FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

2026-07-08 · Source: Takara TLDR - Daily AI Papers · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, medium

Summary

FedCVESA introduces a novel white-box "Taking Away Training Data" (TATD) attack designed for Federated Learning (FL) environments. This attack, a federated variant of Correlation Value Encoding Attack (CVEA), demonstrates how a malicious server can actively embed private training data into a global model. The method involves adding a Pearson-correlation regularizer to the loss function of targeted clients, encoding private data into specific "carrier parameters." To counteract the overwriting effect of multi-client averaging, FedCVESA employs a segmented aggregation strategy, preserving these carrier parameters while applying standard averaging to the rest. Experimental evaluations on MNIST, Fashion-MNIST, and CIFAR-10 datasets, under Dirichlet non-IID partitions, successfully extracted semantically meaningful private training images. Crucially, the attack maintained acceptable main-task utility, confirming that FL can serve as a parameter-level memorization channel for active TATD attacks in a white-box malicious-server setting.

Key takeaway

For AI Security Engineers designing or auditing federated learning systems, you must account for sophisticated white-box data extraction attacks. This research demonstrates that malicious servers can actively embed and recover private training data from global models, even with aggregation. You should implement robust defenses against parameter-level memorization and consider advanced aggregation strategies that prevent targeted data encoding, rather than relying solely on standard privacy-preserving techniques.

Key insights

Federated learning can be exploited by malicious servers to embed and extract private training data.

Principles

• Deep models memorize training data.
• Selective aggregation can preserve encoded data.
• Correlation regularizers embed private data.

Method

FedCVESA adds a Pearson-correlation regularizer to target client loss functions to encode data into "carrier parameters." Segmented aggregation then preserves these parameters during server updates.

In practice

• Implement correlation-based data encoding.
• Design aggregation to protect specific parameters.
• Test FL systems for parameter-level data leakage.

Topics

• Federated Learning
• Data Privacy
• White-box Attacks
• Data Extraction
• Model Memorization
• Correlation Encoding
• Segmented Aggregation

Code references

• an7123/FedKT-CSD
• tum-pbs/CRAFT

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation — Federated learning can be exploited by malicious servers to actively encode and recover private training data.
• Privacy-Preserving and Verifiable Approximate Distributed Coded Computing — Model-agnostic framework unifies privacy and adversarial resilience in distributed learning via coded computing and specific defenses.
• Statistical Limits and Efficient Algorithms for Differentially Private Federated Learning — New methods improve federated learning accuracy and communication efficiency while preserving differential privacy.
• dsLassoCov: a federated Lasso approach incorporating covariate control — dsLassoCov efficiently controls covariates in federated learning for high-dimensional biomedical data, enabling privacy-preserving analysis.
• FedXDS: Leveraging Model Attribution Methods to counteract Data Heterogeneity in Federated Learning — FedXDS uses XAI feature attribution to selectively share data, mitigating heterogeneity in federated learning while preserving privacy.
• Detecting Data Contamination in Large Language Models — Black-box MIAs are currently ineffective at reliably detecting data contamination in LLM training corpora.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Takara TLDR - Daily AI Papers.