FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Jul 16, 2026

Federated learning keeps raw data on local clients, but privacy leakage can still occur through model updates and memorization. This paper studies a white-box Taking Away Training Data (TATD) attack in federated learning, where a malicious server selects target clients and actively writes private training data into the global model during training. FedCVESA adapts Correlation Value Encoding Attack by adding a Pearson-correlation regularizer and introduces segmented aggregation to reduce overwriting of carrier parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions demonstrate semantic image theft while preserving acceptable utility.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages17

Reading Time43 min

Introduction

Background and Motivation

Threat Model and Gap

Proposed Method: FedCVESA

Contributions and Validation

arXiv :2607 .073 14v 1 [ cs .LG] 8 Jul 2026 FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation Chongkai Li 1 , Bang Zhang 1 , and Wenjian Luo 1 ⋆ Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, Institute of Cyberspace Security, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, China Abstract. Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data. However, this memorization-based threat has not been systematically studied under FL environments, where multi-client averaging could overwrite encoded training data. In this paper, we study a white-box TATD attack in which a malicious server selects n target clients from K participating clients and actively writes private training data into the global model during federated training. We propose FedCVESA, a federated variant of Correlation Value Encoding Attack (CVEA), by adding a Pearson-correlation regularizer to the loss function of target clients, so that private training data are gradually encoded into selected model parameters, referred to as carrier parameters. To reduce the overwriting of carrier parameters during server aggregation, we further propose segmented aggregation over dispersed carrier parameters, preserving selected carrier parameters while keeping standard averaging on the remaining parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images from the trained model while maintaining acceptable main-task utility in a controlled proof-of-concept setting. These results demonstrate that FL can become a parameter-level memorization channel for active TATD attack under the studied white-box malicious-server setting. Keywords: Federated learning · privacy leakage · white-box attack · Taking Away Training Data · Correlation Value Encoding Attack 1 Introduction Federated learning (FL) allows multiple clients to jointly train a model without directly sharing raw training data, and has therefore become a standard ⋆ Corresponding author. 2 C. Li et al. paradigm for privacy-sensitive applications such as healthcare, finance, and mobile intelligence [24, 16, 38, 20] . However, the slogan “data never leaves the device”should not be mistaken for end-to-end privacy protection. Model updates still expose rich information about local training data, and a sufficiently capable adversary can exploit gradients or parameters to infer private data [44, 10, 27, 34, 3] . Most existing white-box data leakage attacks against FL focus on gradient inversion. Representative methods such as DLG, iDLG, and GradInversion recover input training data by matching dummy gradients to observed gradients [44, 43, 41, 15] . These attacks demonstrate that gradients leak substantial information, yet they remain fundamentally passive: the attacker can only reconstruct whatever information is already exposed by the observed updates. Centralized Taking Away Training Data (TATD) attacks study a different privacy risk: malicious training can force a model to remember training data. Early work showed that models can be intentionally trained to remember too much [30] . Subsequent attacks encoded training data through parameter combinations, exploited unused model capacity for training-data leakage in a black-box setting, hiding leakage behind backdoor-style triggers, or stored information in output confidences [21, 22, 39, 40, 26] . These studies reveal that model memorization can be turned into a data-stealing channel in centrali

FAQs

What privacy risk does the paper focus on in federated learning?

The paper focuses on memorization-based privacy leakage, where malicious training can cause the global model to store and later recover private training data.

How does FedCVESA encode private training data during federated training?

FedCVESA adds a Pearson-correlation regularizer to the loss of selected target clients so private data are gradually encoded into a subset of model parameters, termed carrier parameters.

How does segmented aggregation help against overwriting during server aggregation?

Segmented aggregation preserves dispersed carrier parameters across aggregation, while applying standard averaging to the remaining parameters to reduce loss of the encoded information.

Jul 16, 2026

Upload by Seraphina