Data Leakage in Tabular Federated Learning
Authors: Mark Vero
Mislav Balunovic
Dimitar Iliev Dimitrov
Martin Vechev
Venue: Submitted to ICLR 2023 (2023)
Keywords: federated learning
tabular data
data leakage attacks
gradient inversion

Abstract: While federated learning (FL) promises to preserve privacy in distributed training of deep learning models, recent work in the image and NLP domains showed that training updates leak private data of participating clients. At the same time, most high-stakes applications of FL (e.g., legal and financial) use tabular data. Compared to the NLP and image domains, reconstruction of tabular data poses several unique challenges: (i) categorical features introduce a significantly more difficult mixed discrete-continuous optimization problem, (ii) the mix of categorical and continuous features causes high variance in the final reconstructions, and (iii) structured data makes it difficult for the adversary to judge reconstruction quality. In this work, we tackle these challenges and propose the first comprehensive reconstruction attack on tabular data, called TabLeak. TabLeak is based on three key ingredients: (i) a softmax structural prior, implicitly converting the mixed discrete-continuous optimization problem into an easier fully continuous one, (ii) a way to reduce the variance of our reconstructions through a pooled ensembling scheme exploiting the structure of tabular data, and (iii) an entropy measure which  can successfully assess reconstruction quality. Our experimental evaluation demonstrates the effectiveness of TabLeak, reaching a state-of-the-art on four popular tabular datasets. For instance, on the Adult dataset, we improve attack accuracy by 10% compared to the baseline on the practically relevant batch size of 32 and further obtain non-trivial reconstructions for batch sizes as large as 128. Our findings are important as they show that performing FL on tabular data, which often poses high privacy risks, is highly vulnerable.

Under review as a conference paper at ICLR 2023
DATA LEAKAGE IN TABULAR FEDERATED LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
While federated learning (FL) promises to preserve privacy in distributed training of deep learning models, recent work in the image and NLP domains showed that training updates leak private data of participating clients. At the same time, most high-stakes applications of FL (e.g.. legal and financial) use tabular data. Compared to the NLP and image domains, reconstruction of tabular data poses several unique challenges: (i) categorical features introduce significantly more difficult mixed discrete-continuuut optimization problem, (ii) the mix of categori- cal and continuous features causes high variance in the final reconstructions, and (ili) structured data makes it difficult for the adversary to judge reconstruction quality. In this work, tackle these challenges and propose the first compre- hensive reconstruction attack on tabular data, called Tabl.eak. Tabl_eak is based on three key ingredients: (i) softmax structural prior, implicitly converting the mixed cascrete-continuuu optimization problem into an easier fully continuous one, (ii) way to reduce the variance of our reconstructions through a pooled ensembling scheme exploiting the structure of tabular data, and (iii) an entropy measure which can successfully assess reconstruction quality. Our experimental evaluation demonstrates the effectiveness of TabLeak, reaching a state-of-the-an on four popular tabular datasets. For instance, on the Adult dataset, we improve attack accuracy by 10% compared to the baseline the practically relevant batch size of 32 and further obtain non-trivial reconstructions for batch sizes as large as 128. Our findings are important they show that performing FL on tabular data, which often poses high privacy risks, is highly vulnerable.
INTRODUCTION
Federated Learning (McMahan et al. 2016) (FL) has emerged as the most prominent approach to training machine learning models collaboratively without requiring sensitive data of different parties to be sent to a single centralized location. While prior work has examined privacy leakage in federated
learning in the context of computer vision (Zhu et al. 2019 Geiping al. 2020 Yin et al.) 2021>
and natural language processing (Dimitrov et al. [022a Gupta et al.) 2022; Deng et al. 2021j. many applications of Fl. rely on large tabular datasets that include highly sensitive personal data such as financial information and health status (Borisov et al., [021] Rieke et al. 2020 Long et al. 2021). However, no prior work has studied the issue of privacy leakage in the context of tabular data, a cause of concern for public institutions which have recently launched a competition") with 1.6 mil. USD FL solutions for fraud detection and infection risk prediction,
prize to develop both being tabular datasets.
Key challenges Leakage attacks often rely on solving optimization problems whose solutions are the desired sensitive data points. Unlike other data types, tabular data poses unique challenges to solving these problems because: (i) the reconstruction is solution to a mixed optimization problem, in contrast to other domains where the problem is either fully continuous or discrete (pixels for images and tokens for text), (ii) there is high variance in the final reconstructions because, uniquely to tabular data, discrete changes in the categorical features significantly change the optimization trajectory. and (iii) assessing the quality of reconstructions is harder compared to images and text- e.g. determining whether a person with given reconstructed characteristies exists difficult. Together, these challenges imply that it is difficult to make existing attacks work on tabular data.
httpss///pessprizechhhl wwwpeeahhhaleengececmmm eegeens com/

---

Under review as a conference paper at ICLR 2023
Client
[alee 18, white]
c(r) 00, 08.0,0.1
training update f
Step I: Optimization
Step 2: Pooling
initialize of randomly
initialize z randomly
( [0, 19, 0, 1,0 ( 1. 1.0]
(...0.11, 17, 0.O, D.7. 0.1
[0.0.0.9. 19, 0.0. 1.5 07,022,05,000
0
ooo
10 ((2)
c(aw)
[0. 18, 0,
e(=) 0.7,
0.7.0.7.022
Step Entropy
|a(=²)
|o(=)
211
VE(O(= V
000
#1 x' VE((o=")
Age
Race
21
NN
male f. 181. hispanic +
Figure Overview of TabLeak. Our approach transforms the optimization problem into fully continuous one by optimizing continuous versions of the discrete features, obtained by applying softmax (Step middle boxes), resulting in N candidate solutions (Step 1, bottom). Then, we pool together an ensemble of N different solutions 21, #2, .... EN obtained from the optimization to reduce the variance the reconstruction (Step 2). Finally, we assess the quality the reconstruction by computing the entropy from the feature distributions in the ensemble (Step 3).
This work In this work, we propose the first comprehensive leakage attack on tabular data in the FL setting, addressing the previously mentioned challenges. We provide an overview of our approach in Fig. showing the reconstruction of client's private training data point [male, 18, white). from the corresponding training update V received by the server. In Step 1, we create N separate optimization problems, each assigning different initial values 2 2N to the optimization variables, representing our reconstruction of the client's one-hot encoded data, c(z). To address the first challenge of tabular data leakage, continuous optimization problem into a fully continuous one, by passing our current reconstructions 21 zf....., z through per-feature softmax at every step Using the softmaxed data (2²), take a gradient step to minimize the reconstruction loss, which compares the received client update V with simulated client update computed (z²). In Step 2, reduce the variance of the final reconstruction by performing pooling over the N different solutions 22, 2.......... thus tackling the second challenge. In Step 3, we address the challenge of assessing the fidelity of our reconstructions. We rely on the observation that often when our proposed reconstructions 21, 22, .... nN agree they also match the true client data, c(x:) We measure the agreement using entropy. In the example above, we see that the features sex and age produced a low entropy distribution. Therefore we assign high confidence to these results (green arrows). contrast, the reconstruction of the feature race receives a low confidence rating (orange arrow); rightfully so, as the reconstruction is incorrect.
transform the mixed discrete-
We implemented our approach in an end-to-end attack called Tabl.eak and evaluated on several tabular datasets. Our attack is highly effective: it obtain non-trivial reconstructions for batch sizes as large as 128, and on many practically relevant batch sizes such as 32, it improved reconstruction accuracy by up to 10% compared to the baseline. Overall, our findings show that FL is highly vulnerable when applied to tabular data.
Main contributions Our main contributions are:
Novel insights enabling efficient attacks on FL with tabular data: using softmax to make the optimization problem fully continuous, ensembling to reduce the variance, and entropy to assess the reconstructions.
An implementation of our approach into an end-to-end tool called TabLeak.
Extensive experimental evaluation, demonstrating effectiveness of TabLeak reconstructing sensitive client data on several popular tabular datasets.
2

---

Under review as a conference paper at ICLR 2023
2 BACKGROUND AND RELATED WORK
In this section, we provide the necessary technical background for our work, introduce the notation used throughout the paper, and present the related work in this field.
Federated Learning Federated Learning (FL.) a training protocol developed to facilitate the
distributed training of a parametric model while preserving the privacy of the data at source (McMahan ct al. 2016). Formally, we have a parametric function fe. where 0 ② are the (network) parameters and Ja X + V. Given a dataset as the union of private datasets of clients S = U Sk. we now wish find a 0* O such that:
0" arg min E
Σ (E..BI)ES
[(fo(x:).
(I)
N
in a distributed manner, i.e. without collecting the dataset S in a central database. McMahan et al. (2016) propose two training algorithms: FedSGD (a similar algorithm was also proposed by /Shokri & Shmatikov )2015) and FedAvg, that allow for the distributed training of Sa. while keeping the data partitions Sy client sources. The two protocols differ in how the clients compute their local updates in each step of training. In FedSGD, cach client calculates the update gradient with respect to randomly selected batch of their own data and shares the resulting gradient with the server. In FedAvg. the clients conduct a few epochs of local training on their own data before sharing their resulting parameters with the server. After the server has received the gradients/parameters from the clients, it aggregates them, updates the model, and broadcasts it to the clients. In each case, this process is repeated until convergence, where FedAvg usually requires fewer rounds of communication.
Data Leakage Attacks Although FL was designed with the goal of preserving the privacy of clients' data, recent work has uncovered substantial vulnerabilities. Melis et al. (2019) first presented how one can infer certain properties of the clients' private data in FL. Later, Zhu et al. (2019) demonstrated that an honest but curious server can use the current state of the model and the client gradients to
reconstruct the clients' data, breaking the main privacy promise oederrtted Learning (FL) Under this threat model, there has been extensive research on designing tailored attacks for images (Geiping
ct al. 2020; Geng et al. 2021; Huang et al. [022 Jin et al. 2021 [alunović et al.. 2021 Yin et al.
2021 1
Zhao et al. 2020 Jeon et al. |021 Dimitrov et al. 2022b) and natural language (Deng et al.
2021
Dimitrov et al. 2022a; Gupta et al. 2022). However, no prior work has comprehensively dealt
with tabular data, despite its significance in real-world high-stakes applications (Borisov et al. 2021).
Some works also consider a threat scenario where the malicious server is allowed to change the model
or the updates communicated to the clients (Wen et al. 2022 Fowl et al. 2021); but in this work
focus on the honest-but-curionn setting.
In training with FedSGD, given the model fe an iteration t and the gradient V [(fo(z), y) of some client, we solve the following optimization problem to retrieve the client's private data:
a. ý arg min E(V, C(fo(o))))) v). Ve ((f(('')) AR(x')
(a) (x'x))xxxy)
Where in Eq. (2) we denote the gradient matching loss as E and R is an optional regularizer for the reconstruction. The work Zhu et al. (2019) used the mean square error for E, on which Geiping et al. (2200) improved using the cosine similarity loss. Zhao et al. (200)) first demonstrated that the private labels y can be estimated before solving Eq. 2 reducing the complexity of Eq. 22) and
improving the attack results. Their method was later extended to batches by Yin et al. (022) and
refined by Geng et (202T). Eq. (2) is typically solved using continuous optimization tools such as
L-BFGS (Liu & Nocedal 1989) and Adam (Kingma & Ba 2014). Although analytical approaches
exist, they do not generalize to batches with more than a single data point (Zhu & Blaschko (020).
Depending the data domain, distinct tailored alterations to Eq. 2 have been proposed in the literature, e.g., using the total variation regularizer for images (Geiping et al. 2020) and exploiting pre- trained language models in language tasks (Dimitrov et al.) 2022a Gupta al. [2022). These mostly non- non-transferable domain -speciffc solutions are necessary as each domain poses unique challenges. Our work is first to identify and tackle the key challenges to data leakage in the tabular domain.
3

---

Under review as a conference paper at ICLR 2023
Mixed Type Tabular Data Mixed type tabular data is data type commonly used in health, economic and social sciences, which entail high-stakes privacy-critical applications (Borisov et al. 2021). Here, data is collected in a table of feature columns, mostly human-inteen intaanninterretablee e.g., age, nationality, and occupation of an individual. We formalize tabular data as follows. Let œ E X be one line of data, containing discrete or categorical features and continuous numerical features. Let X' contain K discrete feature columns and L continuous feature columns, i.e. X' = Dj X D2 x x Uz where D. N with cardinality [D; D; and U, IR. For the purpose
x D x U1 of deep neural network training, the categorical features are often encoded in numerical vector. We denote the encoded data batch line as c(z), where we preserve the continuous features and encode the categorical features by a one-hol encoding. The one-hot encoding of the i-th discrete feature xP is a vector (x) of length D, that has one at the position marking the encoded category, while all other entries are zeros. We obtain the represented category by taking the argmax of oi (x) (projection to obtain z). Using the described encoding, one line of data x E X translates to:
e(x) = [x)(x), (z().
(x), of. ..... 2f]. containing d = L + E i=1 D; entries.
3 TABULAR LEAKAGE
In this section, we briefly summarize the key challenges in tabular leakage and present our solution to these challenges in the subsequent subsections and our end-to-end attack.
Key Challenges We now list the three key challenges that we address in our work: (i) the presence
of both categorical and continuous features in tabular data require the attacker to solve significantly harder mixed snacrete-cotinuoue optimization problem (addressed in Sec. [.1]. (ii) the large distance the encodings of the categorical features introduces high variance in the leakage problem (addressed
in Sec. (.2), and (iii) in contrast to images and text, it is hard for an adversary to assess the quality of the reconstructed data in the tabular domain, as most reconstructions may be projected to credible input data points (we address this via uncertainty quantification scheme in Sec. 3.3)
3.1 THE SOFTMAX STRUCTURAL PRIOR
We now discuss our solution to challenge (i) we introduce the softmax structural prior, which turns the hard mixed contrrte-o optimization problem into a fully continuous one. This drastically reduces its complexity, while still facilitating the recovery of correct discrete structures.
To start, notice that the recovery of one-hot encodings can be enforced by ensuring that all entries of the recovered vector are either zero or one, and exactly one of the entries equals to one. However, these constraints enforce integer properties, i.e. they are cin-differentiable and can not be used in combination with the powerful continuous optimization tools used for gradient leakage attacks. Relaxing the integer constraint by allowing the reconstructed entries to take real values in [0, 1], we are still left with constrained optimization problem not well suited for popular continuous optimization tools, such as Adam (Kingma & Ba 2014). Therefore, we are looking for a method that can implicitly enforce the constraints introduced above.
Let 2 E ddd be our approximate intermediate solution for the true one-hot encoded data c(x) at some optimization step. Then, are looking for differentiable function a R.P - [0, 1], such that:
D. Σ
oa(=P)i
1 and a Pbl [0,1]
Vje D,
Notice that the two conditions in Eq. can be fulfilled by applying a softmax to x i.e. define:
exp(2," (xp(2PDi) [i)
M
Vj ejeD D;
Ik=1 exp(=P(k))
Dr
Note that it is easy to show that Eq. (4) fulfills both conditions Eq. 3 and that is differentiable. Putting this together, in each round optimization we will have the following approximation of the
true data point: c(x) R (x)) (a(=²), ..... (xxR), zf,,.., = In order to preserve notational
simplicity, we write (2) to mean the application of softmax to each group of entries representing a given categorical variable separately.
4

---

Under review as a conference paper at ICLR 2023
3.2 POOLED ENSEMBLING
As mentioned earlier, the mix of categorical and continuous features introduces further variance in the difficult reconstruction problem which already has multiple local minima and high sensitivity to initialization (Zhu & Blaschko 2020) (challenge (ii). Concretely, as the one-hot encodings of the categorical features are orthogonal to each other, a change in the encoded category can drastically change the optimization trajectory. We alleviate this problem by adapting an established method of variance reduction in noisy processes (Hastie et al. 2009), i.e. we run independent optimization processes with different initializations and ensemble their results through feature-wise pooling.
Note that the features in tabular data are tied to a certain position in the recovered data vector, thereby we can combine independent reconstructions to obtain an improved and more robust final estimate of the true data by applying feature-wise pooling. Formally, we run N independent rounds of optimization with i.i.d. initializations recovering potentially different reconstructions {2)))) Then, obtain final estimate of the true encoded data, denoted as of (3)) by pooling them:
of (2) pool (10(2R)))=) Vi [K] and pool (1(=)))
Vi [L].
(5)
Where the (-ol(-) operation can be any permutation invariant mapping that maps to the same structure as its inputs. In our attack, we use median pooling for both continuous and categorical features.
Notice that because a batch-gradient is invariant to permutations of the datapoints the corre- sponding batch, when reconstructing from such a gradient we may retrieve the batch-points in different order at every optimization instance. Hence, we need to reorder each batch such that their lines match each other, and only then can conduct the pooling. We reorder by first se- lecting the sample that produced the best recon- struction loss at the end of optimization gbest
[male, 18, hispanic] [female, 35, black] [eemlle 23, hispanic]
[female, 23, hispanic]
[emale, 37, hispanic]
[male, 35, white
Imale, 38, white]
[male, 20, hispanic
hestt
Figure 2: Maximum similarity matching of a sam- ple from the collection of reconstructions to the best-loss sample ghost
with projection ghest Then, we match the lines of every other sample in the collection with respect to gbest, Concretely, we calculate the similarity (described in detail in Sec.44 between each pair of lines of gbest and another sample i; in the collection and find the maximum similarity reordering of the lines with the help of bipartite matching solved by the Hungarian algorithm (Kuhn 1955). This process is depicted in Fig. 2 Repeating this for each sample, we reorder the entire collection with respect to the best-loss sample, effectively reversing the permutation differences in the independent reconstructions. Therefore, after this process we can directly apply feature-wise pooling for each line over the collection.
3.3 ENTROPY-BASED UNCERTAINTY ESTIMATION
We now address challenge (iii) above. To recap, it is significantly harder for an adversary to assess the quality of an obtained reconstruction when it comes to tabular data, almost any reconstruction may constitute a credible data point when projected back to mixed discrete-continun that this challenge does not arise as prominently in the image (or text) domain, because by looking at a picture one can easily judge if it is just noise or an actual image. To address this issue, we propose to estimate the reconstruction uncertainty by looking at the level of agreement over certain feature for different reconstructions. Concretely, given a collection of reconstructions as in Sec. 3.2 we can observe the distribution of each feature over the reconstructions. Intuitively, if this distribution is "peaky", i.e. concentrates the mass heavily on a certain value, then we can assume that the feature has been reconstructed correctly, whereas if there is high disagreement between the reconstructed samples, we can assume that this feature's recovered final value should not be trusted. We can quantify this by measuring the entropy of the feature distributions induced by the recovered samples.
space. Note
Categorical Features Let p(aP)) NV Count, (3ff m)) be the relative frequency of projected reconstructions of the i-th discrete feature of value m in the ensemble. Then, we can calculate the normalized entropy of the feature as H.P log DD, the normalization allows for comparing features with supports of different size, i.e. it ensures that H.P E [0, 1). as 0 < (k)) log KC] for any discrete random variable h E K. of finite support.
-1 Db. p(. )m log p(aP) m Note that
5

---

Under review as a conference paper at ICLR 2023
Algorithm 1 Our combined attack against training by FedSGD
1: function SINGIEINVERSSONNNNeral Network: Se. Client Gradient: Ve (( v). Recon-
structed Labels: ÿ. Initial Reconstruction: zf, Iterations: T, N. Discrete Features: K)
2: for & in 1, ................................ do
3: for in 1, 2..... K do
4:
(2 SOFTMAX(2;
5: end for [++
6:
#f 1) 2.Ecs VV (o v) Vo ((
7: end for
8: return 2!
9: end function
11: function TNeLE Network: fo. Client Gradient: Vo [(f((((=)) v), Reconstructed
Labels: y. Ensemble Size: N, Iterations: T, N. Discrete Features: K)
[ ~ Mo.1j for in 1,2, ......... N do
12:
14:
<- SINGLEINVERSION/S. Vo ((f((((()))))))))))))))))))))))) 2.T
15:
end for
16:
gbest arg ming
vo
(3) + MATCHANDPOOL(((((()) (obbeo))
17:
18:
_ H + CALCULATEENTTROP
19:
i + (R)JECT(O())
return HD HC
21: end function
Continuous Features In case of the continuous features, calculate the entropy assuming that errors of the reconstructed samples follow a Gaussian distribution. As such, we first estimate the sample variance of for the i-th continuous feature and then plug it in calculate the entropy of the corresponding Gaussian: H.C + 2 log 2To² As this approach is universal over all continuous features, it is enough to simply scale the features themselves to make their entropy comparable. For example, this be achieved by working only with standardized features.
Note that as the categorical and the continuous features are fundamentally different from an infor- mation theoretic perspective, have no robust means combine them in way that would allow for equal treatment. Therefore, when assessing the credibility of recovered features, we will always distinguish between categorical and continuous features.
3.4 COMBINED ATTACK
Now provide the description of end-to-end attack, TabLeak. Following Geiping al. 2020
we use the cosine similarity loss as our reconstruction loss, defined as:
(l, g)
Evs(Vo, (c(x)) y), Vo, (o(o))
with Ecs(Lg)== =1 [| 119122
(6)
where (xr, y) are the true data, ÿ are the labels reconstructed beforehand, and we optimize for 2. Our algorithm shown in Alg. [] First, we reconstruct the labels using the label reconstruction method of Geng et al. (2021) and provide them as an input to our attack. Then, we initialize N independent dummy samples for an ensemble of size N (Line 12 Starting from each initial sample we optimize function. In each optimization step,
independently (Line 13 15) via the SINGLEINVERS, apply the softmax structural prior of Sec. 3.1 and let the optimizer differentiate through it (Line 4). After the optimization processes have converged have reached the maximum number of allowed iterations T, we identify the sample ghest producing the best reconstruction loss (Line 16). Using this sample, match and median pool to obtain the final encoded reconstruction a (2) in Line 17 as described in Sec. 3.2 Finally, we return the projected reconstruction & and the corresponding feature-entropies H and HC, quantifying the uncertainty in the reconstruction.

---

Under review as a conference paper at ICLR 2023
4 EXPERIMENTAL EVALUATION
In this section, we first detail the evaluation metric we used to assess the obtained reconstructions. We then briefly explain our experimental setup. Next, we evaluate our attack in various settings against baseline methods, establishing a new state-of-the-ard Finally, we demonstrate the effectiveness of our entropy-base uncertainty quantification method.
As no prior work on tabular data leakage exists, we propose our metric for measuring the accuracy of tabular reconstruction, inspired by the 0-1 loss, allowing the joint treatment of categorical and continuous features. For a reconstruction i, we define the accuracy metric as:
Evaluation Metric
K
I Tao = =P) + >
1 accuracy(r, 8) = K+L L
Σ
Tha E [o] ci, of + +all)
(7)
where is the ground truth and {<r)==1 are constants determining how close the reconstructed continuous features have to be to the original value in order to be considered successfully leaked. We provide more details on our metric in App. A and experiments with additional metrics in App. C3
Baselines We consider two main baselines: (i) Random Baseline does not use the gradient updates and simply randomly samples reconstructions from the per-feature marginals of the input dataset. Due to the structure of tabular datasets, we can easily estimate the marginal distribution of each feature. For the categorical features this can be done by simple counting, and for the continuous features we do it by defining a binning scheme with 100 equally spaced bins between the lower and upper bounds of the feature. Although this baseline is usually not realizable in practice (as it assumes prior knowledge of the marginals), helps us calibrate our metric as performing below this baseline signals that there is no information being extracted from the client updates. Note that because both the selection batch and the random baseline represent sampling from the (approximate) data generating distribution, the random baseline monotonously increases in accuracy with growing batch size, (ii) Cosine Baseline based on the work of Geiping et al.) (2020), who established a strong attack for images. We transfer their attack to tabular data by removing the total variation prior used for images. Note that in the case of most competitive attacks on image and text, when removing the domain specific elements, they reduce this baseline, therefore benchmarking a new domain.
reasonable choice for
Experimental Setup For all attacks, we use the Adam optimizer (Kingma & Ba 2014) with learning rate 0.06 for 500 iterations and without learning rate schedule to perform the optimization in Alg. I In line with Geiping et al.) (2020). we modify the update step of the optimizer by reducing the update gradient its element-wise sign. The neural network we attack is fully connected neural network with two hidden layers of 100 neurons each. We conducted our experiments on four popular mixed-type tabular binary classification datasets, the Adult census dataset (Dua & Graff 2017), the German Credit dataset (Dua & Graff 2017), the Lawschool Admission dataset (Wightman (017)). and the Health Heritage dataset from Kaggle Due to the space constraints, here we report only our results on the Adult dataset, and refer the reader to App. D for full results on all four datasets. Finally, for all reported numbers below, we attack neural network at initialization and estimate the mean and standard deviation of each reported metric on 50 different batches. For experiments with varying network sizes and attacks against provable defenses, please see App. C
For further details on the
experimental setup of each experiment, we refer the reader to App. B
General Results against FedSGD In Tab. we present the results of our strong attack TabLeak against FedSGD training, together with two ablation experiments, each time removing either the pooling (no pooling) the softmax component (no softmax). We compare our results to the baselines introduced above, on batch sizes 8, 16, 32, 64, and 128, once assuming knowledge of the true labels (top) and once using labels reconstructed by the method Geng et al. (222I) (bottom). Notice that the noisy label reconstruction only influences the results for lower batch sizes, and manifests itself mostly in higher variance in the results. It is also worth to note that for batch size 8 (and lower, App. D) all attacks can recover almost all the data, exposing a trivial vulnerability of FL. on tabular
"Souree: hutp://www.kuglle.om/iii
7

---

Under review as a conference paper at ICLR 2023
Table The mean inversion accuracy [%] and standard deviation of different methods over varying batch sizes with given true labels (True y) and with reconstructed labels (Rec. ÿ) on the Adult dataset.
Label
Batch Size
TabI.eak
Tabl (mo pooling)
Tabl (no softmax)
Cosine
Random
8
95.1 + 9.2
93.9 + 10.2
92.9 + 6.5
91.1 + 7.3
53.9 + 4.4
16
89.5 + 7.6
84.5 + 9.9
80.5 + 4.3
75.0 - 5.2
55.1 3.9
True y
77.6 1
72.4 1 4.6
70.8 3.2
66.6 = 3.5
58.0 2.9
64
71.2 :: 2.8
66.2 10.2:20 2.8
66,9
62.5
59.0
128
68.8 + 1.3
64.1 1.4
64.0
59.5 + 2.1
8
86.9 + 11.6
84.6 13.4
85.8
83.3 9.7
53.9 4.4
16
82.4 8.4
7..3+9.0
77.7
+3.0+3.5
55.1
3.9
Rec. ù
32
75.3 + 4.8
70.6 4.3
70.2
66.3 + 3.4
58.0
1.0+221 2.9
64
70.4 3.2
65.9 3.6
2.6
63.1 3.2
59.0 - 3.2
128
68.7
1.3
64.4 1.5
63.8 2.1
59.5 2.1
61.2
+ 3.1
data. In case of larger batch sizes, even up 128, TabLeak can recover significant portion of the client's private data, well above random guessing, while the baseline Cosine attack fails to do so, demonstrating the necessity of domain tailored attack. In a later paragraph. show how we further improve our reconstruction on this batch size and extract subsets of features with > 90% accuracy using the entropy. Further, the results the ablation attacks demonstrate the effectiveness of each attack component, both providing a non-trivial improvement over the baseline attack that is preserved when combined in our strongest attack. Demonstrating generalization beyond Adult, we include our results on the German Credit, Lawschool Admissions, and Health Heritage datasets in App. DDI]] where we also outperform the Cosine baseline attack by at least 10% on batch size 32 on each dataset.
Categorical vs. Continuous Features An interest- ing effect of having mixed type features in the data that the reconstruction success clearly differs by
100
Reconstruction Accuracy (%)
feature type. As we can observe in Fig. 3 the contin- uous features produce an up to 30% lower accuracy than the categorical features for the same batch size. We suggest that this due to the nature of categori- cal features and how they are encoded. While trying to match the gradients by optimizing the reconstruc- tion, having the correct categorical features will have a much greater effect on the gradient alignment, as when encoded, they take up the majority of the data vector. Also, when reconstructing a one-hot encoded categorical feature, we only have be able to retrieve the location of the maximum in vector of length D, whereas for the successful reconstruction of contin- uous feature we have to retrieve its value correctly up to a small error. Therefore, especially when the optimization process is aware of the structure of the encoding scheme (e.g., by using the softmax structural prior), categorical features are much easier to reconstruct. This poses critical privacy risk in tabular federated learning, sensitive features are often categorical, e.g., gender race.
70
Cosine, discrete
Tableak, discrete
40
Cosine, continuous
TabLeak, continuous
1
2
4
16
32
64
128
Batchsize (log scale)
Figure 3: The inversion accuracy the Adult dataset over varying batch size separated for discrete (D) and continuous (C) features.
Federated Averaging In training with FedAvg MMMMhan al. 2016) participating clients conduct local training of several updates before communicating their new parameters to the server. Note that the more local updates are conducted by the clients, the harder a reconstruction attack becomes. making leakage attacks against FedAvg more challenging. Although this training method is of significantly higher practical importance than FedSGD, most prior work does not evaluate against it. Building upon the work Dimitrov et al. (2022b) (for details please see App. B and the work of Dimitrov et al. (2022b)), we evaluate our combined attack and the cosine baseline in the setting of Federated Averaging. We present our results of retrieving client dataset of size 32 over varying number of local batches and epuchs on the Adult dataset in Tab. 2 while assuming full knowledge of the true labels. We observe that while combined attack significantly outperforms the random
8

---

Under review as a conference paper at ICLR 2023
Table 2: Mean and standard deviation of the inversion accuracy [%] on FedAvg with local dataset sizes of 32 on the Adult dataset. The accuracy of the random baseline for 32 datapoints is 58.0 + 2.9.
TabLeak
Cosine
n. batches
epoch
5 epochs
10 epochs
1 epoch
epoccs
10 epochs
77.4
2.9
67.6 3.7
65.2 2.7
56.1 4.1
53.2 +
75.7 =
71.7 3.9
67.7 4.2
64.8 3.3
56.4
4.8
56.2 +
75.9
71.0 + 3.2
67.4 3.4
64.8 61.8+3.4
58.7 4.6
56.6 + 5.0
Table 3: The mean accuracy [%] and entropies with the corresponding standard deviations over batch sizes of the categorical (top) and continuous (bottom) features.
Batch Size
16
32
64
128
Acc.
98.5 + 5.6
97.2 + 4.3
91.0 + 4.4
83.2 + 3.6
78.5 1.8
D
0.15 0.13
0.26 + 0.11
0.40
0.06
0.48 + 0.04
0.53 + 0.03
Acc.
90.9 + 14.7
78.8 + 13.5
59.2
6.9
55.1 3.0
55.7 + 2.0
-1.1 0.95
-0.11 0.63
0.77 = 0.30
1.21 + 0.19
1.48 0.10
baseline of 58.0% accuracy even up to 40 local updates, the baseline attack fails consistently do so whenever the local training is longer than one epoch. As FedAvg with tabular data is of high practical relevance, our results which highlight its vulnerability are concerning We show further details for the experimental setup and results on other datasets in App. B and App. [D respectively.
Assessing Reconstructions via Entropy We now investigate how an ad adversary can use the en- tropy (introduced Sec. (.3) to assess the qual- ity of their reconstructions. In Tab. 3 we show the mean and standard deviation the accuracy and the entropy of both the discrete and the con- tinuous features over increasing batch sizes af- ter reconstructing with TabLeak (ensemble size 30). We observe an increase the mean entropy the increasing batch sizes, corresponding to accuracy decrease in the reconstructed batches. Hence, an attacker can understand the global effectiveness of their attack by looking at the retrieved entropies, without having to compare their results to the ground truth.
Table The mean accuracy [%] and the share of data [%] in each entropy bucket for batch size 128 on the Adult dataset.
Entropy
Categorical Features
Bucket
Accuracy [%]
Data [%]
0.0-0.2
95.7
8.1
0.2-0.4
90.5
23.4
0.4-0.6
79.8
27.7
0.6-0.8
69.8
29.2
0.8-1.0
61.2
11.6
Overall
78.5
100
Random 73.8
100
We now look at single batch of size 128 and put each categorical feature into bucket based on their reconstruction entropy after attacking with TabLeak (ensemble size 30). In Tab. we present our results, showing that features falling into lower entropy buckets (0.0-0.2 and 0.2-0.4) inside batch are significantly more accurately reconstructed (> 90%) than the overall batch (78.5%). Note that this bucketing can be done without the knowledge of the ground-truth yet the adversary can concretely identify the high-fidelity features in their noisy reconstruction. This shows that for reconstructions large batches that seem to contain little-to-no information (close to random baseline), an adversary still extract subsets of the data with high accuracy. Tables containing both feature types on all four datasets can be found in App. D.4 providing analogous conclusions.
CONCLUSION
In this work presented TabLeak, the first data leakage attack on tabular data in the setting of federated learning (FL), obtaining state-of-the-ae results against both popular FL training protocols in the tabular domain. As tabular data is ubiquitous in privacy critical high-stakes applications, our results raise important concerns regarding practical systems currently using FL. Therefore, we advocate for further research advancing defenses necessary to mitigate such privacy leaks.

---

Under review as a conference paper at ICLR 2023
ETHICS STATEMENT
As tabular data is often used in high-stakes applications and may contain sensitive data of natural or legal persons, confidential treatment critical. This work presents an attack algorithm in the tabular data domain that enables FL server steal the private data of its clients in industry scenarios, deeming such applications potentially unsafe.
We believe that exposing vulnerabilities of both recently proposed and widely adopted systems, where privacy is a concern, can benefit the development of adequate safety mechanisms against malicious actors. In partieular, this view is shared by the governmental institutions of the United States of America and the United Kingdom that jointly supported the launch of a competition lhttps://pet weworrizechalleeggee
com/) aimed advancing the privacy of FL in the tabular domain, encouraging the participation of both teams developing defenses and attacks. Also, as our experiments App [CI show, existing techniques can help mitigate the privacy threat, hence we encourage practitioners to make use of them.
REPRODUCIBILITY STATEMENT
We publish all of our code and provide it to the reviewers in an anonymized form on the openreview discussion forum. Alongside the code, we provide detailed README file with instructions how to run all of our experiments presented in Sec. and our additional experiments presented in App. C To allow better reproducibility. our code presets random seeds the chosen constant 42. Further, all of our reported numbers are statistics of 50 independent repeated experiments, and wherever possible, we report standard deviations. Finally, our hyperparameters and information about the hardware on which we ran our experiments are provided in App. B
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS '16, pp. 308-318, New York, NY, USA, 2016. Association for Computing Machinery. ISBN 9781450341394, 2978318. URL http:: :/oo:://oooo.. wrg.r00gg....... 0tt.://0..111/2997711117 29783111199711
doi: 10. 10.1145/2976749
Mislav Balunović, Dimitar I. Dimitrov, Robin Staab, and Martin Vechev. Bayesian framework for gradient leakage, 2021.
Vadim Borisov, Tobias Leemann, Kathrin SeBler, Johannes Haug. Martin Pawelczyk, and Gjergji Kasneci. Deep neural networks and tabular data: A survey, 2021. URL htllattss///axiivi
abs/ 2tt0/110.000 01889
Jieren Deng, Yijue Wang, Ji Li, Chao Shang, Hang Liu, Sanguthevar Rajasekaran, and Caiwen Ding. Tag: Gradient attack on transformer-basee language models, 2021. URL bottps://arxx:
org /tgg/bs//2in aba/ 06819
Dimitar I. Dimitrov, Mislav Balunović, Nikola Jovanović, and Martin Vechev. Lamp: Extracting text from gradients with language model priors, 2022a. URL httph: /ttp://///riv../. org. abs 2202
08827
Dimitar I. Dimitrov, Mislav Balunović, Nikola Konstantinov, and Martin Vechev. Data leakage in federated averaging, 2022b. URL
Dheeru Dua and Casey Graff. UCI machine learning repository, 2017. URL ics. www.uuu.ee///...
Liam Fowl, Jonas Geiping, Wojtek Czaja, Micah Goldblum, and Tom Goldstein. Robbing the fed: Directly obtaining private data federated learning with modified models, 2021. URL
https:
https://erxxie wwtp:rwwwwwwvorrooor//rorooese/e
13007
13057
10

---

Under review as a conference paper at ICLR 2023
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is it to break privacy in federated learning?, 2020. URL htttps://axxiv..org
abs 221122003.14455
Jiahui Geng, Yongli Mou, Feifei Li, Qing Li, Oya Beyan, Stefan Decker, and Chumming Rong. Towards general deep leakage in federated learning, 2021. URL
2110. 09074
Samyak Gupta, Yangsibo Huang, Zexuan Zhong, Tianyu Gao, Kai Li, and Danqi Chen. Recovering private text in federated learning of language models, 2022. URL https: http:///axxvv........ /ttp/////////////..o.oo////////.
22C5. 08514
Hastie, Tibshirani, and J.H. Friedman. The Elements of Statistical Learning: Data Mining, Inference, and Prediction. Springer series in statistics. Springer, 2009. ISBN 9780387848846. URL htttttttt///oooss...t wtw.oooossoooooooooooooooooooooo ctw.o///sssooo.......oooo//////
Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient
inversion attacks and defenses in federated learning. 2021. doi: 1044555//RXX12112200000/
URL htttttttt//axiiiii http:////aaxwv.rrg///a... wttg:bb///////////b/ 00059
Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradient inversion with generative image prior, 2021. URL https:
wwtgg//g/ggg.o...///////gg/go 14962
Xiao Jin, Yu Chen, Chia-Y Yi Hsu, Chia-Mu Yu, and Tianyi Chen. Cafe: Catastrophic data leakage in vertical federated learning, 2021. URL http:ppp:///iii.oorrr///////////
15122
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2014. URL
https::/arxiv: org/ abs/ 1412, 6980
H. W. Kuhn. The hungarian method for the assignment problem. Naval Research Logistics Quarterly, 2(1-2):83-97, 1955. doi: https://doi.org/11000 http:://oi.orr//..00022aaa.a.. 200000000/0/..00000000099
URL https
1002000222ae //on womelinelibaare wiwey. htw.lley.coomaaaa cww/doo//aaaaaaooooocoooooo https/0000..000//000000000000000 3800020109
Dong C. Liu and Jorge Nocedal. On the limited memory bfgs method for large scale optimization.
Mathematical Programming, 45:503-528, 1989.
Guodong Long, Yue Tan, Jing Jiang, and Chengqi Zhang. Federated learning for open banking, 2021.
URL https://arxiis org/ abs/ 10749
H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas Communication-efficienn learning of deep networks from decentralized data. 2016. doi: 10.48550/
ARXIV.1602.05629 URL httttp:://axxxw.oorr//aaa////
05629
Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 20/9 IEEE Symposium Security and Privacy (SP), pp. 691-706, 2019. doi: 10. 10.11090 10.1109/9.2019.00022
Nicola Rieke, Jonny Hancox, Wenqi Li, Fausto Milletari, Holger R. Roth, Shadi Albarqouni, Spyri- don Bakas, Mathieu N. Galtier, Bennett A. Landman, Klaus Maier-Hein, Sébastien Ourselin, Micah Sheller, Ronald M. Summers, Andrew Trask, Daguang Xu, Maximilian Baust, and M. Jorge Cardoso. The future of digital health with federated learning. npj Digital Medicine, 3(1), sep 2020. doi: 10.
020000200000011100000000000000-0 URL https: /tttps://doi... org/ 10. 1038
01641746-020-00233-1
Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC Conference Computer and Communications Security, CCS 115, pp. 1310-1321, New York, NY, USA, 2015. Association for Computing Machinery. ISBN 9781450338325. doi:
10. 10103.22 2863687
URL BtLLhttts://dool wttp:////ooooor///////oo// /10. 11w.:/..1111.2.111
2813687
Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in
large-batch federated learning via gradient magnification, 2022. URL /tt.:tttps///rxx...orr
abs/ 220./220..2m 00580
F. Linda Wightman. LSAC national longitudinal bar passage study, 2017.
11

---

Under review as a conference paper at ICLR 2023
Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M. Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion, 2021. URL /ttpt//a////xi..////////
abs abs/2104... 07586
Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients, 2020.
httphtss::/ /ttp:v.//axxvv..oo org. att///bs/000000 2001. 02610
Junyi Zhu and Matthew Blaschko. R- R-gap: Recursive gradient attack on privacy, 2020. URL
https://arxiv. at/ /011. 07733
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients, 2019. URL https
//axxiv.oro/abs/1996.000
12

---

Under review as a conference paper at ICLR 2023
Table 6: Dataset specifications.
Features
Discrete Features
Continuous Features
Encoded Features
Data Points
Adult
14
8
6
105
45 222
German
20
13
7
63
1000
Lawschool
7
5
2
39
96 584
Health Heritage
17
6
11
110
218 415
A ACCURACY METRIC
To ease the understanding, we start by repeating our accuracy metric here, where we measure the reconstruction accuracy between the retrieved sample & and the ground truth as:
K
accuracy(r, 2) = K+L
1
12 = -.) + Σ Ma E 1=1
[o - of + tcllt)
(8)
2=1
Note that the binary treatment of continuous features in accuracy metric enables the combined measurement of the accuracy on both the discrete and the continuous features. From an intuitive point of view, this measure closely resembles how one would judge the correctness of numerical guesses. For example, guessing the age of 25 year old, one would deem the guess good if it is within 3 to 4 years of the true value, but the guesses 65 and 87 would be both qualitatively incorrect. In order to facilitate scalability of our experiments, we chose the { error-tolerance-bounde based on the global standard deviation the given continuous feature of and multiplied by a constant, concretely, we used & 0.319 of for all our experiments. Note that Pr(4-0.3111 0.319 x < 0+3.11 0.25 for a Gaussian random variable with mean l and variance o². For our metric this means that assuming Gaussian zero-mean error in the reconstruction around the true value, we accept our reconstruction privacy leakage as long we fall into the 25% error-probability range around the correct value. In Tab. 5 we list the tolerance bounds E, for the continuous features of the Adult dataset produced by this method. We would like to remark here, that we fixed our metric parameters before conducting any experiments, and did not adjust them based on any obtained results. Note also that in App. C we provide results where the continuous feature reconstruction accuracy is measured using the commonly used regression metric of root mean squared error (RMSF), where Tabl.aat also achieves the best results, signaling that the success of our method is independent of our chosen metric.
Table 5: Resulting tolerance bounds the Adult dataset when using c, 0.319 used by us for our experiments.
feature
age
fnlwgt
education-nus
capital-gain capital- -oottalllssss
hours-per-weet
lolerance 4.2
33699
0.8
2395
129
3.8
B FURTHER EXPERIMENTAL DETAILS
Here we give extended description our experimental details provided in Sec. 4 additionally we provide the specifications of each used dataset in Tab. [6] For all attacks, we use the Adam optimizer (Kingma Ba 2014) with learning rate 0.06 for 550 iterations and without a learning rate schedule. We chose the learning rate based on our experiments on the baseline attack where it performed best. line with Geiping et al. (2020), we modify the update step of the optimizer by reducing the update gradient to its element-wite sign. We attack a fully connected neural network with two hidden layers of 100 neurons each at initialization. However, we provide a network-size ablation in Fig. g where we evaluate our attack against the baseline method for 5 different network architectures. For each reported metric we conduct 50 independent runs on 50 different batches to estimate their statisties. For all FedSGD experiments ranges before measuring the reconstruction accuracy, both for our attacks and the baseline methods. We each of experiments single cores of Intel(R) Xeon(R) CPU ES-2690 v4 @ 2.60GHz..
clamp the continuous features their valid
13

---

Under review as a conference paper at ICLR 2023
Federated Averaging Experiments For experiments attacking the FedAvg training algorithm, we fix the clients' local dataset size at 32 and conduct an attack after local training with learning rate 0.01 on the initialized network described above. We use the FedAvg fraack-frameork of Dimitrov et al. (002b)), where for each local training epoch we initialize an independent mini- dataset matching the size of the client dataset, and simulate the local training of the client. At each reconstruction update, we use the mean squared error between the different epoch data means (Div lg and g = mean in Dimitrov et al. (2022b) the permutation invariant epoch prior required by the framework, ensuring the consistency of the reconstructed dataset. For the full technical details, please refer to the manuscript of Dimitrov al. (2022b). For choosing the prior parameter Ainv. we conduct line-search on each setup and attack method pair individually [0.0, 0.5, 0.1, 0.05, 0.01, 0.005, 0.001], and pick the ones providing the best results. Further, to reduce computational overhead, we reduce the ensemble size of Tabl Leak from 30 to 15 for these experiments on all datasets.
the parameters
C FURTHER EXPERIMENTS
In this subsection, we present three further experiments:
Results of attacking neural networks defended using differentially private noisy gradients in App. C.1
Ablation study on the impacts of the neural network's 's size on the reconstruction difficulty in App. C.2
Mcasuring the Root Mean Squared Error (RMSE) of the reconstruction of continuous features in App. C.3
C.I ATTACK AGAINST GAUSSIAN DP
Differential privacy (DP) has recently gained popularity, way to prevent privacy violations in FL (Abadi et al. 2016: Zhu et al., 2019). Unlike, empirical defenses which are often broken by specifically crafted adversaries (Balunović of data leaked by a FL model, in terms of the magnitude of random noise the clients add to their gradients prior to sharing them with the server (Abadi et al.) [0166] Zhu al.) 2019). Naturally, DP methods balance privacy concerns with the accuracy of the produced model, since bigger noise results in worse models that are more private. Cosine baseline against DP defended gradient updates, where zero-mean Gaussian noise is added with standard deviations 0.001, 0.01, and 0.1 to the client gradients. We present our results on the Adult, German Credit, Lawschool Admissions, and Health Heritage datasets in Fig. 4 Fig. 5 Fig. 6 and Fig. 7 respectively. Although both methods are affected by the defense, our method consistently produces better reconstructions than the baseline method. However, for high noise level (standard deviation = 0.1) and larger batch size both attacks break, advocating for the use of DP defenses in tabular Fl. to prevent the high vulnerability exposed by this work.
al. 2021). DP provides guarantees
the amount
this subsection, we evaluate TabLeak, and the
14

---

Under review as a conference paper at ICLR 2023
100
Random TabLeak
Random
Reconsiraction Accuracy 195]
Tablaak
luconstnction Accuracy
Ieconsinction Accuracy
80
80
80
70
70
70
Cosine
60
60
50
50
50
40
40
40
16 32 Batchsize (lng scalle
64
16 32 Batchsize (log scale]
128
16
32
128
Batchsize (log scale]
(a) standard deviation 0.001
(b) standard deviation
(c) standard deviation
Figure 4: Mean and standard deviation accuracy [%] curves over batch size at varying Gaussian noise level o added to the client gradients for differential privacy on the Adult dataset.
Recorstruction Accuracy 1%6
90
Recorstruction Acturacy [%6]
90
Cosine
Recorstructin Accuracy [96
90
Cosine
80
80
Random
70
70
60
TabLeak
60
60
50
50
50
30
30
30
2
4
16
32
64
128
2
16
32
128
1
16
32
64
128
Batchsize (lag
Batchsize
Batchsize scale)
(a) standard deviation 0.001
standard deviation 0.01
(c) standard deviation
0.1
Figure 5: Mean and standard deviation accuracy [%] curves over batch size at varying Gaussian noise level added to the client gradients for differential privacy on the German Credit dataset.
100
100
Random
100
Random
Cosine
Cosine
Reconstructin Accurecy [%)]
Recondruction Accuncy [S]]
Tableak
Reconstructio Accuracy [%]]
Tableak
80
70
Random
70
70
Cosine
60
Tebleak
60
60
50
50
40
40
40
30
30
30
Datchsiee (log stale)
Datchsize (log stale)
Datchsiet (log stale]
(a) standard deviation = 0.001
(b) standard deviation = 0.01
(c) standard deviation = 0.1
Figure 6: Mean and standard deviation accuracy [%] curves over batch size at varying Gaussian noise level a added to the client gradients for differential privacy on the Lawschool Admissions dataset.
15

---

Under review as a conference paper at ICLR 2023
Random Cosine
Random
Reconstrucion Accuracy 186
90
Reconstructio Accuracy 1%6
90
Reconstrucion Accuracy [K]
90
Cosine
TabLeak
80
80
80
Random
Cosine
60
Tableak
60
60
50
50
50
30
30
30
16 32 (log scale)
64
128
2
16 32
128
2
16
32
128
(log scale)
scale)
standard deviation 0.001
standard deviation 0.01
(c) standard deviation 0.1
Figure 7: Mean and standard deviation accuracy [%] curves over batch size at varying Gaussian noise level added to the client gradients for differential privacy on the Health Heritage dataset.
C.2 VARYING NETWORK SIZE
To understand the effect the choice of the network has on the obtained reconstruction results, defined 4 additional fully connected networks, two smaller, and two bigger ones to evaluate TabLeak on. As simple linear model often good baseline for tabular data, we add it also to the range of attacked models. Concretely, we examined the following six models for our attack:
Linear: a linear classification network: [w((c()) (W + b),
NN I: single hidden layer neural network with 50 neurons,
NN 2: single hidden layer neural network with 100 neurons,
NN 3: a neural network with two hidden layers 100 neurons each (network used in main body),
NN 4: neural network with three hidden layers of 200 neurons each,
NN 5: a three hidden layer neural network with 400 neurons in each layer.
We attack the above networks, aiming to reconstruct batch of size 32. We plot the accuracy of TabLeak and the cosine baseline as function of the number of parameters in the network in Fig. g for all four datasets. We can observe that with increasing number of parameters the network, the reconstruction accuracy significantly increases on all datasets, and rather surprisingly. allowing for near perfect reconstruction of batch as large as 32 in some cases. Observe that on both ends of the presented parameter scale the differences between the methods degrade, i.e. they either both converge to near-perfect reconstruction (large networks) or to random guessing (small networks). Therefore, the choice of network for conducting the experiments was instructive in examining the differences between the methods.
Additionally, to better understand the relevance of the models examined here, train them each of the datasets for 50 epochs and observe their behavior through monitoring their performance on a secluded test set of each dataset. We do this for 5 different initializations of each model, and report the mean and the standard deviation of the test accuracy at each training epoch for each model. Note that we do not train the models using any FL protocol, merely, this experiment serves give better understanding between the relation of the given dataset and the model used, putting also the attack success data better perspective. For training, we use the Adam Kingma Ba (2014) optimizer and batch size 256 for each of the datasets, except for the German Credit dataset, where we train with batch size due its small size. We provide all test accuracy eurves over training in Fig. From the accuracy curves we can observe that most large models that are easy to attack tend to overfit quickly to the data, indicating a heavily overparameterized regime. Additionally, in Tab, we provide the peak mean test accuracies per dataset and model, effectively corresponding to 'perfect' strly-stopping. The linear model could appear to be an overall good choice, as is very hard to attack and shows good stability during training, however, it does not achieve competitive performance on most datasets. In Tab. 7 the non-linear models always outperform the linear model, and achieve comparable performance across themselves in this ideal setting, where overfitting can be prevented
16

---

Under review as a conference paper at ICLR 2023
100
100
Used NN
Used NN
90
Random
Reconstruction Accuracy [%)
90
Random
Cosine
Cosine
Reconstruction Accuracy
80
TabLeak
80
TabLeak
70
70
60
60
50
50
40
40
30
30
0.2
102.0
364.0 0
0.1
16.7
93.6
347.2 .2
Params (th (thousand)
# Params (thousand)
(a) Adult = 105
(b) German Credit: = 63
100
100
Used NN
Used NN
90
Random
Reconstruction Accuracy [%)
90
Random
Cosine
Cosine
Reconstruction Accuracy
80
TabLeak
80
TabLeak
70
70
60
60
50
50
40
40
30
30
0.1
2.
A.2
14.3
88.8
337.6
0.2
5.6
103.0
366
#Params (thousand)
# Params (thousand)
(c) Lawschool Admissions: d = 39
(d) Health Heritage: d = 110
Figure Mean attack accuracy curves with standard deviation for batch size 32 over varying network size (measured in number of parameters, #Params, log scale) on all four datasets with d number of features after encoding. We mark the network we used for our other experiments with dashed vertical line. From left to right we have the following models: Linear, NN 1, NN 2, NN 3, NN 4, and NN5.
Table 7: Mean and standard deviation of the peak test accuracy of each of the examined models on the four discussed datasets training.
Linear
Layout 1
Layout
Layout 3
Layout
Layout
Adult
84.7 + 0.1
84.9 = 0.1
85.0 0.1
84.
0.1
84.7 - 0.1 79.4 1.8
German
73.0 + 1.4
80.0
79.5 0.6
8..9
7..9
Lawschool
87.4 0.0
8.1
89.8
9.10
8.1
89.8 0.1
Health Heritage
80.9 - 0.0
8.1
8.0
8..
81.2
0.110.11
by monitoring on the test data Conclusively, simpler non-linear models shall be pursued for FL
on tabular data, they are less prone to overfitting and provide better protection from data leakage attacks.
In practice proxy metric would he necessary to achieve carly-stopping, such as monitoring the performance separate validation split from the training data
17

---

Under review as a conference paper at ICLR 2023
80
84
75
Test Accuracy [%6]
Test Accuracy [%]
65
Linear
NN
55
NN
NN
NN
NN
NN
NN
NN
NN
45
10
20
40
50
1
10
20
40
50
Epochs
Epechs
(a) Adult
(b) German Credit
90
88
80
Test Accuracy [%]
Test Accuracy [%]
79
86
78
Linear
84
77
NN
NN
82
NN
76
NN
NN
NN
1
20
40
50
1
10
40
50
Epochs
(c) Lawschool Admissions
(d) Health Heritage
Figure 9: Mean test and standard deviation of the test accuracy epochs during five independent runs of training for each examined model on all four datasets. For our experiments elsewhere we used the network corresponding Layout 3, marked red here.
18

---

Under review as a conference paper at ICLR 2023
Cosine
Cosine
TabLeak
TabLeak
(no softmax)
(no softmax)
TabLeak
TabLeak (no pooling)
6
(no pooling)
TabLeak
TabLeak
RMSE
RMSE
2
2
1
16
32
64
128
1
4
16
32
64
128
Batchsize (log scale)
Batchsize (log scale)
(a) Adult
(b) German Credit
10
Cosine
4.0
Cosine
TabLeak
Tableak
8
(no softmax)
3.5
(no softmax)
TabLeak
(no pooling)
3.0
TabLeak
(no pooling)
TabLeak
2.5
TabLeak
RMSE
RMSE
2.0
1.5
1.0
2
0.5
0.0
2
16
32
64
128
1
8
16
32
64
128
Batchsize (log scale)
Batchsize (log scale)
(c) Lawschool Admissions
(d) Health Heritage
Figure 10: The mean and standard deviation the Root Mean Square Error (RMSE) of the recon- structions of the continuous features on all four datasets over batch sizes.
C.3 CONTINUOUS FEATURE RECONSTRUCTION MEASURED BY RMSE
In order to examine the potential influence of our choice of reconstruction metric on the obtained results, we further measured the reconstruction quality of continuous features on the widely used Root Mean Squared Error (RMSE) metric as well. Concretely, we calculate the RMSE between the L continuous features of our reconstruction &C and the ground truth in batch of size
n
RMSE ,.0)
(a) - 2gg2
j=1
As results in Fig. [0 demonstrate, TabLeak achieves significantly lower RMSE than the Cosine baseline on large batch sizes, for all four datasets examined. This indicates that the strong results obtained by TabLeak in the rest of the paper are not consequence of evaluation metric.
19

---

Under review as a conference paper at ICLR 2023
Table The mean inversion accuracy [%] and standard deviation of different methods over varying batch sizes with given true labels (top) and with reconstructed labels (bottom) on the Adult dataset.
Label
Batch Size
TabLeak
TabLeak (no pooling)
TabLeak (no softmax)
Cosine
Random
99.4 + 2.8
99.1 + 4.4
100.0 + 0.0
100.0 0.0
43.3 11.8
2
99.2 + 5.5
99.1 6.5
99.9 + 1.0
9..
47.1 7.9
4
98.0 = 4.5
96.6 1.6
98.9 + 4.0
9.2
49.8 4.9
8
95.1
93.9 10.2
92.9
7.3
63.9 4.4
True y
16
89.5 + 7.6
84.5
8..5
5.2
55.1 3.9
32
4.8
4.6
3.2
3.5
2.9
64
2.8
2.8
2.7
6.1
3.2
128
1.3
64.1
6.10
59.5
61.2
1
99.4
3.6
100.0 0.0
100.0 0.0
43.3 + 11.8
8.9
9.1
98.6 1 7.5
95.9 11.5
4..1
4
1
15.2
90.0 13.0
13.7
49.8
11.6
14.6113.4
9.9
9.7
53.9
Rec. Ú
16
82.4 8.4
7.0
4.1
+..0
55.1
32
75.3 4.8
4.3
3.2
6.4
58.0
64
7
3.6
66.8 2.6
6.21
5.2
128
68.7 1.3
1.5
2.1
2.1
61.2
D ALL MAIN RESULTS
In this subsection, include all the results presented in the main part of this paper for the Adult dataset alongside with the corresponding additional results on the German Credit, Lawschool Admis- sions, and the Health Heritage datasets.
D.1 FULL FEDSGD RESULTS ON ALL DATASETS
In Tab. g Tab. Tab. 10 and Tab. we provide the full attack results of our method compared to the Cosine and random baselines on the Adult, German Credit, Lawschool Admissions, and Health Heritage datasets, respectively. Looking at the results for all datasets, we can confirm the observations made Sec. 4 i.e. (i) the lower batch sizes are vulnerable to any non-trivial attack, (ii) not knowing the ground truth labels does not significantly disadvantage the attacker for larger batch sizes, and (iii) TabLeak provides a strong improvement over the baselines for practically relevant batch sizes over all datasets examined.
D.2 CATEGORICAL VS. CONTINUOUS FEATURES ON DATASETS
In Fig. I we compare the reconstruction accuracy of the continuous and the discrete features on all four datasets. We confirm our observations, shown in Fig. Bi the main text, that strong dichotomy between continuous and discrete feature reconstruction accuracy exists on all 4 datasets.
D.3 FEDERATED AVERAGING RESULTS ON ALL DATASETS
In Tab. 12 Tab. B
Tab. 14 and Tab. 15 we present our results on attacking the clients in FedAvg training the Adult, German Credit, Lawschool Submissions, and Health Heritage datasets, respec- tively. We described the details of the experiment in App. A above. Confirming our conclusions drawn in the main part of this manuscript, accuracy over all settings and even for large numbers of updates, while the baseline attack often fails outperform random guessing, when the number of local updates is increased.
observe that TabL.eak achieves non-trivial reconstruction
20

---

Under review as a conference paper at ICLR 2023
Table The mean inversion accuracy [%] and standard deviation of different methods over varying batch sizes with given true labels (top) and with reconstructed labels (bottom) on the German Credit dataset.
Label
Batch Size
TabLeak
TabLeak (no pooling)
TabLeak (no softmax)
Cosine
Random
100.0 0.0
100.0 0.0
100.0 0.0
100.0 0.0
43.9 9.8
2
100.0 = 0.0
100.0 0.0
99.9 + 0.7
98.0 7.1
45.1 6.6
99.9 0.4
3.6
99.5 1.2
97.8 6.0
50.3 4.5
8
1.1
2.2
98.2 2.5
9.2
512
True
3.4
9..
3..1
7.43
54.5 3.0
32
83.6
3.1
1.9
2.2
56.8 - 2.2
64
1.3
1.
1.4
1.8
59.4 1.9
128
0.8
0.8
1.5
6.55
61.0 2.1
100.0 0.0
100.0 0.0
0.0
1.0
43.9 9.8
100.0 - 0.0
3.5
9.7
9..
4..1
4
2.6
2.9
9.0
9..4
5.5
97.2 6.1
6.8
96.0
94.8
512
Rec. ù
16
6.5
7.3
8.6
4.6
3.0
32
3.4
2.8
7..5
2.11
56.8
64
72.9
70.5 1
1.3
6.7
1
128
71.100.9
69.1 + 0.7
1.6
6.64
61.0 2.1
Table 10: The mean inversion accuracy [%] and standard deviation of different methods over varying batch sizes with given true labels (top) and with reconstructed labels (bottom) on the Lawschool Admissions dataset.
Label
Batch
TabLeak
Tableak (no pooling)
Tableak (no softmax)
Cosine
Random
Size
100.0 + 0.0
100.0 0.0
100.0 0.0
100.0 +
38.9 14.6
2
100.0
= 0.0
100.0
99.9 + 1.0
96.3 10.4
38.4 11.5
100.0 1 0.0
100.0
99.7 1.2
9.66
43.2
8
98.7=
3.7
96.0
94.5
4.64
True
16
9.6
6.5
4.5
5.5
531
32
8.9
4.1
7.8
7..0
2.3
64
7.0
7..6
7.10
2.2
6.2
128
7..
7..0
7.67
7.78
6..4
100.0
1.0
100.0 0.0
38.9 - 14.6
2
99.1
5.00
7.1
95.9
38.4 11.5
3.0
99.0
6.3
9.5
4.2
8
9.8
95.
93.4
91.9
4.64
Rec. ú
16
7.3
89.1
4.75
7.44
53.0
32
4.1
80.9
7.27
7..0
5..
64
77.2
76.0
72.7
7,45
6.,4
128
1.2
7.
73.9
7.8
1.5
21

---

Under review as a conference paper at ICLR 2023
Table 11: The mean inversion accuracy [%]] and standard deviation of different methods over varying batch sizes with given true labels (top) and with reconstructed labels (bottom) on the Health Heritage dataset.
Label
Batch Size
Tableak
TabLeak (no pooling)
TabLeak (no softmax)
Cosine
Random
99.8 1.6
99.8 1.6
99.8 + 1.6
99.8 1.6
34.8 13.1
97.7 8.3
97.2 : 10.2
98.6 + 3.3
97.9 5.6
36.9 :
98.2 6.5
9
97.8 + 4.2
95.6
37.0 5.3
96.0 8.2
94.211003 10.5
9.1
8..
39.2
True y
16
86.1
9.9
67.8
5.5
4.7
32
70.0 4.5
6.97
4.0
4.17
43.4
64
2.8
2.7
4.3
4.74
4.7
128
63.0 1.4
1.6
59.9
4.8
46.8 3.2
1.6
99.9 0.8
99.8 1.6
2.5
34.8
13.1
15.4113.6
94.8 15.1
95.2 13.6
16.9
36.9 9.8
86.6 20.2
84.7
84.7
8 20.7
37.0 5.3
+ 15.6
16.3
43.3
13.8
3.8
Rec. !
12.4
11.
7.6
6.3
41.4
32
5.7
4.7
3.8
4.0
4..4
64
62.6 2.6
59.6 2.6
4.0
5..7
45.0
128
62.7 1.6
1.6
591
5.0
46.8 3.2
Table 12: Mean and standard deviation of the inversion accuracy [%] with local dataset size of 32 in FedAvg training the Adult dataset. The accuracy of the random baseline for 32 datapoints is 58.0 + 2.9.
TabLeak
Cosine
n. batches
epoch
epochs
epochs
epoch
epochs
epochs
77.4445
71.1
67.6 + 3.7
65.2 + 2.7
56.1 4.1
53.2 + 4.2
2
71.7
87.7
64.8 + 3.3
56.4 4.8
56.2 + 4.8
75.9 4.4
71.0 +
3.44
64.8 3.4
58.7 + 4.6
56.6 + 5.0
Table 13: Mean and standard deviation of the inversion accuracy [%] with local dataset size of 32 in FedAvg training on the German Credit dataset. The accuracy of the random baseline for 32 datapoints 56.9 + 2.1.
TabLeak
Cosine
n. batches
epoch
5 epochs
epochs
epoch
epochs
epochs
95.2 + 3.8
87.9 + 6.2
83.4 + 4.6
78.2 + 4.6
65.4 6.2
62.5 + 6.1
2
95.5 + 3.9
5.2
84.0 + 6.6
78.3 5.8
68.8 + 6.6
63.4 + 4.8
95.6 3.6
85.5.6.0
81.0
79.2 + 4.9
67.4 + 4.8
62.6 + 6.5
Table 14: Mean and standard deviation the inversion accuracy [%] with local dataset size of 32 in FedAvg training on the Lawschool Admissions dataset. The accuracy of the random baseline for 32 datapoints 57.8 + 2.3.
TabLeak
Cosine
n. batches
epoch
Spochs
epochs
epoch
Spochs
epochs
85.6
3.8
83.3 2.9
80.7 4.1
72.2
68.1
65.2 + 2.8
2
86.0 3.8
83.0 + 3.2
79.8 + 3.5
72.5 + 1.9
68.3 + 4.4
66.2 + 2.8
3.5
81.7 3.8
79.3 4.3
72.5 + 2.4
69.4 + 3.9
67.9 + 3.8
22

---

Under review as a conference paper at ICLR 2023
100
100
Reconstruct Accuracy (%6
Reconstruction Accuracy (%)
50
Cosine, discrete
50
Cosine, discrete
TabLeak, discrete
TabLeak, discrete
40
Cosine, continuous
40
Cosine, continuous
Tableak, continuous
TabLeak, continuous
30
30
8
16
64
128
8
16
64
128
Batchsize (log scale)
Batchsize (log scale)
(a) Adult
(b) German Credit
100
100
Reconstruction Accuracy [%%
90
Reconstruction Accuracy [%)
90
80
80
Cosine,
Cosine,
TabLeak, discrete
TabLeak, discrete
Cosine, continuous
Cosine, continuous
c
Tableak, continuous
TabLeak, continuous
30
30
1
8
16
32
64
128
1
8
16
32
64
128
Batchsize (log scale)
Batchsize (log scale)
(c) Lawschool Admissions
(d) Health Heritage
Figure 11: Mean reconstruction accuracy curves with corresponding standard deviations varying batch size, separately for the discrete and the continuous features on all four datasets.
Table 15: Mean and standard deviation of the inversion accuracy [%] with local dataset size of 32 in FedAvg training on the Health Heritage dataset. The accuracy of the random baseline for 32 datapoints 43.4 + 3.5.
TabLeak
Cosine
n. batches
epoch
epochs
10 epochs
epoch
5 epochs
10 epochs
68.5 5.0
62.2 + 3.5
57.4 3.0
53.8 + 5.5
41.4
111134
2
68. 1 4.9
62.4
+ 4.1
57.0 + 2.8
52.4 + 5.7
43.4
44.4 4.3
4
67.3 5.8
62.0 3.5
57.0 3.0
52.5
4.74
4..8
23

---

Under review as a conference paper at ICLR 2023
Table 16:
The mean accuracy [%] and entropies with the corresponding standard deviations over batch sizes of the categorical and the continuous features on the Adult dataset.
Discrete
Continuous
Accuracy
Entropy
Accuracy
Entropy
1
100.0 0.0
0.01 + 0.04
98.7 6.5
-3.1 + 0.26
2
0.01 + 0.06
9.2
-2.8 + 0.57
4
0.08 0.11
9
-1.89 + 0.99
8
5.6
0.13
14.7
-1.11 + 0.95
16
4.3
0.11
13.5
-0.11 0.63
32
91.0 4.4
0.06
6.9
0.77 0.30
64
3.6
0.48
5.01
1.21 0.19
128
78.5 1.8
0.53 0.03
2.0
1.48 0.10
Table 17:
The mean accuracy [%] and entropies with the corresponding standard deviations over batch sizes of the categorical and the continuous features on the German Credit dataset.
Discrete
Continuous
Accuracy
Entropy
Accuracy
Entropy
1
100.0 0.0
0.00 + 0.01
100.0
-3.10 + 0.18
2 100.0 0.0
0.03 0.05
100.0
-2.41 + 0.97
4
0.07 1.0
99.8
-1.66 1 0.80
8
0.10 0.0
99.1
-1.38 + 0.54
16
9.4
0.07
89.1
-0.55
32
2.1
0.04
6..0
0.60 0.13
64
1.8
2.2
1.08 + 0.06
128
1.1
0.59 + 0.02
58.4
1.30 + 0.05
D.4 FULL RESULTS ENTROPY ALL DATASETS
In Tab. 16 Tab. Tab, 18 and Tab. 19 we provide the mean and standard deviation of the reconstruction accuracy and the entropy the continuous and the categorical features over increasing batch size for attacking with Tableak on the four datasets. In support of Sec. 4 we can observe on all datasets a trend of increasing entropy over decreasing reconstruction accuracy as the batch size increased; and as such providing signal to the attacker about their overall reconstruction success.
To generalize our results on the local information contained the entropy, we show the mean reconstruction accuracy of both the discrete and the continuous features with respect to bucketing them based on their entropy in a batch of size 128 in Tab. 20 Tab. 21 Tab, 22 and Tab, 23 for all four datasets, respectively. We can see that with the help of this bucketing, the reconstructed features that have been retrieved with a (sometimes significantly e.g., up to 24%) higher accuracy than the overall batch.
identify subsets of
24

---

Under review as a conference paper at ICLR 2023
Table 18: The mean accuracy [%] and entropies with the corresponding standard deviations over batch sizes of the categorical and the continuous features on the Lawschool Admissions dataset.
Discrete
Continuous
Accuracy
Entropy
Accuracy
Entropy
1
1.0 0.0
0.01 + 0.03
1.0
-3.28 + 0.29
2 100.0
0.02 0.05
100.0
-2.85 + 0.87
4
0.0
1.030000
100.0
-2.45 + 0.78
8
9.1
0.10
96.4
-1.77 0.62
16
98.1
0.11
83.1
-0.65 0.49
32
3.0
0.41:0.00
6..1
0.18 0.20
64
2..
0.05
4.87
0.78 + 0.12
128
1.5
0.60 + 0.03
6.4
1.07 + 0.11
Table 19: The mean accuracy [%] and entropies with the corresponding standard deviations over batch sizes of the categorical and the continuous features on the Health Heritage dataset.
Discrete
Continuous
Accuracy
Entropy
Accuracy
Entropy
100.0 0.0
0.02 + 0.05
99.6 2.5
-2.97 + 0.33
2
100.0 0.0
0.05 + 0.09
96.5 12.9
-2.55 + 0.80
4
99.7
0.08 0.10
97.
-1.71 1 0.79
99.1
0.11
41.3
-1.06 0.64
16
9.56
0.10
81.2
-0.11
32
85.1 6.4
0.06
6..7
0.72 0.23
64
#.7
+.03
2.56
1.13 = 0.20
128
66.1 2.4
0.57 + 0.02
6.67
1410..1
Table 20: The mean accuracy [%] and the share of data [%] in each entropy bucket for batch size 128 on the Adult dataset.
Entropy
Categorical Features
Entropy
Continuous Features
Bucket
Accuracy [%]
Data [%]
Bucket
Accuracy [%]
Data [%]
0.0-0.2
95.7
8.1
co-0.72
72.7
1.2
0,2-0.4
90.5
23.4
0.72-1.16
65.5
13.6
0.4-0.6
79.8
27.7
1.16-1.6
56.4
50
0.6-0.8
69.8
29.2
1.6-2.04
51.1
32.4
0.8-1.0
61.2
11.6
2.04-00
41.8
2.9
Overall
78.5
100
Overall
55.7
100
Random
73.8
100
Random
44.4
100
25

---

Under review as a conference paper at ICLR 2023
Table 21: The mean accuracy [%] and the share of data [%] in each entropy bucket for batch size 128 on the German Credit dataset.
Entropy Bucket
Categorical Features
Entropy
Continuous Features
Accuracy [%]
Data [%]
Bucket
Accuracy [%]
Data [%]]
0.0-0.2
98.1
7.4
cc-0.72
55.7
1.2
0.2-0.4
92.5
15.3
0.72-1.16
62.3
28. 1
0,4-0.6
83.3
22.2
1.16-1.6
57.7
56.4
0.6-0.8
71.6
33.7
1.6-2.04
53.4
13.2
0.8-1.0
66.0
21.3
2.04-00
48.2
0.2
Overall
78.2
100
Overall
58.4
100
Random
73.5
100
Random
37.8
100
Table 22: mean accuracy [%] and the share of data [%] each entropy bucket for batch size 128 on the Lawschool Admissions dataset.
Entropy Bucket
Categorical Features
Entropy
Continuous Features
Accuracy [%]
Data [%]
Bucket
Accuracy [%]
Data [%]
0.0-0.2
95.5
3.4
oc-0.72
69.5
20.7
0.2-0.4
92.1
14.2
0.72-1.16
63.3
35.1
0.4-0.6
88.0
32.7
1.16-1.6
60.1
32.9
0.6-0.8
81.2
30.4
1.6-2.04
55.5
10.8
0.8-1.0
70.7
19.3
2.04-o0
54.1
0.5
Overall
83.5
100
Overall
62.6
100
Random
81.1
100
Random
19.1
100
Table 23: The mean accuracy [%] and the share of data [%] in each entropy bucket for batch size 128 on the Health Heritage dataset.
Entropy
Categorical Features
Entropy
Continuous Features
Bucket
Accuracy [%]
Data [%]
Bucket
Accuracy [%]
Data [%]
0.0-0.2
90.7
6.2
co-0.72
69.1
1.1
0,2-0.4
84.7
22.1
0.72-1.16
65.6
17.0
0,4-0.6
70.5
21.2
1.16-1.6
61.8
52.9
0.6-0.8
54.8
32.3
1.6-2.04
55,9
26.5
0.8-1.0
50.3
18.4
2.04-00
49.4
2.5
Overall
66.1
100
Overall
60.7
100
Random
69.8
100
Random
34.2
100
26

---

Under review as a conference paper at ICLR 2023
E STUDYING POOLING
In this subsection, we present three further experiments on justifying and understanding our choices in pooling:
Experiments synthetic datasets for understanding the motivation for pooling in App. E.1
Ablation study understanding the impact of the number of samples N the performance T'TaLL in App. E.2
Comparison of using mean and median pooling on TabLeak in App.
E.3
E.
VARIANCE STUDY
unique challenge (challenge (ii)) of tabular data leakage is that the mix of discrete and continuous features introduces further variance in the final reconstructions. As a solution to this challenge, we propose to produce N independent reconstructions of the same batch, and ensemble them using the pooling scheme described in Sec. 3.2 In this subsection, we provide empirical evidence for the subject of challenge (ii) and the effectiveness of our proposed solution to it.
Experimental Setup We create synthetic binary classification datasets, each with 10 features, however of varying modality. Concretely; we have the following setups:
Synthetic dataset with 0 discrete and 10 continuous columns,
Synthetic dataset with 2 discrete and continuous columns,
Synthetic dataset with 4 discrete and continuous columns,
Synthetic dataset with 6 discrete and continuous columns,
Synthetic dataset with 8 discrete and continuous columns,
Synthetic dataset with 10 discrete and continuous columns.
The continuous features are Gaussians with means between 0 and 5, and standard deviations between I and The discrete features have domain sizes between and 6, and the probabilities are drawn randomly. On each of these datasets we sample 50 batches of size 32 and reconstruct them using TabLeak (no pooling) starting from 30 different initializations in the same experimental setup elaborated in Sec. 4 and in App. B We then proceed to calculate the standard deviation of the accuracy for each of the 50 batches over their 30 independent reconstructions, providing us 50 statistically independent data points for understanding the variance in the non-pooled reconstruction problem. Further, from the 30 independent reconstructions of each batch, we build 6 independent mini-ensembles of size 5 and conduct median pooling on them (essentially, TabLeak with N 5). We then measure the standard deviation of the error for each of the 50 batches over the obtained pooled reconstructions, obtaining 50 independent data points for analyzing the variance of pooled reconstruction.
Results We present the results of the experiment in Fig. 12 additionally to measuring the same- batch reconstruction accuracy standard deviation for all features together, also present the resulting measurements when only considering the discrete and the continuous features, respectively. The figures are organized such that the x-axis begins with the synthetic dataset consisting only of continuous features and progresses to the right by decreasing the number of continuous and increasing the number of discrete features at each step by Roughly speaking, the very left column of the figures is similar to data leakage in the image domain, where all features are continuous, and the very right relates data leakage in the text domain, containing only discrete features. Looking at Fig. [2a we observe that the mean same-batch STD is indeed higher for datasets consisting of mixed types, providing empirical evidence underlining the second challenge of tabular data leakage. Further, it can be clearly seen that pooling, even with small ensemble of just 5 samples, decisively decreases the variance of the reconstruction problem, providing strong justification for using pooling in the tabular setting. Finally, from Fig. [2b and Fig, [12c we gain interesting insight in the underlying dynamics of the interplay between discrete and continuous features at reconstruction. Concretely, we observe that the presence of a given modality is decreasing and its place is taken up by the other, the recovery
27

---

Under review as a conference paper at ICLR 2023
3.5
TabLeak (no pooling)
Lab pooling) Leb (Nm5)
3.0
Tableak (N-5)
Accuracy STD 166
Accuracy STD [60
Accunscy STD [%)
2.0
8
1.0
Tobleak tho pooling!
0.0
TabLeak (N=5)
20.
DD. D.
2.D.
40.
10.
2.
6D.
Combined Accuracy STD
(b) Discrete Accuracy STD
(c) Continuous Accuracy STD
Figure 12: Mean same-batch reconstruction accuracy standard deviation and 90% confidence interval batch size 32 estimated from 50 independent batches over synthetic datasets with varying number of discrete (D.) and continuous (C.) features.
Table 24: Reconstruction accuracy [%] and standard deviation TabLeak on batch size 32 over the size of the ensemble N used for pooling.
5
10
20
30 83.4
Adult
71.8 + 4.6
75.1 +: 4.6
76.5 - 4.6
76.5 - 4.8
77.1 + 4.7
77.0
77. = 4.8
German
79.0 +: 3.0
81.6
82.6
0.6:220 2.9
82.9
2.9
83.2
288
83.6
2.7
Lawschool
82.3 = 4.0
847
84.7
2 3.9
85.1
3.9
8..3=40
85.3 -
Health Heritage
64.6 -
67.5 4.3
69.1 4.4
69.1
4.5
69.7
4.5
69.5
70.1 4.0
of this modality becomes increasingly noisier. Much line with the observations on the difference in the recovery success between discrete and continuous features, these results also argue for future work to pursue methods that decrease the disparity between the two different feature types in the mixed setting.
E.2 THE IMPACT THE NUMBER SAMPLES N
In Tab. 24 we present the results of an ablation study we conducted on Tableak at batch size 32 to understand the impact of the size of the ensemble N on the performance the attack. We observed that with increasing N the performance of the attack gets steadily better, albeit, producing diminishing returns, showing signs of saturation on some datasets after N = 25. Note that this behavior is expected, and suggests using the largest N that is not yet computationally prohibitive. We chose N 30 for all our experiments with Tableak (unless explicitly stated otherwise); this allowed us to conduct large-scale experiments while still extracting good performance from TabLeak.
E.3 CHOICE OF POOLING FUNCTION
We compare TabLeak using median pooling to TabLeak with mean pooling in Tab. 25 over the four datasets. we can observe, most cases both methods produce similar results, hence effectiveness of Tableak is not to be attributed solely to the chosen pooling method. However, as median pooling demonstrates to provide a slight edge in some cases, we opt for using median pooling in our main experiments with TabLeak.
28

---

Under review as a conference paper at ICLR 2023
batch size
TabLeak (median)
TabLeak
batch size
TabLeak (median)
TabLeak
(mean)
(mean)
99.4 + 2.8
99.4 2.8
100.0 0.0
100.0
99.2 + 5.5
99.3 + 5.0
2
100.0 + 0.0
100.0 + 0.0
98.0 = 4.5
5.3
99.9 + 0.4
99.9 0.4
95.1 9.2
94.
8
99.7
99.6 1.1
89.4 + 7.6
8.7
16
95.9
95.6 =
32
77.6 4.8
77.1
32
83.6
83.1 3.0
64
71.2 + 2.8
71.7 + 2.8
64
73.0 + 1.3
72.6 + 1.3
128
68.8 + 1.3
69.4 + 1.4
128
71.3 + 0.8
70.8 + 0.9
(a) Adult
(b) German Credit
batch size
TabLeak
TabLeak (mean)
batch size
TabLeak (median)
TabLeak (mean)
(median)
100.0 + 0.0
100.0 + 0.0
99.8 + 1.6
99.8 + 1.6
2
100.0
0.0
100.0
97.7 + 8.3
97.4 + 9.0
4
100.0 0.0
100.0 + 0.0
4
98.2 + 6.5
98.0 + 6.7
3.8
98.
96.0 + 8.2
9.6
16
5.6
94.6 5.4
16
86.1 + 8.8
9.3
32
84.
84.7 3.9
70.0 + 4.5
69.7
64
2.0
78.2 + 2.2
64
64.7
64.8
128
77.3
77.5 + 1.2
128
63.0 + 1.4
63.6 + 1.5
(c) Lawschool Admissions
(d) Health Heritage
Table 25: Mean and standard deviation of the inversion accuracy [%] using TabLeak with either median or mean pooling, assuming full knowledge of the true labels.
29


Reviews:
[{"review_id": "koWJoRcGCA", "reviewer": "Reviewer_oUHx", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper considers the data leakage attack in federated learning and focuses on the tabular data. A new method called TabLeak is proposed, which consists of three ingradients: (Section 3.1) softmax structural prios; (Section 3.2) pooled ensembling; and (Section 3.3) entropy-based uncertainty estimation. The combined attack is given in Section 3.4. Numerical experiments is presented in Section 4 and conclusions are drawn in Section 5.", "summary_of_the_review": "Please see my comments above. Although this paper may contain some intellectual merit, the poor presentation makes it hard for readers to appreciate it. ", "strength_and_weaknesses": "Strength:\nThis paper considers a very interesting topic. \n\nWeakness: \n\nFirst, the solutions to tackle the challenge brought by tabular data are quite standard. \n\nSecond, this paper is not well written. Certain sentences are very obscure and it is hard to understand what the authors are trying to say. \nAlso, the grammars are not correct in certain sentences. One example is the sentence following Equation (2).\nMoreover, in this paragraph, the tense should be consistent. The present tense is used in the beginning of the paragraph, however is switched to past tense for unknown reasons. Although this might be correct in grammar, it is very annoying to the readers. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "5rzp6h0mQG", "reviewer": "Reviewer_Gtmh", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper investigates the problem of data reconstruction from gradients in federated learning in the case of tabular data. Two main issues arise with this modality: some features are categorical, and it is much harder for a naïve human to guess whether the samples are correctly reconstructed.\n\nBuilding on the previous work of Geiping (for images), the paper introduces a softmax parametrization and the resulting method optimizes on the resulting latent variables. Further, by using multiple independent reconstruction and subsequent pooling, reconstruction results are improved. The authors propose to leverage these independent reconstructions to measure the entropy of reconstructed features as a proxy for quality of reconstruction.\n\nMany experiments on 4 tabular datasets (1 in main body, the remaining three in appendix) investigate in detail the proposed method. The authors first perform an ablation study to show the effect of each proposed improvement (softmax and pooling) in the case of FedSGD, for varying batch size, demonstrating a significant improvement over the baseline. The authors observe that discrete features are easier to retrieve than continuous ones. For FedAvg-style updates, experiments also demonstrate an improvement over baseline. The authors show empirically that the heuristic based on entropy is associated with a larger retrieval success for categorical variables.", "summary_of_the_review": "The authors propose a novel approach to make gradient attacks work successfully on tabular data. The thorough experiments are enough to convince me of the viability of the approach. However, I have small concerns regarding the claims on the specificity of the problems tackled for tabular data. If the authors address them, I will raise my score accordingly.", "strength_and_weaknesses": "# Main strengths\n\n- Simple method, easy to plug over existing approaches (Geiping et al.)\n- Proposes a working entropy-based heuristic to assess the quality of reconstruction\n- Compelling experimental demonstration for the effectiveness of the proposed method. I have several comments to improve it further, but I already find it very convincing\n\n# Main weaknesses\n\n- Some claims regarding the specificity of problem are a bit strong (see novelty below).\n  - The related works on NLP are not completely fairly represented (see below);\n  - The authors list as a challenge specific to tabular data that \"the mix of categorical and continuous features causes high variance in the final reconstructions\", but there is no empirical proof of it. However, there is no denying it brings improvements, and it also enables the entropy heuristic; it is mostly a wording issue. (see detailed comments)\n- The justification and study of pooling could be improved (see below)", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "0_MqRseeE4", "reviewer": "Reviewer_x5xg", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "While reconstructing data in FL from gradients leads to a continuous optimization problem, tabular data with categorical variables yields a mixed integer programming optimization problem. The authors propose a softmax based continuous relaxation and an ensemble strategy that makes the underlying solution algorithm more robust. They show 10% improvement over baselines. ", "summary_of_the_review": "Both technical contributions are weak. In terms of softmax, there are more sophisticated and often efficient relaxations of discrete random variables (for example, the Gumble trick). \nIt is also possible to tackle directly the mixed integer formulation. There is a slew of algorithms in the optimization community (for example, branch-and-bound, GA) that are applicable in this case (many of them don't require convexity and can handle general optimization problems). \nRobustness can also be improved by not simply taking ensemble. There is work in distributed computing on how to effectively explore parallelization. \n", "strength_and_weaknesses": "Strengths: \nThe identification of the unique aspect of data reconstruction in the tabular setting\n\nWeaknesses:\nThe underlying new ideas are not innovative. Softmax relaxations are well known and ensemble techniques are also ubiquitous. \nThe benchmark models are fairly weak (random selection and a technique transferred from the continuous case)\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject