns in the model parameters, making their presence easier to detect. Conversely, limiting such modifications can reduce the attacker's reconstruction capabilities. Therefore, reconstruction performance and detectability should be considered jointly when evaluating the privacy risk posed by server-side gradient inversion attacks. The objective of this work is to improve this trade-off by designing an attack capable of achieving high reconstruction performance while limiting the detectability of the malicious model modifications. To this end, we propose the Random Cuts Reconstruction Attack (RCRA), a novel server-side analytical Gradient Inversion Attack based on random hyperplanes. The proposed approach exploits the geometry induced by the randomly initialized neurons of a neural network to isolate client samples and reconstruct them from the corresponding gradients. Unlike previous malicious-server attacks, the proposed method preserves the randomly initialized, full-rank structure of the attacked layer and performs the attack within a single communication round, reducing both structural anomalies and the amount of malicious interaction required. An oracle-based analysis shows that complete reconstruction is achievable for batches of up to 256 samples with a sufficiently large attacked layer. Experimental results obtained in a realistic setting, without relying on oracle knowledge, further demonstrate that the proposed attack can reconstruct up to 82% of the samples in a batch of 128 CIFAR-10 images. Additional experiments on CIFAR-100 and Tiny-ImageNet demonstrate that the attack remains effective across datasets of increasing complexity. Detectability analyses based on neuron diversity, rank ratio, and weight entropy further show that RCRA preserves the statistical properties of the attacked layer close to those of its benign initialization. The results demonstrate that effective gradient inversion can be performed while reducing the detectability associated with malicious model manipulation, highlighting persistent privacy vulnerabilities in Federated Learning and the need for robust mechanisms against malicious server-side attacks.