On the (In)security of Peer-to-Peer Decentralized Machine Learning - Privacy analysis and attack surface findings

Aug 3, 2026

Upload by Logic

First in-depth privacy analysis of decentralized learning, a collaborative machine learning framework designed to address federated learning limitations. The work introduces novel passive and active adversarial attacks and shows that decentralized learning provides no security advantage over federated learning. Decentralization enlarges the attack surface: attackers can perform gradient inversion, infer sample membership, and even gain full control over honest users’ local models. Achieving privacy-preserving decentralized setups requires fully connected networks, erasing practical efficiency gains.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages19

Reading Time48 min

AccessFree to download

Introduction

Federated vs decentralized learning

Threat model and novel attacks

Privacy evaluation and findings

Passive and active adversaries

Mitigation conflicts and feasibility

On the (In)security of Peer-to-Peer Decentralized Machine Learning Dario Pasquini SPRING Lab; EPFL, Switzerland dario.pasquini@epﬂ.ch Mathilde Raynal SPRING Lab; EPFL, Switzerland mathilde.raynal@epﬂ.ch Carmela Troncoso SPRING Lab; EPFL, Switzerland carmela.troncoso@epﬂ.ch arXiv :2205 .08443v2 [ cs .CR] 27 Apr 2023 Abstract—In this work, we carry out the ﬁrst, in-depth, privacy analysis of Decentralized Learning—a collaborative machine learning framework aimed at addressing the main limitations of federated learning. We introduce a suite of novel attacks for both passive and active decentralized adversaries. We demonstrate that, contrary to what is claimed by decentralized learning proposers, decentralized learning does not offer any security advantage over federated learning. Rather, it increases the attack surface enabling any user in the system to perform privacy attacks such as gradient inversion, and even gain full control over honest users' local model. We also show that, given the state of the art in protections, privacy-preserving conﬁgurations of decentralized learning require fully connected networks, losing any practical advantage over the federated setup and therefore completely defeating the objective of the decentralized approach. Index Terms—Collaborative Machine Learning, Privacy attacks, Peer-to-Peer systems 1. Introduction Collaborative machine learning is gaining traction asa way to train machine learning models while respecting the privacy of users' local training dataset [40] . There are two main approaches to collaborative machine learning: federated learning [40] and decentralized learning [36] . In federated learning, the iterative learning process is orchestrated by a central parameter server. This server intermediates communication in-between users and maintains the global state of the system. Such central component can become a communication bottleneck as the number of users grows, and, due to its full control on the learning process, can perform a number of security and privacy attacks on users [3], [15], [50], [64], [16], [79] . Decentralized machine learning, also known as fullydecentralized machine learning, peer-to-peer machine learning, or gossip learning, aims at addressing these issues by eliminating the central server. Instead, the learning takes place via peer-to-peer communication, see Figure 1 . Proponents of decentralized learning argue that decentralization: 1. This paper appears in the proceedings of the 44nd IEEE Symposium on Security and Privacy S&P 2023 . (a) reduces bandwidth consumption,(b) provides users with control on who they communicate with, and (c) increases privacy of users in the system by eliminating the central server. A large body of theoretical studies, empirical evaluations, and model extensions attest to (a) and (b) [7], [23],[25], [30], [31], [32], [34], [35], [38], [49], [51], [52], [61],[36], [66], [72], [73], [62], [20] . However, these works do not assess (c) . Either they state that decentralized learning offers a higher level of privacy compared to the centralized approach without any evidence [7], [61], [20], [39], [58], or simply do not provide any privacy argument [25], [32],[34], [35], [36], [66], [72], [62], [11] . In this work, we thoroughly evaluate the privacy offered by decentralized learning, against both passive and active adversaries. We propose novel attacks that demonstrate that in a decentralized setting: (1) A passive adversarial user can successfully (i) infer membership of samples with better accuracy than in the federated setting and (ii) perform reconstruction attacks on the training set of arbitrary honest users. (2) An active adversarial user can (i) inﬂuence the update process of honest users in arbitrary ways and (ii) and perform effective privacy attacks such active gradient inversion [64], [3] . We show that these attacks are possible because decentralization increases the inference power of users,

FAQs

What is the main objective of the study on decentralized learning privacy?

The study performs the first in-depth privacy analysis of decentralized learning and compares its privacy to federated learning against both passive and active adversaries.

What attacks are introduced for passive and active decentralized adversaries?

Passive adversaries can infer sample membership and reconstruct training data of honest users. Active adversaries can arbitrarily influence update processes and perform effective privacy attacks such as active gradient inversion.

Why does decentralized learning not provide a security advantage over federated learning?

Decentralization increases users’ inference power and their influence on others’ status, making adversarial users as capable as the parameter server. Mitigations also conflict, and comparable privacy requires fully connected networks that eliminate decentralization’s practical advantage.

Aug 3, 2026

Upload by Logic