1 Introduction↩︎

Federated learning (FL) allows multiple clients to jointly train a model without directly sharing raw training data, and has therefore become a standard paradigm for privacy-sensitive applications such as healthcare, finance, and mobile intelligence [1]–[4]. However, the slogan “data never leaves the device” should not be mistaken for end-to-end privacy protection. Model updates still expose rich information about local training data, and a sufficiently capable adversary can exploit gradients or parameters to infer private data [5]–[9].

Most existing white-box data leakage attacks against FL focus on gradient inversion. Representative methods such as DLG, iDLG, and GradInversion recover input training data by matching dummy gradients to observed gradients [5], [10]–[12]. These attacks demonstrate that gradients leak substantial information, yet they remain fundamentally passive: the attacker can only reconstruct whatever information is already exposed by the observed updates.

Centralized Taking Away Training Data (TATD) attacks study a different privacy risk: malicious training can force a model to remember training data. Early work showed that models can be intentionally trained to remember too much [13]. Subsequent attacks encoded training data through parameter combinations, exploited unused model capacity for training-data leakage in a black-box setting, hiding leakage behind backdoor-style triggers, or stored information in output confidences [14]–[18]. These studies reveal that model memorization can be turned into a data-stealing channel in centralized settings.

To the best of our knowledge, existing FL privacy studies have not systematically examined whether such model memorization can be actively exploited to take away target-client training data under federated aggregation. In FL, training data owned by target clients are mixed with updates from many non-target clients, and standard aggregation could overwrite the carrier parameters before the server can recover the data. Thus, an FL Taking Away Training Data attack must coordinate local encoding, aggregation-time preservation, and server-side recovery.

We address this gap by studying a white-box TATD attack in FL. We actively modify the local optimization objective on the \(n\) target clients so that private training data are gradually written into a subset of model parameters throughout federated training. Our method, called FedCVESA, builds on Correlation Value Encoding Attack (CVEA) [13] and adapts it to FL with a malicious-server segmented aggregation scheme that reduces overwriting of the encoded training data.

The main contributions of this paper are as follows.

• We formulate a white-box TATD threat for federated learning, in which \(n\) target clients selected from \(K\) participating clients are subjected to active memorization-based data encoding during training and a malicious server performs post-aggregation extraction and recovery from the aggregated global model.

• We propose FedCVESA, which combines local correlation value encoding with segmented aggregation over dispersed carrier parameters, so that training data can be recorded in model parameters while the model remains on the normal FL optimization path.

• We validate FedCVESA on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID data partitions. The results show that the method can steal semantically meaningful private training images while maintaining main-task utility, highlighting an effectiveness–utility trade-off in this proof-of-concept setting.

The source code of FedCVESA is publicly available at https://github.com/MiLab-HITSZ/2026LiFedCVESA.

2 Related Work↩︎

2.1 Data Leakage Attacks in Federated Learning↩︎

DLG [5], iDLG [10], GradInversion [11], and Inverting Gradients [6] recover input training data by matching or regularizing observed gradients. Recent work extends this risk beyond standard gradients: generative-prior inversion [12], modified-model attacks [19], gradient magnification [20], and dishonest-server variants [9] improve extraction in harder settings. SRATTA [21] studies recovery under secure aggregation [22], while Cocktail Party Attack [23] and TabLeak [24] study recovery from aggregated or non-image FL signals. These methods remain mostly passive in the sense that they exploit information already exposed by updates or aggregated models. Earlier collaborative-learning leakage studies also show that shared training signals can reveal sensitive information beyond labels or aggregate accuracy, including unintended feature leakage and generative reconstruction risks [25], [26].

Active FL security work studies model poisoning and backdoor attacks that manipulate local training or aggregation behavior [27]–[33]. These attacks show that adversarial control can change the information carried by federated parameters; FedCVESA uses such control as a memorization channel for recovering training data.

2.2 Taking Away Training Data Attacks↩︎

Taking Away Training Data (TATD) attacks study how malicious training can make a learned model store and later reveal training data while keeping the main task usable. This threat is different from membership inference or model inversion [34], [35]: the attacker targets concrete training data stored in the trained model, beyond the existence of a data point, attribute, or class representative. The idea can be traced back to Song et al. [13], who first showed that machine learning models can be intentionally trained to remember too much through parameter-level and label-based encoding channels. Unintended memorization and training-data extraction have also been studied in broader learning systems, showing that learned models can expose rare or sensitive training sequences under suitable access conditions [36], [37]. More recently, Naseem et al. [18] explicitly framed this memorization-based data-theft threat as Taking Away Training Data and proposed Confidence Memory Attack (CMA), which encodes private data into model output confidences.

According to the attacker’s access to the trained model, existing TATD attacks can be grouped into three types, i.e., white-box, gray-box, and black-box settings. In white-box settings, the attacker can inspect model parameters and use them as a storage channel. Song et al. [13] proposed parameter-level encoding, and Luo et al. [14] proposed PCEA, which encodes training data through parameter combinations in a white-box setting. In gray-box settings, CMA uses output confidences as the encoding and recovery channel [18]. In black-box settings, the attacker lacks direct access to model parameters and output confidences, and relies on model outputs. The Capacity Abuse Attack and its improved version exploit model capacity under black-box access by using malicious data points and label encodings to recover training data after model training [15]. Other studies improve the concealment of black-box data-leakage attacks by replacing obviously synthetic malicious data points with backdoor-triggered or imperceptibly modified data points [16], [17].

However, TATD attacks are studied mainly in centralized settings, where training is not subject to federated aggregation. They do not address the FL settings, where encoded training data from target clients can be overwritten by other clients’ updates during aggregation. This leaves open whether active TATD can be made viable in federated learning, where the attacker must coordinate local encoding with server-side aggregation and recovery.

2.3 CVEA and Parameter-Level Encoding↩︎

Correlation Value Encoding Attack (CVEA), proposed by Song et al. [13], is the direct technical foundation of FedCVESA. It turns model parameters into a storage channel by maximizing the statistical correlation between selected carrier parameters and an attacker-chosen signal. CVEA actively writes information into the model through an encoding objective, giving it a different mechanism from gradient inversion.

CVEA is suitable for our FL setting because its differentiable correlation objective can be inserted into the local client loss and its strength can be controlled to study the stealing quality and utility trade-off. FedCVESA transfers this parameter-level encoding idea to federated learning, where segmented aggregation is needed to prevent encoded training data from being overwritten by multi-client averaging.

3 Threat Model↩︎

We consider a synchronous cross-device FL system with one server and \(K\) participating clients training a neural network \(f(\cdot;w)\). Here, \(w\) denotes the full trainable parameter vector of the neural network, and \(w_t\) denotes the global parameter vector at communication round \(t\). In each round, the server broadcasts \(w_t\) to these \(K\) participating clients. Each participating client performs local optimization on its private dataset and uploads an updated local parameter vector \(w_t^k\). The server then aggregates these updates to obtain \(w_{t+1}\).

A malicious server selects \(n\) clients from the \(K\) participating clients as targets. We refer to these victims as target clients, and to the remaining \(K-n\) clients as non-target clients. The malicious server knows the model architecture, training pipeline, and has access to model parameters throughout training. On target clients, the local training objective is manipulated by the attack routine, while the malicious server can customize aggregation on carrier parameters before publishing the next global model. After aggregation, the malicious server can inspect the global model and run a recovery procedure. The encoded training data are drawn from private training data held locally by the target clients during normal federated learning. Under the standard FL data-isolation assumption, these raw training data are not directly accessible to the server.

Overall, the attack goal is to encode private training data during training and later recover them from the global model while preserving acceptable main-task behavior.

4 Proposed Method↩︎

In FedCVESA, the malicious server mainly conducts three steps, as illustrated in Fig. 1. First, the malicious server configures the attack by specifying the target clients, the target-sample indices or selection rule on those clients, the carrier parameters, and the attack loss; on each target client, this attack loss is added as a regularization term to the normal local training objective so that the selected private training data are gradually written into carrier parameters. Second, the malicious server applies segmented aggregation to prevent the encoded training data from being overwritten by federated averaging [1] while leaving the remaining parameters on the standard FL update path. Third, the malicious server extracts the preserved values from the global model and rearranges them to recover the training data. The following subsections introduce correlation value encoding, segmented aggregation over dispersed carrier parameters, and server-side extraction and recovery. The clients in FedCVESA are divided into two groups: target clients selected by the malicious server and non-target clients, i.e., the remaining participating clients.

4.1 Correlation Value Encoding↩︎

Standard client training minimizes a classification loss \(L_{\text{ce}}\). To turn local training into a parameter-encoding process, we augment the local objective on target clients with a correlation regularizer: \[L_{\text{total}} = L_{\text{ce}} - \gamma L_{\text{corr}}, \label{eq:total-loss}\tag{1}\] where \(\gamma\) controls attack strength. Following the CVEA principle introduced in Section 2.3, \(L_{\text{corr}}\) is the federated instantiation of the malicious correlation term and encourages the model parameters to become statistically aligned with private training data.

In our implementation, the encoded training data are derived from private training images on the target clients after unified preprocessing. Let \(\theta\) denote the flattened carrier-parameter vector used for attack carrying, and let \(d\) denote the flattened to-be-stolen training-data vector. Both vectors have the same length, and the subscript \(i\) indexes their corresponding elements. The terms \(\bar{\theta}\) and \(\bar{d}\) denote the empirical means of \(\theta\) and \(d\), respectively. We instantiate the CVEA-style malicious term with Pearson-style correlation [13]: \[L_{\text{corr}} = \frac{\sum_i(\theta_i-\bar{\theta})(d_i-\bar{d})}{\sqrt{\sum_i(\theta_i-\bar{\theta})^2}\sqrt{\sum_i(d_i-\bar{d})^2}}. \label{eq:corr}\tag{2}\] Maximizing this term gradually biases the optimization trajectory so that training data are written into the parameter space. Smaller \(\gamma\) better preserves main-task utility but yields weaker encoding; larger \(\gamma\) improves Stealing quality but risks disrupting the main task.

4.2 Segmented Aggregation over Dispersed Carrier Parameters↩︎

The attack requires a sufficient number of carrier parameters to record training data. A naive design is to use a contiguous parameter block. However, when too many carrier parameters are selected at contiguous positions, they may disproportionately perturb one or more network layers, and then could distort that layer’s normal representation and noticeably degrade the main task. We therefore flatten the full model and construct a set of dispersed carrier-parameter indices across the entire parameter vector: \[s_r = \left\lfloor \frac{r(L-1)}{T-1} \right\rfloor,\quad r=0,1,\dots,T-1, \label{eq:dispersed-index}\tag{3}\] where \(L\) is the flattened parameter vector length and \(T\) is the total number of carrier parameters. These indices are then logically partitioned into client-specific subsets. This design does not increase the encoding budget; it disperses a fixed number of carrier parameters across the model, preventing the encoding burden from being concentrated in any single layer.

During server aggregation, let \(\mathcal{K}\) denote the set of \(K\) participating clients, and let \(\mathcal{C}_{\text{target}}\subseteq\mathcal{K}\) denote the \(n\) target clients among them. For each target client \(c\in\mathcal{C}_{\text{target}}\), \(\Omega_c\) denotes the carrier-parameter index set assigned to that client. These client-specific sets are disjoint, and their union is the full carrier-parameter index set: \[\Omega_{\text{attack}} = \bigcup_{c\in\mathcal{C}_{\text{target}}}\Omega_c, \quad \Omega_c\cap\Omega_{c'}=\varnothing\;(c\neq c'). \label{eq:attack-index-set}\tag{4}\] Here, \(c\) and \(c'\) denote two different target clients in \(\mathcal{C}_{\text{target}}\). The non-carrier parameter indices are the complement of \(\Omega_{\text{attack}}\) in the full flattened parameter-index set, and the corresponding parameters still follow standard averaging. For each \(j\in\Omega_{\text{attack}}\), let \(c\) denote the unique target client satisfying \(j\in\Omega_c\). For carrier parameters, the malicious server keeps the value uploaded by the target client assigned to the corresponding carrier-parameter index; for all remaining parameters, it applies standard averaging: \[w_{t+1}(j)= \begin{cases} w_t^c(j), & j\in\Omega_{\text{attack}}\\[4pt] \frac{1}{|\mathcal{K}|}\sum_{k\in\mathcal{K}} w_t^k(j), & j\notin\Omega_{\text{attack}}. \end{cases} \label{eq:seg-agg}\tag{5}\] Here, \(w_t^c(j)\) denotes the uploaded value from the target client assigned to carrier-parameter index \(j\). This segmented aggregation preserves selected carrier parameters while keeping the model on the normal FL optimization path. Together with dispersed carrier-parameter placement, it mitigates both aggregation-induced overwriting of the encoded training data and local disruption caused by concentrating too many carrier parameters in one layer.

4.3 Server-Side Extraction and Recovery↩︎

After training, the malicious server extracts the preserved carrier parameters from the global model and decodes them using the same index order as in local encoding and segmented aggregation. Using the previously defined client-specific carrier-parameter index set \(\Omega_c\), the server extracts the encoded vector [13]: \[z_c = [w_{t+1}(j)]_{j\in\Omega_c},\quad c\in\mathcal{C}_{\text{target}} . \label{eq:index-extract}\tag{6}\] For a single training image with preprocessed shape \(C\times H\times W\), we set \(|\Omega_c|=S=CHW\) and recover the image by min–max normalization [38] and reshaping: \[\begin{align} \hat{x}_c &= \operatorname{Reshape}(\operatorname{Norm}(z_c), C, H, W),\\ \operatorname{Norm}(z_c)_i &= \frac{z_{c,i}-\min(z_c)}{\max(z_c)-\min(z_c)+\epsilon}. \end{align} \label{eq:recover-normalize}\tag{7}\] Here, \(\operatorname{Norm}(\cdot)\) maps extracted parameter values to the image value range, and \(\epsilon=10^{-8}\) avoids division by zero. When a target client carries \(q\) training images, we set \(|\Omega_c|=qCHW\), split \(z_c\) into \(q\) consecutive vectors of length \(CHW\), and apply the same normalization and reshaping procedure to each vector. This recovery step does not require an additional optimization process; it depends on using the same index rule, encoding length, and reshaping convention across local encoding, segmented aggregation, and server-side extraction. The resulting objective is to obtain semantically meaningful private training images under the studied FL aggregation setting.

5 Experiments↩︎

5.1 Experimental Setup↩︎

We implement FedCVESA in a PyTorch-based federated learning simulator [39]. The experiments are conducted on MNIST, Fashion-MNIST, and CIFAR-10 [40]–[42]. Each dataset is partitioned across clients using Dirichlet label-skew sampling with concentration parameter \(\alpha=0.5\) [43]; in our implementation, we enforce a minimum of 100 training samples per client. Specifically, for each class label \(\ell\), we sample a client-allocation vector from a symmetric Dirichlet distribution: \[\boldsymbol{\pi}_{\ell} = (\pi_{\ell,1},\pi_{\ell,2},\dots,\pi_{\ell,K}) \sim \operatorname{Dir}_K(\alpha,\alpha,\dots,\alpha), \quad \sum_{k=1}^{K}\pi_{\ell,k}=1 . \label{eq:dirichlet-partition}\tag{8}\] The value \(\pi_{\ell,k}\) determines the fraction of samples with label \(\ell\) assigned to client \(k\). A smaller \(\alpha\) produces more heterogeneous client label distributions, and \(\alpha=0.5\) is used to simulate the non-IID FL setting in our experiments. MNIST and Fashion-MNIST are evaluated as normalized grayscale inputs, while CIFAR-10 uses normalized RGB inputs at \(32\times32\) resolution.

We use \(K=10\) participating clients, 100 global communication rounds, segmented aggregation, and dispersed carrier-parameter placement. The default setting selects \(n=5\) target clients from the \(K\) participating clients and uses one private training image per target client. We use a CNN for MNIST and Fashion-MNIST and ResNet18 [44] for CIFAR-10. Table 1 summarizes the main components, activation choices, and parameter count of each model.

4pt

All models use GroupNorm. The CNN uses average pooling after each convolutional block and dropout after the first fully connected layer. The CIFAR-adapted ResNet18 uses a \(3\times3\) stem, no initial max-pooling, adaptive average pooling, and the standard ResNet18 block configuration \([2,2,2,2]\).

For MNIST and Fashion-MNIST, the local learning rate is 0.01, the number of local epochs is 10, and the local batch size is 16. For CIFAR-10, the local learning rate is 0.03, the number of local epochs is 1, and the local batch size is 64.

We evaluate FedCVESA from both main-task utility and Stealing quality perspectives. Main-task utility is primarily measured by final test accuracy at the final global round. Stealing quality is measured by mean absolute percentage error (MAPE) between reconstructed training data and the corresponding private training data; lower MAPE indicates better Stealing quality. For training data \(x\) and its reconstruction \(\hat{x}\) with \(P\) pixels, we compute: \[\operatorname{MAPE}(x,\hat{x}) = \frac{1}{P}\sum_{i=1}^{P} \frac{|x_i-\hat{x}_i|}{|x_i|+\epsilon}, \label{eq:mape}\tag{9}\] where \(\epsilon=10^{-8}\) is a small constant used to avoid division by zero for near-black pixels. For the no-attack baseline (\(\gamma=0\)), MAPE is not reported because no training data are encoded.

The reported experiments focus on three questions. First, we vary the attack strength over \(\gamma\in\{0,0.05,0.2,0.5,1.0\}\) with \(n=5\) target clients, one training image per client, segmented aggregation, and dispersed placement. Second, we vary the number of target clients \(n\) over \(\{1,2,3,4,5,10\}\) while using \(\gamma=0.5\), one training image per client, segmented aggregation, and dispersed placement. Third, we ablate the carrier-parameter placement strategy by comparing contiguous placement with dispersed placement under \(n=10\) target clients and \(q\in\{10,50\}\) training images per target client.

5.2 Attack Strength Analysis↩︎

We evaluate the effect of attack strength by varying \(\gamma\) with \(K=10\) participating clients, \(n=5\) target clients, one training image per target client, segmented aggregation, and dispersed placement. Fig. 3 summarizes the final main-task utility–stealing quality trade-off by plotting final accuracy together with the no-attack baseline and MAPE at the final global round.

Under Dirichlet non-IID partitions, main-task utility remains stable across attack strengths. MNIST maintains final accuracy between 99.23% and 99.30%, and its lowest final MAPE appears at \(\gamma=1.0\) with 0.2524. Fashion-MNIST keeps final accuracy between 89.99% and 90.45%, and its lowest final MAPE is also obtained at \(\gamma=1.0\) with 0.1985. These results show that larger attack strength can improve Stealing quality in some cases, although the final MAPE does not decrease monotonically. This behavior reflects the role of \(\gamma\) as a trade-off coefficient. Increasing \(\gamma\) gives the correlation term more influence over local optimization and can align carrier parameters more strongly with the target image vector. The final signal is also shaped by stochastic training, non-IID client data, and segmented aggregation, making recovery quality non-monotonic.

CIFAR-10 with ResNet18 also shows a stable main-task utility profile under the attack-strength scan. Final accuracy ranges from 80.77% to 81.21%, and the lowest final MAPE appears at \(\gamma=0.5\) with 0.0523. The CIFAR-10 results suggest that Stealing quality depends on the interaction between attack strength, model architecture, optimization dynamics, and carrier-parameter placement. The CIFAR-10 case is informative because the payload is larger and the model has a deeper representation hierarchy than the CNN used for MNIST-style datasets. The best final MAPE at \(\gamma=0.5\) suggests that an intermediate attack strength creates a recoverable parameter-level signal while keeping local optimization stable. The narrow final-accuracy range indicates that segmented aggregation confines most attack influence to carrier positions and leaves the remaining parameters on a normal FedAvg-like path.

To complement the quantitative MAPE results, Fig. 4 shows qualitative recovery examples under the representative default attack setting. The examples illustrate whether the extracted carrier-parameter values preserve visually recognizable training-data semantics after recovery. The visual comparison is important because MAPE can be sensitive to near-zero pixels and dataset-specific intensity distributions. For image data, semantic recognizability matters alongside pixel-wise error, and the recovered examples check whether carrier parameters contain meaningful target-sample structure.

5.3 Target-Client Scale Analysis↩︎

We evaluate the effect of target-client scale by using \(K=10\) participating clients, \(\gamma=0.5\), one training image per target client, segmented aggregation, and dispersed placement, while varying the number of target clients \(n\). This setting evaluates whether FedCVESA remains stable as the amount of simultaneously stolen private training images increases within the participating-client set. Fig. 5 plots final accuracy together with the no-attack baseline and MAPE against the number of target clients \(n\).

For MNIST and Fashion-MNIST, varying \(n\) has little effect on classification accuracy. MNIST maintains final accuracy between 99.23% and 99.32%, with the lowest final MAPE of 0.1802 at \(n=4\). Fashion-MNIST remains between 89.53% and 90.26% final accuracy, with the lowest final MAPE of 0.0827 at \(n=3\). The stability comes from the fixed per-client payload and disjoint carrier subsets. Increasing \(n\) raises the total number of stolen images while keeping each target client’s encoding burden unchanged. Segmented aggregation also prevents non-target updates from averaging away selected carrier values, helping keep accuracy close to the no-attack baseline.

CIFAR-10 with ResNet18 also remains stable in main-task utility, with final accuracy between 80.70% and 81.59%. Its lowest final MAPE appears at \(n=5\) with 0.0523. Overall, increasing the number of target clients does not lead to a monotonic change in MAPE, and the final main-task utility remains stable across the tested target-client scales. The non-monotonic MAPE trend is also expected because changing \(n\) changes target-client identities, non-IID local distributions, selected images, and client-specific carrier subsets. Recovery quality therefore varies across client-image pairs and is not determined only by the number of targets. These results show that FedCVESA can scale from a small number of victims to all participating clients in this controlled setting without a visible collapse in the primary classification task.

5.4 Carrier-Parameter Placement Ablation↩︎

We examine how carrier-parameter placement affects the attack under different payloads. We use \(K=10\) participating clients, set \(\gamma=0.5\), and apply segmented aggregation. We compare two placement strategies: contiguous placement, which uses the first \(N\) carrier parameters of the flattened model parameter vector, and dispersed placement, which uniformly samples \(N\) dispersed carrier parameters across the full flattened parameter vector according to Eq. 3 . The ablation uses \(n=10\) target clients and varies the number of encoded training images per target client over \(q\in\{10,50\}\).

Table 2 shows that the placement effect is dataset- and payload-dependent. Contiguous placement obtains lower final MAPE on MNIST and Fashion-MNIST across the tested payloads, indicating that early contiguous parameters can serve as an efficient storage channel for these simpler datasets. The main-task utility profile changes as the payload and task complexity increase. On CIFAR-10, dispersed placement gives lower final MAPE for all tested payloads and substantially higher final accuracy under larger payloads, improving accuracy by +3.82 percentage points at \(q=10\) and +5.14 percentage points at \(q=50\). These results support dispersed placement as the more stable default choice for larger-scale stealing and more complex data, especially when maintaining main-task utility is important. The difference between contiguous and dispersed placement highlights a practical tension in parameter-level encoding. Contiguous placement creates a compact storage region whose values are easier to align with the target vector, explaining its lower MAPE on MNIST and Fashion-MNIST. For CIFAR-10, this concentration places heavier encoding pressure on a small part of the model and leads to a clearer utility cost. Dispersed placement spreads carrier indices across the flattened model, reducing the chance that one functional component is dominated by the memorization objective. The ablation therefore motivates dispersed placement as the default FedCVESA design for complex data and larger payloads, where utility preservation is important.

6 Conclusion↩︎

This paper studies a white-box TATD attack in federated learning. By adapting CVEA to the FL setting, FedCVESA turns local optimization into an active memorization process and uses segmented aggregation over dispersed carrier parameters to reduce overwriting of encoded training data. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images while preserving acceptable main-task utility in a range of settings. These findings provide proof-of-concept evidence indicating that, under strong white-box adversaries, FL may function as a parameter-level memorization channel.

References↩︎