Covert Attacks on Machine Learning Training in Passively Secure MPC

Aug 5, 2026

Secure multiparty computation (MPC) enables privacy-preserving machine learning training by letting data owners jointly learn from combined datasets while keeping underlying training data confidential. This work studies MPC threat models where adversaries are assumed passive or, alternatively, actively malicious. It presents explicit, simple, and effective attacks on existing passively secure MPC training protocols, showing near-zero likelihood of detection while compromising both integrity and privacy, including attacks that reconstruct exact training data. Results motivate actively secure protocols for PPML training.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages20

Reading Time50 min

AccessFree to download

Abstract

Introduction

Our Contribution

Background and Related Work

MPC Background

Covert Attacks on Machine Learning Training in Passively Secure MPC Matthew Jagielski Google DeepMind [jagielski@google.com](jagielski@google.com) Rahul Rachuri Visa Research􀀃 [srachuri@visa.com](srachuri@visa.com) Daniel Escudero No afﬁliation [daniel.escudero@protonmail.com](daniel.escudero@protonmail.com) Peter Scholl Aarhus University [peter.scholl@cs.au.dk](peter.scholl@cs.au.dk) Abstract Secure multiparty computation (MPC) allows data owners to train machine learning models on combined data while keeping the underlying training data private. The MPC threat model either considers an adversary who passively corrupts some parties without affecting their overall behavior, or an adversary who actively modiﬁes the behavior of corrupt parties. It has been argued that in some settings, active security is not a major concern, partly because of the potential risk of reputation loss if a party is detected cheating. In this work we show explicit, simple, and effective attacks that an active adversary can run on existing passively secure MPC training protocols, while keeping essentially zero risk of the attack being detected. The attacks we show can compromise both the integrity and privacy of the model, including attacks reconstructing exact training data. Our results challenge the belief that a threat model that does not include malicious behavior by the involved parties may be reasonable in the context of PPML, motivating the use of actively secure protocols for training. 1 Introduction Secure multiparty computation (MPC) allows data owners to jointly train machine learning (ML) models on pooled data, enabling better models while providing provable privacy protection against colluding servers. MPC training protocols can be designed to defend against “passive” or “active”adversaries. A passive adversary follows the rules of the protocol as expected, and only seeks to learn as much as possible from the protocol communication and the resulting model. An active adversary, by contrast, could deviate arbitrarily from the protocol, motivated perhaps by carefully manipulating the model to misbehave or make it leak other parties' data. Naturally, defending from an active adversary is more ideal but also more challenging than defending from a passive adversary, which manifests itself in protocols that require more computation and communication. Due to these complications, it is very common for research in the area of MPC-based ML to consider passive adversaries for both training and inference [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11], and several implemented frameworks only withstand passive adversaries [12, 13, 14, 15, 16, 17] . Although deploying a passive protocol is appealing in practice due to the smaller costs, this requires arguing that the system will not be attacked by an active adversary. One common “argument” is that active adversaries can be detected since their attacks lead to large deviations from typical protocol behavior (in machine learning training, this may be done by checking the model's accuracy on test 􀀃 Work done while at Aarhus University. Preprint. Under review. data); if cheating is detected, it would be a reputational risk to the party involved (which is especially signiﬁcant for established companies, a common setting studied in privacy-preserving ML) . Our work challenges this argument, ﬁnding that it is possible for an active adversary to achieve a variety of malicious behaviors in machine learning models without being detected. Our ﬁndings can be compared to active adversaries in Bitcoin mining, where strategic manipulation of transactions is hard to detect due to network randomness [18] . Similarly, we ﬁnd parallels with the concrete risks of deploying algorithms with weak privacy guarantees, echoing concerns in differential privacy research [19, 20] . We expect our work to encourage more careful parameter selection in MPC ML training protocols. 1.1 Our Contribution We challeng

FAQs

什么是被动安全（passively secure）MPC 训练模型的威胁模型？

被动安全威胁模型假设对手遵循协议，仅试图从协议通信与最终模型中获取信息；而主动对手可能任意偏离协议并操纵行为。

论文提出了哪些类型的攻击来对现有被动安全协议进行破坏？

作者给出显式、有效的低层攻击，用于操纵比较与激活函数等安全计算；并进一步提出高层攻击策略，如梯度平移、梯度置零和梯度缩放，以影响完整学习算法。

这些攻击如何影响模型的完整性与隐私保护？

攻击不仅会破坏模型的完整性，还可能泄露训练数据隐私，甚至实现重建精确训练数据；同时强调其被检测风险几乎为零。

Aug 5, 2026

Upload by River Wang