1 Introduction↩︎

Federated Learning (FL) [1] is a framework that enables distributed training of machine learning models without transmission of private data from clients to a central server. By design, FL limits communication to local updates, such as gradients or parameters, under the assumption that keeping the data on the client guarantees privacy. However, recent research has fundamentally challenged this supposition, demonstrating that shared gradients retain significant imprint of the training data, allowing adversaries to reconstruct private inputs through Gradient Inversion Attacks (GIA) [2]–[5].

Early research primarily operated under the honest-but-curious threat model, ignoring the risks posed by an untrusted third-party server or compromised infrastructure. To address this gap, [6] and [7] explored the malicious server scenario, where the server actively manipulates model parameters to force clients data leakage. Recent advancements in this domain have focused on overcoming batch size limitations [8], improving noise robustness [9] and reducing detectability [10].

Despite substantially advancing the practical power of gradient inversion, existing attacks cannot certify that a reconstruction matches the true underlying sample, unless they have access to some prior knowledge about the dataset. In vision and language domains, this issue is often mitigated through human inspection; for example, [11] rely on crowd-sourced human evaluation to assess the recognizability of reconstructed images. In contrast, tabular data, which is central to many real-world federated learning applications [12], [13], does not offer comparable semantic validation methods [14]. As noted by [14], for an uninformed adversary it is often close to impossible to assess reconstruction quality in tabular settings, substantially complicating reliable privacy risk estimation. Figure 1 illustrates the difficulty to recognize erroneously reconstructed tabular data.

To date, only [14] explicitly addresses this issue by proposing an entropy-based measure to quantify reconstruction certainty. However, their approach requires repeating the same optimization-based attack from ten to thirty times to obtain an ensemble of reconstructions, incurring significant computational overhead while still inheriting the batch-size limitations of optimization-based attacks in the honest-but-curious setting. By contrast, [17] propose an analytical attack whose reconstructions can be verified with high probability, but their method requires the batch size to be smaller than the input dimension—a condition that is typically satisfied in vision and language settings but is impractical for tabular data.

To rigorously audit the privacy risk in tabular FL, we operate within the malicious server threat model. We present a novel reconstruction attack wherein the server, by crafting specific model parameters, successfully isolates individual samples within an aggregated batch, introducing a subspace verification method that allows the attacker to verify whether the isolation process is successful, eliminating the reliance on heuristics. Once the input features of a sample are recovered, our framework enables the exact reconstruction of the corresponding target value, resulting in a complete breach of the record. Our contributions are summarized as follows:

• We introduce VGIA, a novel analytical gradient inversion attack. Unlike prior heuristic methods, our approach certifies whether a reconstruction is correct, establishing a more rigorous baseline for privacy auditing.

• VGIA achieves exact reconstruction of both input features and—under a broad class of loss functions—target values. To the best of our knowledge, this is the first attack to provably recover continuous targets in regression settings.

• We empirically validate VGIA on both tabular and image datasets, demonstrating exact record recovery even under large-batch aggregation and cross-domain applicability.

2 Background and Related Work↩︎

Federated Learning (FL) enables a set of clients \(\mathcal{C}\), coordinated by a central server, to collaboratively optimize a shared global model \(\theta\). The training objective is to minimize the weighted average of the clients’ empirical risks: \[\label{eq:globalobjective} \min_{\theta\in \mathbb{R}^d} {\mathcal{L}}(\theta) = \sum_{c\in \mathcal{C}} p^c\mathcal{L}(\theta, \mathcal{D}^c),\tag{1}\] where \(\mathcal{D}^c= \{({\mathbf{x}}_i^c, y_i^c)\}_{i=1}^{n^c}\) denotes the local dataset of client \(c\) and \(p^c\) is a positive weight satisfying \(\sum_{c\in \mathcal{C}} p^c = 1\), typically proportional to the dataset size or set uniformly. The optimization proceeds in communication rounds. In each round, participating clients download the current global model, compute local updates using their data, and send these updates to the server. Depending on the algorithm, clients may perform either a single stochastic gradient update (FedSGD; [18]) or multiple stochastic gradient steps (FedAvg; [1]).

Recent work shows that during FedSGD and FedAvg training, a server can reconstruct private client data via gradient inversion attacks (GIAs) by eavesdropping on exchanged messages in the honest-but-curious setting or by crafting global model parameters in the malicious setting. Following [19], GIAs can be grouped into three families: optimization-based, generative model-based, and analytical-based. Below, we briefly review these approaches and highlight their limitations in terms of verifiability.

2.0.0.1 Optimization-Based attacks

Optimization-based attacks were the first approach to recover client inputs from FL updates [2]. Starting from dummy inputs and labels, the attacker reconstructs data by minimizing the discrepancy between gradients computed on the dummy data and the observed pseudo-gradients. To improve reconstruction quality, several works decouple label and input recovery [20]–[24], often augmenting the objective with regularization terms or image priors [3], [22], [23], [25]. [4] propose separating per-sample gradient contributions via Independent Component Analysis, while [26] exploit information aggregated across multiple communication rounds. Nevertheless, reconstruction quality still degrades sharply for ImageNet batch sizes exceeding 256. Under a malicious threat model, [27]–[29] propose attacks that selectively amplify per-sample gradient contributions, mitigating the obfuscating effects of large batch sizes. These methods assume the adversary has access to an auxiliary dataset drawn from a similar distribution.

2.0.0.2 Generative Model-Based attacks

Optimization-based attacks become computationally prohibitive for high-dimensional data, e.g., high-resolution images. Consequently, recent work leverages generative models, including generative adversarial networks and diffusion models. In the honest-but-curious setting, instead of optimizing directly over the batch of inputs, the attacker trains a generative model to match the gradient of generated samples to the observed pseudo-gradient [30]–[38]. In the malicious setting, the server locally trains an encoder and a secret generative decoder using an auxiliary dataset. The encoder, instantiated as a crafted global model, either conceals the amplification of a target sample’s gradient [10] or facilitates reconstruction from a latent space [9]. The decoder is then applied on the server to recover client inputs.

2.0.0.3 Analytical attacks

Analytic attacks can recover exact inputs by exploiting analytical properties of gradients on fully connected ReLU layers; we review the underlying theory in Sec. 4.1. In the honest-but-curious setting, [39] demonstrate the feasibility of such attacks on convolutional neural networks for batch size one. Subsequent work [5], [17] extends these attacks to batch sizes up to 200 by exploiting the low-rank structure and sparsity of gradients, requiring a batch size smaller than the input dimension. In the malicious setting, [7], [40] craft neurons that activate for a single sample per batch, but their approaches suffer fundamental accuracy limits, especially on low-dimensional data [8]. Other work [6], [41]–[43] uses pairs of neurons activating on the same set of samples except one, requiring prior knowledge of data distributions. [8] remove this assumption via a binary search scheme, recovering up to 1024 ImageNet samples per batch in 10 rounds. In parallel, [44] decouple gradients by label, but requiring one sample per class in the batch.

2.0.0.4 Limitation on verifiability

To assess the success of GIAs, prior work typically evaluates reconstructions against ground-truth samples (available to the experimenter). For noisy reconstructions produced by optimization-based or generative attacks, image studies commonly report SSIM, PSNR, and LPIPS, while text studies often use exact match / token-level accuracy and sequence-overlap metrics such as BLEU or ROUGE. For analytic attacks, where the output is either an exact sample or a linear combination of samples, a common metric is the fraction of reconstructions that exactly match a true record (up to numerical tolerance). As noted in [14], these ground-truth-based metrics do not reflect the attacker’s perspective: without access to the original batch, the adversary lacks a per-reconstruction certificate of success. Even an attack that consistently recovers a small fraction of samples (e.g., \(10\%\)) can pose a serious privacy threat, but its practical impact is greatly reduced if the attacker cannot identify which reconstructions are correct. Ideally, GIAs should therefore provide an intrinsic verification mechanism. For vision and language data, verification may rely on human inspection, but this is largely infeasible for tabular records (Fig. 1). Despite its practical importance, verifiability has been largely overlooked in the GIA literature; only a few works offer any form of verification, typically under restrictive conditions.

[14] propose an optimization-based attack tailored to tabular data and introduce an entropy-based verification score that requires repeatedly solving the same optimization problem to obtain an ensemble of local minima. Feature-wise entropy is then computed across these minima, and the \(25\%\) lowest-entropy features are deemed valid. However, this procedure is computationally expensive and still yields noisy, incomplete reconstructions with missing features, while providing only a heuristic notion of verification. Although analytical attacks can yield exact reconstructions rather than noisy ones, verification remains non-trivial. The approaches of [5], [17] require the batch size to be smaller than the input dimension, a condition rarely met in tabular datasets. Meanwhile, the attack of [8] is verifiable only if the attacker has prior knowledge of the minimum separation between projected inputs within a batch—an assumption that is difficult to justify in practice.

3 Threat model↩︎

We consider a threat model in which the central server acts as a malicious adversary and actively modifies the model parameters sent to clients. This setting is consistent with prior work on malicious-server attacks in Federated Learning [6]–[9], [27].

Clients are assumed to trust the server and therefore apply the received model parameters without verification before computing and sending their updates. At the same time, the server cannot artificially modify the architecture of the model, for example by adding layers, modifying layers’ connections [6], [43] or activation functions. In contrast to [6], [27], we assume that the attacker has no auxiliary knowledge of the data distribution beyond known bounds on the input features. Furthermore, unlike [7], [9], [10], [27], we do not assume access to any auxiliary or public datasets. In the following, we assume that clients update the global model using FedSGD with full-batch updates.

4 Our attack↩︎

4.1 Preliminaries↩︎

4.1.0.1 Analytic Gradient Inversion

Our work builds upon the fundamental observation that the gradients of a fully connected (FC) layer followed by a ReLU activation can contain sufficient information to analytically recover input data [3], [6], [8], [45].

Consider a model whose first (attacked) layer is a linear layer with \(N\) neurons, parameterized by weights \(\mathbf{W}^a \in \mathbb{R}^{N \times d}\) and biases \({\mathbf{b}}^a \in \mathbb{R}^N\). For neuron \(i\), the post-activation output is \[z_i^a = \mathrm{ReLU}\!\left(\mathbf{W}_i^a {\mathbf{x}}+ b_i^a\right),\] where \({\mathbf{x}}\in \mathbb{R}^d\) denotes the layer input. For a training example \(({\mathbf{x}}_j, y_j)\), let \(z_{i,j}^ a\) denote the activation of neuron \(i\). The gradients of the per-sample loss \(\mathcal{L}_j\) with respect to the weights and bias of neuron \(i\) are \[\begin{align} \frac{\partial \mathcal{L}_j}{\partial \mathbf{W}_i^a} & = \frac{\partial \mathcal{L}_j}{\partial z_{i}^ a}\frac{\partial z_{i}^a}{\partial \mathbf{W}_i^a} = \frac{\partial \mathcal{L}_j}{\partial z_{i}^a}\, {\mathbf{x}}_j\, \mathbb{1}_{z_{i,j}^a>0}, \tag{2}\\ \frac{\partial \mathcal{L}_j}{\partial b_i^a} & = \frac{\partial \mathcal{L}_j}{\partial z_{i}^a}\frac{\partial z_{i}^a}{\partial b_i^a} = \frac{\partial \mathcal{L}_j}{\partial z_{i}^a}\, \mathbb{1}_{z_{i,j}^a>0}. \tag{3} \end{align}\] The indicator \(\mathbb{1}_{z_{i,j}>0}\) encodes whether \({\mathbf{x}}_j\) activates neuron \(i\). Therefore, whenever \(z_{i,j}>0\) and \(\nabla_{b_i^a}\mathcal{L}_j \neq 0\), the input can be recovered exactly from the gradients via \[\label{eq:single95point95reconstruction} {\mathbf{x}}_j = \frac{\partial \mathcal{L}_j}{\partial \mathbf{W}_i^a}\left( \frac{\partial \mathcal{L}_j}{\partial b_i^a} \right)^{-1}.\tag{4}\]

In FedSGD, the server does not observe per-sample gradients; instead, it receives the gradient of the batch-averaged loss \(\mathcal{L}=\frac{1}{B}\sum_{j=1}^B \mathcal{L}_j\), computed over the batch \(\mathcal{B}=\{({\mathbf{x}}_j,y_j)\}_{j=1}^B\). As shown in prior work [8], [40], taking the ratio of the corresponding gradient components as in 4 allows the server to recover a linear combination of the batch inputs (we call this an observation): \[\begin{align} {\mathbf{o}}_i & \;=\; \frac{\partial \mathcal{L}}{\partial \mathbf{W}_i^a}\left(\frac{\partial \mathcal{L}}{\partial b_i^a}\right)^{-1} \;=\; \sum_{j=1}^B \alpha_j {\mathbf{x}}_j, \label{eq:observation}\\ \alpha_j & \;=\; \frac{\frac{\partial \mathcal{L}_j}{\partial b_i^a}}{\sum_{k=1}^B \frac{\partial \mathcal{L}_k}{\partial b_i^a}}. \end{align}\tag{5}\] Only the samples \({\mathbf{x}}_j\) that activate neuron \(i\) contribute to observation \({\mathbf{o}}_i\), i.e., they are the only ones with \(\alpha_j \neq 0\). We refer to this subset as the set of active samples and denote the set of their indices by \(\mathcal{A}_i = \{j \in [B] \mid \mathbf{W}_i^a {\mathbf{x}}_j + b_i^a > 0\}\).

Disentangling individual samples from the aggregate \({\mathbf{o}}_i\) is the central challenge in analytic gradient inversion.

4.1.0.2 Geometric Isolation

To address this, [8] adopt a geometric view of ReLU-based leakage through the activation boundary. For neuron \(i\), the weights \(\mathbf{W}_i^a\) and bias \(b_i^a\) define the hyperplane \(\mathcal{H}_i=\{{\mathbf{x}}\in\mathbb{R}^d \mid \mathbf{W}_i^a {\mathbf{x}}+ b_i^a = 0\}\), which partitions the batch into inputs on the ReLU-active side \(\mathbf{W}_i^a {\mathbf{x}}+ b_i^a > 0\) and on the inactive side \(\mathbf{W}_i^a {\mathbf{x}}+ b_i^a \le 0\). Fixing \(\mathbf{W}_i^a\) and varying \(b_i^a\) translates \(\mathcal{H}_i\) along its normal direction, yielding a family of parallel hyperplanes that sweep across the batch. Building on this interpretation, [8] propose the CTP algorithm, which searches over \(b_i^a\) to identify thresholds \(\hat{b}_{i,1}^* < \dots < \hat{b}_{i,B+1}^*\) such that the slab between two consecutive hyperplanes contains exactly one batch element \({\mathbf{x}}_k\). The resulting sequence of gradient-ratio observations forms a linear system; under Assumption 4.1 in [8] which states that \(\partial \mathcal{L}_j/\partial b_i^a\) does not depend on \(b_i^a\), this system can be solved to reconstruct the entire batch.¹ Moreover, multiple hyperplanes can be queried within the same FedSGD round by attacking different neurons.

It is important to note that while CTP can detect when a slab contains no samples (and thus avoid placing further hyperplanes there), it cannot distinguish whether a non-empty slice contains one or multiple samples. Consequently, it keeps bisecting any slice that contains at least one point until two consecutive hyperplanes are within distance \(\epsilon\) (a user-chosen parameter). Figure 2 (a) illustrates a case where CTP correctly recovers three inputs after 6 rounds (3 hyperplanes per round, 18 hyperplanes total). In contrast, Fig. 2 (c) shows a failure where two inputs lie closer than \(\varepsilon\); CTP stops before separating them, leading to incorrect reconstruction.

From the discussion above, two key limitations of CTP emerge:

• Unverifiability: CTP cannot certify the correctness of the reconstructed samples and produce systematic errors when the projections of two inputs onto the direction \(\mathbf{W}_i^a\) are closer than \(\varepsilon\). In a realistic blind threat model, the adversary lacks the prior knowledge needed to tune \(\varepsilon\) empirically.

• Inadaptability: CTP bisects every non-empty slab down to resolution \(\varepsilon\), potentially spending multiple attack rounds to further refine samples that were already isolated early on.

4.2 Attack method↩︎

Our new dynamic attack addresses the two limitations of CTP. First, it introduces an algebraic step that makes isolation events verifiable: the attacker can certify when a slice contains a single input. Second, once a slice is certified to contain a single input, our algorithm removes it from further refinement and may allocate future hyperplane queries adaptively across unexplored regions, avoiding unnecessary dissections and reducing the number of communication rounds required for full-batch reconstruction.

Figure 2 (b) illustrates that, by correctly identifying slices that contain a single input, our attack reconstructs all samples in only \(4\) rounds (\(12\) hyperplanes), compared to \(6\) rounds (\(18\) hyperplanes) for CTP (Fig. 2 (a)). Moreover, Fig. 2 (d) shows that our protocol adapts the number of rounds and hyperplanes to the specific batch: in this example it continues for \(8\) rounds to isolate all inputs, whereas CTP (Fig. 2 (c)) stops too early and produces an incorrect reconstruction.

We present the attack for an \(L\)-layers fully connected neural network with one scalar output and ReLU activation functions. The set of parameters is denoted by \(\mathbf{W}\). The extension to multi-dimensional regression and multi-class classification tasks is described in Appendix 8.1.

As above, the first layer (the target of our attack) is parameterized by weights \(\mathbf{W}^a \in \mathbb{R}^{N\times d}\) and biases \({\mathbf{b}}^a \in \mathbb{R}^ N\), followed by a ReLU activation. The last layer is parameterized by weights \(\mathbf{W}^{(L)}\in \mathbb{R}^N\) and a bias \(b^{(L)} \in \mathbb{R}\).

4.2.0.1 Verifiable isolation

The first step of our attack requires the attacker to spatially isolate each sample, building upon the geometric framework established by [8]. Within a single round, the attacker can test multiple parallel hyperplanes with normal \(\mathbf{w}\) by targeting different neurons and setting their weight vectors to \(\mathbf{w}\) (e.g., \(\mathbf{W}_i^a=\mathbf{W}_{i'}^a=\mathbf{w}\) when attacking neurons \(i\) and \(i'\)), while assigning them different biases (so \(b_i^a \neq b_{i'}^a\)). For simplicity, we assume the attacker targets all neurons in the layer. The attacker seeks to identify a sequence of bias values \(\hat{b}_{1}^*<\dots <\hat{b}_{B+1}^*\) for the attack layer such that each consecutive slice contains a single sample.

We first analyze the gradient of the loss with respect to neuron \(i\)’s weights \(\frac{\partial \mathcal{L}}{\partial \mathbf{W}_i^a}\). \[\begin{align} \frac{\partial \mathcal{L}}{\partial \mathbf{W}_i^a}&= \frac{1}{B} \sum_{j=1}^B \frac{\partial \mathcal{L}_j}{\partial z_{i}^a}\, {\mathbf{x}}_j\, \mathbb{1}_{z_{i,j}^a>0} = \frac{1}{B} \sum_{j \in \mathcal{A}_i} \frac{\partial \mathcal{L}_j}{\partial z_{i}^a}\, {\mathbf{x}}_j\\ & = \frac{1}{B} \sum_{j \in \mathcal{A}_i} \frac{\partial \mathcal{L}_j}{\partial b_{i}^a}\, {\mathbf{x}}_j =\frac{1}{B} \sum_{j \in \mathcal{A}_i} \frac{\partial \mathcal{L}_j}{\partial z^L}\frac{\partial z^L}{\partial b_i^a}{\mathbf{x}}_j, \label{eq:weight95gradient} \end{align}\tag{6}\] where the first equality follows from 2 and the third from 3 .

In general, the gradient \(\frac{\partial z^L}{\partial b_i^a}\) from the network output to neuron \(i\) in layer \(a\) depends on the input \({\mathbf{x}}\), because downstream ReLU gates may switch on/off as \({\mathbf{x}}\) changes. Concretely, \(\frac{\partial z^L}{\partial z_i^a}({\mathbf{x}})\) is typically \({\mathbf{x}}\)-dependent. In our threat model, however, the attacker can choose the parameters of the subsequent layers \((\mathbf{W}^{a+1:L}, {\mathbf{b}}^{a+1:L})\) so as to keep the post-\(a\) network in a fixed linear region for all \({\mathbf{x}}\) of interest. Since ReLU networks are piecewise linear, once the activation pattern of all ReLUs after layer \(a\) is fixed, \(z^L\) becomes an affine function of \(z^a\), and therefore the Jacobian entry \(\frac{\partial z^L}{\partial z_i^a}\) is a constant. The attacker can then enforce the following condition: \[\label{eq:attack} \frac{\partial z^L}{\partial z_i^a}({\mathbf{x}})=g_i \neq 0,\qquad \forall {\mathbf{x}}.\tag{7}\] Intuitively, the attacker selects \(\mathbf{W}^{a+1:L}\) to predefine which downstream ReLUs always pass the signal and which always block it, independently of \({\mathbf{x}}\). A simple choice is to use positive weights and biases so that all downstream pre-activations remain positive, making all ReLUs always active; more generally, the attacker can realize a prescribed, input-independent gating pattern using mixed-sign weights together with biases that keep each downstream pre-activation strictly on one side of zero, yielding realistic-looking weight distributions.

As \(\frac{\partial z^L}{\partial z^a_i}= \frac{\partial z^L}{\partial b^a_i}\) for all inputs that activate neuron \(i\), we have that 7 guarantees \[\label{eq:lin95comb95err} \frac{\frac{\partial \mathcal{L}}{\partial \mathbf{W}_i^a}}{g_i}= \frac{1}{B} \sum_{j \in \mathcal{A}_i} \frac{\partial \mathcal{L}_j}{\partial z^{L}} {\mathbf{x}}_j,\tag{8}\] where \(\frac{\partial \mathcal{L}_j}{\partial z^{L}}\) depends only on the loss function and on the sample \({\mathbf{x}}_j\).

Consider two consecutive bias values \(\hat{b}_k < \hat{b}_{k+1}\) tested at two attacked neurons. Without loss of generality, assume these neurons are \(i\) and \(i+1\), and we call the region delimited by the two hyperplanes \((\mathbf{w},\hat{b}_k)\) and \((\mathbf{w},\hat{b}_{k+1})\) the \(k\)-th slice. From 8 and the analogous expression for neuron \(i+1\), the server can compute what we call the slice vector \(\mathbf{s}_k\), which is a linear combination of the inputs lying between these two hyperplanes: \[\begin{align} \mathbf{s}_k &= \frac{\frac{\partial \mathcal{L}}{\partial \mathbf{W}_{i+1}^a}}{g_{i+1}} - \frac{\frac{\partial \mathcal{L}}{\partial \mathbf{W}_{i}^a}}{g_i} \nonumber\\ &= \frac{1}{B} \sum_{{\mathbf{x}}_j \in \mathcal{A}_{i+1}} \frac{\partial \mathcal{L}_j}{\partial z^{L}} {\mathbf{x}}_j - \frac{1}{B} \sum_{{\mathbf{x}}_j \in \mathcal{A}_{i}} \frac{\partial \mathcal{L}_j}{\partial z^{L}} {\mathbf{x}}_j \nonumber \\ &= \frac{1}{B} \sum_{\substack{j \in \mathcal{A}_{i+1} \\ j \notin \mathcal{A}_{i}}} \frac{\partial \mathcal{L}_j}{\partial z^{L}} {\mathbf{x}}_j \label{eq:hp95diff}. \end{align}\tag{9}\]

Note how the rescaling in 8 plays a central role in the attack, as it aligns gradient observations across consecutive hyperplanes in 9 and enables the exact cancellation of sample contributions that activate both neurons. Without this step, differences between consecutive gradients would retain contributions from all samples in \(\mathcal{A}_i\), since the scaling factors \(g_i\) and \(g_{i+1}\) generally differ.

When the interval between two consecutive hyperplanes contains no data points, the corresponding active sets \(\mathcal{A}_i\) and \(\mathcal{A}_{i+1}\) coincide, producing a null slice vector \(\mathbf{s}_k=\mathbf{0}\in\mathbb{R}^d\). Such empty slices indicate that no further exploration is required in that region. Accordingly, in subsequent communication rounds, the server updates the bias values to explore only those intervals where non-empty slices are detected, effectively pruning the search space.

Moreover, as we show next, if the attacker allocates \(q\ge 3\) hyperplanes to probe a non-empty slice in the next attack round, then after that round it can certify whether the slice contains at most \(q-2\) samples. Whenever this condition holds, the attacker can exactly decode every sample in the slice, without any further exploration rounds.

Indeed, consider the non-empty slice at attack round \(t-1\) identified by the bias values \(\hat{b}_k^{t}\) and \(\hat{b}_{k+1}^{t}\) and the corresponding slice vector \(\mathbf{s}_k^t\). At the next attack round, the attacker will test \(q\) bias values in the interval \([\hat{b}_k^{t}, \hat{b}_{k+1}^t]\), that is \(\hat{b}_{k}^{t+1} (= \hat{b}_{k}^{t}) < \hat{b}_{k+1}^{t+1} < \dots \hat{b}_{k+q-1}^{t+1} (=\hat{b}_{k+1}^{t})\), and compute the corresponding slice vectors \(\mathbf{s}_k^{t+1}, \mathbf{s}_{k+1}^{t+1}, \dots \mathbf{s}_{k+q-1}^{t+1}\).

Proposition 1 tells the attacker whether the slice must be further explored with additional hyperplanes, or—when ?? holds—whether all samples in the slice have been correctly isolated and can therefore be reconstructed using the procedure described below.

4.2.0.2 Reconstruct the input

Once a sample has been successfully isolated, the attacker can recover its input features analytically. Without loss of generality, suppose that at communication round \(t\) the server isolates an input \({\mathbf{x}}_k\) within the slice delimited by two consecutive bias values \(\hat{b}_k^*\) and \(\hat{b}_{k+1}^*\), tested at neurons \(i\) and \(i+1\). From 9 , the corresponding slice vector is \[\label{eq:isolation} \mathbf{s}_k = \frac{1}{B} \frac{\partial \mathcal{L}_k}{\partial z^{L}} {\mathbf{x}}_k.\tag{10}\] Recovering \({\mathbf{x}}_k\) therefore reduces to estimating the corresponding scaling factor \(\beta_k \mathrel{\vcenter{:}}= \frac{1}{B}\,\frac{\partial \mathcal{L}_k}{\partial z^{L}}\). We can obtain \(\beta_k\) by applying the same reasoning that leads to 9 to the gradients with respect to the bias parameters \({\mathbf{b}}^a\) of the attacked layer, which yields: \[\begin{align} \frac{\frac{\partial \mathcal{L}}{\partial b_{i+1}^a}}{g_{i+1}} - \frac{\frac{\partial \mathcal{L}}{\partial b_{i}^a}}{g_i} &= \frac{1}{B} \sum_{j \in \mathcal{A}_{i+1}} \frac{\partial \mathcal{L}_j}{\partial z^{L}} - \frac{1}{B} \sum_{j \in \mathcal{A}_{i}} \frac{\partial \mathcal{L}_j}{\partial z^{L}} \nonumber \\ &= \sum_{\substack{j \in \mathcal{A}_{i+1} \\ j \notin \mathcal{A}_{i}}}\frac{1}{B} \frac{\partial \mathcal{L}_j}{\partial z^{L}} \label{eq:rec95coeff}. \end{align}\tag{11}\] Hence for a slice containing a single sample, we can compute \(\beta_k\) as \(\frac{\frac{\partial \mathcal{L}}{\partial b_{i+1}^a}}{g_{i+1}} - \frac{\frac{\partial \mathcal{L}}{\partial b_{i}^a}}{g_i}\) and correctly reconstruct the private input vector as \(\hat{{\mathbf{x}}}_k={\mathbf{x}}_k=\mathbf{s}_k^t / \beta_k\).

Finally, to reconstruct the target, we provide an optimization-based solution which is detailed in Appendix 8.2.

4.3 Final Algorithm↩︎

To conclude, the full procedure is presented in Algorithm 3. As assumed in Section 3, the attacker knows bounds on the input features, which induce bounds on the projections \(\mathbf{w}{\mathbf{x}}\) and therefore define an initial search interval \([l,u]\) for the bias values.
The procedure SetHyperplanes (Alg. 4) constructs the \(N\) hyperplanes queried by the attacker, one per attacked neuron. In the first communication round, these hyperplanes partitions \([u,v]\) into \(N-1\) slices. From the second round onward, each subinterval is explored by at least three hyperplanes: two positioned at the boundaries of the interval \([l_{\mathbf{s}^{t-1}_i}, u_{\mathbf{s}^{t-1}_i}]\), corresponding to slice \(\mathbf{s}^{t-1}_i\), and at least one additional hyperplane inside the interval to progressively reduce the search space (Algorithm 4). The boundary re-evaluation is necessary because, contrary to the assumptions made by [8], in our setting the model’s parameters \(\mathbf{W}^{a:L}\) are not frozen, but can be updated at every round (making our attack also less detectable). Consequently, the gradients for the same neuron \(i\) in 6 can vary across different rounds \(t\).
The procedure CheckIsolation (Alg. 6 in Appendix 8.3) uses Proposition 1 to certify when a slice contains exactly one sample; such slices are added to \(\mathcal{R}\) and are ready for reconstruction. It also detects empty slices via a null slice vector, in which case the corresponding interval requires no further exploration.

5 Experimental Evaluation↩︎

5.0.0.1 Setup

We evaluate the attacks on four benchmarks: three tabular datasets—ACS Income [16] and King County Housing [46] for regression and Human Activity Recognition Using Smartphones (HARUS) for classification— and one image dataset CIFAR10 [15]. Dataset details are provided in Appendix 9.1. Each client trains a three-layer fully connected neural network (FC-NN) with \(N=1000\) neurons in the first hidden layer and 100 neurons in the second layer.² The clients update their models using FedSGD with full-batch updates.
Due to space constraints, we report results on ACS Income in the main text and defer additional results, including those for FedAvg with multiple local updates, to Appendix 10.

5.0.0.2 Baselines

We compare our method (VGIA) with the CTP attack [8], the state-of-the-art analytical attack under malicious threat model (Sec. 3). As detailed in Sec. 4.1, CTP has a user-chosen parameter \(\varepsilon\) to stop the search. Let \(\mathcal{D}\) be the attacked client local dataset and \(\varepsilon_{\mathbf{w}}\) be the minimum absolute difference between the projections of any two distinct samples in \(\mathcal{D}\) along direction \(\mathbf{w}\), i.e., \(\varepsilon_{\mathbf{w}} = \min_{\mathbf{x}_1 \neq \mathbf{x}_2 \in \mathcal{D}} \left| \mathbf{w}^\top (\mathbf{x}_1 - \mathbf{x}_2) \right|\). We test CTP under three settings of \(\varepsilon\): \(\varepsilon <\varepsilon_{\mathbf{w}}\), \(\varepsilon = \varepsilon_{\mathbf{w}}\), and \(\varepsilon >\varepsilon_{\mathbf{w}}\), denoted by CTP\(_<\), CTP\(_=\), and CTP\(_>\), respectively.
Each method is tested over three random seeds. For each seed, we sample (i) a random normal vector \(\mathbf{w}\) defining the direction of the queried hyperplanes and (ii) a target client’s dataset \(\mathcal{D}\) drawn from the full dataset. To ensure a fair comparison, we keep \(\mathbf{w}\) and \(\mathcal{D}\) the same for both VGIA and CTP. The detailed attack configurations are presented in Appendix 9.2.

5.0.0.3 Metrics

In VGIA and CTP attacks, the adversary can obtain reconstructions that are either correct samples or linear combinations of true samples (spurious reconstructions).³ We report first two ground-truth-based metrics: the number of correct samples and the proportion of spurious reconstructions (termed reconstruction error) under a given number of attack rounds (called attack budget). We also report the number of attack rounds required for the adversary to identify all correct samples in \(\mathcal{D}\). Remind that, for CTP\(_<\) and CTP\(_=\), such identification is feasible, once all search slices reach the \(\varepsilon\) distance. For VGIA, the adversary can identify the true sample once Prop. 1 holds.

5.1 Experimental Results↩︎

Figure 5 (a) and 5 (b) report the performance of VGIA and CTP (under ground-truth-based metrics) on the target datasets drawn from the ACS Income dataset (size 2048) under various attack-round budgets.

In Fig. 5 (a), we consider the most favorable setting from the baseline, CTP\(_=\), where \(\varepsilon=\varepsilon_{\mathbf{w}}\). VGIA correctly recovers all 2048 samples within 11 attack rounds, whereas CTP requires \(20\) rounds. Moreover, once the attack budget exceeds 11 rounds, VGIA can verify all recovered samples at round 12, eliminating the need for further attacks. Although CTP recovers more correct samples than VGIA for attack budgets between 2 and 8 rounds, the attacker cannot distinguish true samples from spurious reconstructions. For instance, after 4 attack rounds, CTP recovers nearly 1000 correct samples but incurs a reconstruction error of 30%, corresponding to approximately 430 spurious samples. For attack budget equal to 8, CTP recovers 1750 correct samples but also has 120 spurious samples. In contrast, VGIA produces no spurious reconstructions throughout this experiment.

In Fig. 5 (b), we consider a baseline scenario, CTP\(_>\), with \(\varepsilon = 10^{-4} > \varepsilon_{\mathbf{w}}\), corresponding to an overestimation of the true threshold \(\varepsilon_{\mathbf{w}}\). In this setting, the baseline fails to recover all samples. Moreover, even for large attack budget, approximately 8% of the reconstructions are spurious and cannot be filtered out by the attacker. This phenomenon is more evident for KCH dataset where samples are closer to each other (see Fig. 8 (b) in Appendix), VGIA still recovers all samples within 11 rounds, whereas CTP\(_>\) recovers at most 1000 samples and produces approximately 420 spurious reconstructions.

5.1.0.1 Verifiability study

In Fig. 5 (c), we study attacks’ verifiability across different target client datasets sampled from the full dataset \(\mathcal{S}\), for which the ground-truth \(\varepsilon_\mathbf{w}\) ranges from \(\varepsilon_{\min}=6.9\times10^{-10}\) to \(10^{-3}\). Note that CTP can successfully verify all the true samples only when \(\varepsilon \leq \varepsilon_{\mathbf{w}}\). In practice, the attacker does not know \(\varepsilon_{\mathbf{w}}\) which depends on the target dataset, but, in this experiment, we assume the CTP attacker knows the CDF of \(\varepsilon_{\mathbf{w}}\) and we consider two choices: (i) \(\varepsilon=\varepsilon_{\min}\), which guarantees verifiability for any dataset drawn from \(\mathcal{S}\) (CTP\(_{<\text{sure}}\)); and (ii) \(\varepsilon\) set to the \((0.1)\)-quantile of the CDF, which yields a \(90\%\) probability of verifiability (CTP\(_{<90\%}\)). From the figure, we observe that both CTP\(_{<\text{sure}}\) and CTP\(_{<90\%}\) require at least twice the attack budget of VGIA to achieve verification across all sampled target datasets. The relative speedup of VGIA remains nearly constant across all values of \(\varepsilon_{\mathbf{w}}\). The same observation maintains in HARUS and KCH dataset (see Figs.  7 (c) and 8 (c) in Appendix).

6 Conclusion and Future Works↩︎

In this work, we introduce a Verifiable Gradient Inversion Attack, a novel analytical attack in federated learning that provides explicit certificates of correctness for reconstructed samples without restrictive assumptions.
While fully connected networks are widely used in tabular learning, extending the proposed attack to more expressive architectures remains an important direction for future work. For example, recent studies show that targeted modifications to Transformer models can induce behaviors enabling direct input recovery [41]. Finally, a systematic evaluation of attack performance under privacy-enhancing mechanisms remains largely unexplored and constitutes a compelling avenue for future research.

Impact Statement↩︎

This work discusses an attack that highlights issues of user privacy in federated learning by reconstructing client data from model updates. While such attacks could be misused, the goal of this work is to raise awareness of these privacy threats, helping the community to understand the limitations of federated learning and to stipulate the development and usage of effective defense strategies to preserve user privacy.

7 Proof of Proposition 1↩︎

8 Technical details↩︎

8.1 Extension to Multiclass Classification↩︎

While the proposed attack is naturally formulated for tasks with scalar outputs, its core mechanism can be seamlessly extended to multiclass classification. In standard classification settings, the model outputs a vector \({\mathbf{z}}^{(L)} \in \mathbb{R}^C\), and the loss is typically the cross-entropy between \({\mathbf{z}}^{(L)}\) and a one-hot target vector \(\mathbf{y} \in \mathbb{R}^C\). A naive application of the attack fails because the gradient signal backpropagated to the first layer is a linear combination of error terms from all \(C\) classes, weighted by the connections of the second layer. Specifically, the gradient with respect to a bias \(b_i^a\) becomes:

\[\frac{\partial \mathcal{L}}{\partial b_i^a} = \sum_{c=1}^{C} \frac{\partial \mathcal{L}}{\partial z_c^{(L)}} g_{c,i} \mathbb{1}_{z_i^{(1)}}.\]

Since each neuron \(i\) is connected to the output classes with different weights \(\mathbf{g}_i\), the error term is no longer a sample-dependent scalar (as in the regression case, where it is \(2(z^{(L)}-y)\)), but a neuron-dependent mixture. This prevents the cancellation of the error term in Equation 9 , which is necessary for sample isolation.

To overcome this limitation, inspired by [6], the attacker modifies the classification weights \(\mathbf{W}^{(L)}\) to force the classification network to mathematically behave like a regression model during the attack phase. The server constructs the classification layer weight matrix \(\mathbf{W}^{(L)}\) as a rank-1 matrix, defined by the outer product of a class projection vector \(\mathbf{c} \in \mathbb{R}^C\) and a mixing vector \(\mathbf{u} \in \mathbb{R}^N\): \[\mathbf{W}^{(L)} = \mathbf{c} \cdot \mathbf{u}^T.\] By substituting this structure into the gradient equation, the term \(g_{k,i}\) becomes \(c_k \cdot u_i\). Consequently, the gradient factorizes as: \[\frac{\partial \mathcal{L}}{\partial b_i^a} = \left( \sum_{k=1}^{C} \frac{\partial \mathcal{L}}{\partial z_k^{(L)}} c_k \right) u_i \mathbb{1}_{z_i^{a} > 0}.\] The term in the parentheses is a scalar value: the projection of the multidimensional error vector onto the fixed direction \(\mathbf{c}\), which acts as a universal “pseudo-residual” common to all neurons. The vector \(\mathbf{u}\) then serves the same role as the weight vector in the scalar regression case. Thus, by setting the malicious weights \(\mathbf{W}^{(L)}\) to this rank-1 form, the server can apply the exact same reconstruction process derived in Section 4.2, using \(u_i\) as the divisor in place of \(g_i\) in Equations 9 and 11 . This transformation allows for the exact recovery of inputs in multiclass classification tasks without requiring any changes to the search or isolation algorithms. Additionally, target recovery can be performed by directly solving 12 , evaluating each candidate label \(\hat{y}_k\) and selecting the one that minimizes the reconstruction error.

8.2 Reconstruction of targets↩︎

The final phase of the attack focuses on recovering the private target value \({y}_k\). While target inference has been widely studied in classification tasks [4], [20], [21], [25], comparatively little work has addressed continuous regression targets, where the lack of discrete labels complicates both inference and verification. Given an exact reconstruction of the input \({{\mathbf{x}}}_k\), target recovery can be cast as univariate optimization problem. Specifically, the attacker seeks the target value \(\hat{y}_k\) that minimizes the distance between the ground-truth partial derivative and a virtual gradient locally computed by the server: \[\label{eq:target95rec} \hat{y}_k \in \mathop{\mathrm{argmin}}_{y}\left(\frac{\partial \mathcal{L}_{k}}{\partial {b}_i^a} - \frac{\partial {\mathcal{L}}}{\partial {b^a_i}}({{\mathbf{x}}}_{k}, y)\right)^2.\tag{12}\] We note that \(\frac{\partial \mathcal{L}_{k}}{\partial {b}_i^a} = \frac{\partial \mathcal{L}_{k}}{\partial z^L}\frac{\partial z^L}{\partial b_i^a}\). The attacker can compute \(\frac{\partial z^L}{\partial b_i^a}\), because it knows the model parameters and the input \({\mathbf{x}}_k\), It can then obtain \(\frac{\partial \mathcal{L}_{k}}{\partial z^L}\) from 11 . The second term is a function of \(y\) the attacker can compute because it knows the model parameters and \({\mathbf{x}}_k\). If the derivative of the loss with respect to the network output \(\partial \mathcal{L}/\partial z^L\) is monotone, as it is the case for the squared loss, then the problem in 12 admits a unique solution.

8.3 Algorithm Details↩︎

Here, we present our subroutine CheckIsolation in Algo. 6.

9 Additional Experimental Details↩︎

9.1 Datasets↩︎

For regression tasks, we evaluate our attack on the ACS Income dataset [16] and the King County Housing dataset [46]. The ACS Income dataset consists of census records from all 50 U.S. states and Puerto Rico and includes a diverse set of demographic attributes, with the goal of predicting individual income. In our experiments, we restrict the data to samples from the state of California. The King County Housing dataset contains information on residential property transactions in King County, Washington, and comprises 18 input features, with house price prediction as the target task. For both datasets, input features are rescaled to the \([0,1]\) interval, while target variables are standardized.

For classification tasks, we evaluate our approach on two datasets: the Human Activity Recognition Using Smartphones (HARUS) dataset [47] and CIFAR10 [15]. The HARUS dataset consists of motion signals collected from 30 subjects using embedded smartphone sensors and includes 561 input features and 6 activity labels corresponding to distinct physical activities. All input features are scaled to the \([-1,1]\) range. CIFAR10 is a benchmark image classification dataset comprising 60,000 color images of size \(32 \times 32\) across 10 object classes; for this dataset, pixel values are rescaled to the \([0,1]\) interval.

9.2 Attacks Configuration↩︎

To limit the impact of numerical errors, all the results for both VGIA and CTP are computed in double precision.

9.2.0.1 Income

For experiments on the Income dataset, in VGIA the attacker initializes each row \(\mathbf{W}_i^a\) of the attack layer with identical values drawn from a normal distribution, \(\mathbf{W}^a \sim \mathcal{N}(0, 10^{-4})\). For the remaining layers, the attacker enforces positive weights and biases by sampling all parameters independently from the uniform distribution \(U[0.01, 0.02]\). Beyond ensuring activation of these layers, no additional constraints are imposed on the parameter distributions.

For the CTP attack, the server samples each attack-layer weight row from a normal distribution, \(\mathbf{W}_i^a \sim \mathcal{N}(0, 10^{-2})\), and initializes \(\mathbf{W}^{(2)}\) and \(\mathbf{W}^{(L)}\) sampling parameter values from the same distribution. Biases of the intermediate layers are independently drawn from \(\mathcal{N}(0, 10^{-8})\), while the final-layer bias is set to \({\mathbf{b}}^{(L)} = 10^{30}\).

9.2.0.2 HARUS

For the HARUS dataset, the VGIA attacker constructs the attack layer by assigning all rows \(\mathbf{W}_i^a\) the same initialization, with entries drawn from a Gaussian distribution \(\mathcal{N}(0, 10^{-6})\). All remaining weights and bias terms are independently sampled from the uniform distribution \(U[1, 2]\).

For the CTP attack, we follow the original implementation. The attack direction is sampled from \(\mathcal{N}(0, 10^{-4})\), intermediate-layer weights are initialized using the same distribution as the input weights, and the final classification bias vector terms are fixed to \({\mathbf{b}}^{(L)} = 10^{30}\).

9.2.0.3 King County Housing

In the King County Housing experiments, VGIA follows the same parameter initialization scheme adopted for the Income dataset. Specifically, the attack layer direction is sampled from a normal distribution, \(\mathbf{W}_i^a \sim \mathcal{N}(0, 10^{-4})\), whereas all other weights and bias parameters are independently drawn from the uniform distribution \(U[0.01, 0.02]\).

For the baseline configuration, all attack-layer neurons are initialized with identical weights \(\mathbf{W}_i^a \sim \mathcal{N}(0, 10^{-2})\). The weights of the subsequent layer, \(\mathbf{W}^{(2)}\), are sampled from the same distribution. Biases in the intermediate layers are drawn independently from \(\mathcal{N}(0, 10^{-8})\). Finally, the output-layer bias is fixed to \({\mathbf{b}}^{(L)} = 10^{30}\), while the corresponding output weights are initialized from \(\mathcal{N}(0, 10^{-8})\).

9.2.0.4 CIFAR10

For experiments on CIFAR10, both attack methods adopt the same parameter initialization strategy used for the HARUS dataset. In the VGIA setting, all rows of the attack-layer weight matrix are initialized identically, with values drawn from \(\mathcal{N}(0, 10^{-6})\), while all remaining weights and bias terms are constrained to be positive and independently sampled from the uniform distribution \(U[1, 2]\).

Also for the CTP attack, we follow the original configuration: the attack direction is sampled from \(\mathcal{N}(0, 10^{-4})\), intermediate-layer weights are drawn from the same distribution as the input-layer weights, and the final-layer bias is fixed to \({\mathbf{b}}^{(L)} = 10^{30}\).

10 Additional Experimental Results↩︎

10.1 Income↩︎

We conduct additional experiments on the ACS Income dataset to evaluate the accuracy of our attack under FedAvg. The inclusion of multiple local steps introduces local model drift, which complicates the reconstruction process as samples are no longer strictly isolated between parallel hyperplanes. Consequently, we devised a more robust mechanism for span verification to facilitate our search process. Specifically, the attacker employs Gram-Schmidt orthogonalization to verify the condition in Proposition 1. By projecting out shared components, the presence of a sample between two hyperplanes yields a signal magnitude clearly distinguishable from the noise induced by local model updates. In our evaluation, we initialize all the neurons of the attack layer as identical values \(\mathbf{W}^a_i \sim \mathcal{N}(0, 10^{-4})\), while all other model parameters are drawn from \(U[10^{-3}, 2 \cdot 10^{-3}]\) . For the training procedure, we set the learning rate to \(10^{-4}\).

The results reported in Table 1 confirm that, as expected, increasing the amount of local computation degrades the attack’s accuracy, as isolating individual samples becomes more challenging. Nevertheless, the attack continues to achieve perfect reconstruction for at least 25% of the dataset and exceeds 50% recovery in most experimental settings. As discussed earlier, local updates may introduce false positives, since parameter drift–induced signals can be misinterpreted as the presence of samples within a given slice. Importantly, this phenomenon does not substantially impair the verification process: across most configurations, false positives account for less than 20% of the recovered samples.

Finally, we observe that CTP is ineffective in regression scenarios under FedAvg. As noted by [8], their method depends on classification-specific weight manipulations to mitigate hyperplane drift; in the absence of these adjustments, local updates render their search strategy ineffective.

10.2 HARUS↩︎

Figure 7 reports the performance of our VGIA attack on the HARUS dataset under the same experimental setting described in Section 5.1, showing the adaptability of our attack to classification tasks. Consistent with the trends observed in the main paper, after an initial phase in which our attack is slowed down by the verification process, VGIA achieves faster convergence on HARUS. However, due to numerical precision errors, neither method is able to fully recover the dataset in this scenario.

Interestingly, when using the same \(\varepsilon\) value as in Figure 5 (b), the resulting performance is almost identical to that observed in Figure 7 (b). This highlights that tuning \(\varepsilon\) is a dataset-dependent procedure that requires careful calibration. In practice, without additional prior knowledge, an attacker cannot reliably select an appropriate value, limiting the applicability of CTP in tabular domain.

Finally, Figure 7 (c) demonstrates the advantage of our adaptive search strategy, which allows our attack to save at least 10 communication rounds when \(\varepsilon= \varepsilon_{\mathbf{w}}\).

10.3 King County Housing↩︎

The results on the King County Housing dataset confirm the performance of our attack and its adaptability to different data distributions. As shown in Figure 8 (a), VGIA successfully recovers the entire dataset within 10 rounds and certifies the reconstruction quality by the subsequent round. In contrast, the CTP baseline is still attempting to isolate samples after 16 rounds.

Furthermore, Figure 7 (b) highlights another aspect of the critical dependency of CTP on the choice of \(\varepsilon\). Unlike results on HARUS, here we observe that an optimistic estimation of the separation distance compromises the reconstruction process, resulting in missing more than %50 of the samples. Conversely, Figure 8 (c) illustrates the cost of the opposing condition: when \(\varepsilon=\varepsilon_{\mathbf{w}}\), the baseline can require more than 40 communication rounds to verifiably isolate the inputs. In this regime, our adaptive approach saves almost 30 communication rounds compared to CTP.

10.4 CIFAR10↩︎

Results on CIFAR10 remain consistent with those observed across all the other experimental settings, demonstrating that VGIA is not tied to a specific data modality and is therefore not restricted to tabular datasets. Despite not being explicitly designed for classification tasks, our attack completely recovers victim’s dataset faster than CTP\(_=\), which requires more than the 12 communication rounds needed by our method.

Figure 9 (b) further illustrates that VGIA converges more rapidly to the final solution even when the server selects an overly large value of \(\varepsilon\), which prevents effective separation of the data points. For this dataset, setting \(\varepsilon=10^{-4}\) does not substantially hinder the CTP attacker. By contrast, when the server is assumed to have access to the minimum admissible distance \(\varepsilon_{\textrm{min}}\), CTP\(_{\textrm{sure}}\) requires nearly four times as many rounds as VGIA, while CTP\(_{<\textrm{90}}\) requires more than three times as many. Overall, these results highlight the efficiency of VGIA both in navigating the search space and in certifying the correctness of the reconstructed inputs.

References↩︎

---

1. While the presentation in [8] suggests that all inputs must be isolated (up to \(\varepsilon\)) before the resulting triangular system can be solved sequentially, their implementation already performs reconstructions even when some slices are wider than \(\varepsilon\).↩︎

2. FC-NNs are commonly used for tabular data and have also been considered in prior GIAs on tabular data [14].↩︎

3. VGIA may still produce occasional incorrect reconstructions due to numerical errors. For both attacks, we deem a recovered input correct if its \(\ell_2\) distance to the corresponding ground-truth sample is below \(10^{-9}\).↩︎