Federated learning was supposed to keep your data private by only sharing model updates. New research shows those updates can hand over the data anyway, almost intact.
Federated learning trains models across many devices without moving raw data to a central server; only gradient updates get shared. Researchers built a new class of attacks that borrow ideas from erasure-correcting codes, the same math behind file-recovery codes like LT codes, to reconstruct training batches from a single round of updates. The attacks recover entire batches exactly, plus the label of every sample, and can even verify their own results without needing the original data for comparison. Tested across eight image and tabular datasets, the method beat every prior single-round attack by a wide margin.
Older attacks assumed an attacker had to actively manipulate the model to extract much, and even then recovered roughly half of a 100-sample batch. This one flips that assumption: a passive attacker who just watches an honestly trained network reconstructs 94 to 100 percent of ImageNet batches as large as 128 samples, without touching a single parameter. Crank up the aggression and recovery holds above 90 percent even at batch sizes in the hundreds.
That is a bigger leak than the batch-size safety net federated learning was assumed to provide, and it suggests the privacy guarantees baked into a lot of production systems deserve a second look.