Protection against Source Inference Attacks in Federated Learning
Authors: Andreas Athanasiou
Kangsoo Jung
Catuscia Palamidessi
Venue: ICLR 2026 Poster (2026)
Keywords: Federated Learning
Source Inference Attack
Shuffle Model
Residue Number System
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: The paper discusses a defense against Source Inference Attacks using the shuffle model of Federated Learning. It proposes RNS-based parameter-level shuffling that preserves accuracy and reduces attack success to random guessing.

Abstract: Federated Learning (FL) was initially proposed as a privacy-preserving machine learning paradigm. However, FL has been shown to be susceptible to a series of privacy attacks. Recently, there has been concern about the Source Inference Attack (SIA), where an honest-but-curious central server attempts to identify exactly which client owns a given data point which was used in the training phase. Alarmingly, standard gradient obfuscation techniques with Differential Privacy have been shown to be ineffective against SIAs, at least without severely diminishing the accuracy.

In this work, we propose a defense against SIAs within the widely studied shuffle model of FL, where an honest shuffler acts as an intermediary between the clients and the server. First, we demonstrate that standard naive shuffling alone is insufficient to prevent SIAs. To effectively defend against SIAs, shuffling needs to be applied at a more granular level; we propose a novel combination of parameter-level shuffling with the residue number system (RNS). Our approach provides robust protection against SIAs without affecting the accuracy of the joint model and can be seamlessly integrated into other privacy protection mechanisms.

We conduct experiments on a series of models and datasets, confirming that standard shuffling approaches fail to prevent SIAs and that, in contrast, our proposed method reduces the attack’s accuracy to the level of random guessing.

Published as a conference paper at ICLR 2026
PROTECTION AGAINST SOURCE INFERENCE ATTACKS IN FEDERATED LEARNING
Andreas Athanasiou
Kangsoo Jung"
TU Delft & Inria Delft, Netherlands & Palaiseau, France
Inria
Palaiseau, France
a. a.athannsiouue
ft.nl
kangsoo. jungg 48ma i com
Catuscia Palamidessi
Inria IPP
Palaiseau, France
catuscia@lix.per htw.rri@@l....olyyeeeniiieeeee
ABSTRACT
Federated learning (FL) was initially proposed as privacy-preserving machine learning paradigm. However, FL has been shown to be susceptible series of privacy attacks. Recently, there has been concern about the source inference attack (SIA), where honest-but-curious central server attempts to identify exactly which client owns given data point which was used in the training phase. Alarmingly, standard gradient obfuscation techniques with differential privacy have been shown to be ineffective against SIAS, at least without severely diminishing the accuracy. In this work, we propose defense against SIAs within the widely studied shuffle model of FI., where an honest shuffler acts as an intermediary between the clients and the server. First, demonstrate that standard naive shuffling alone is insuf- ficient to prevent SIAs. To effectively defend against SIAs, shuffling needs to be applied at more granular level; we propose novel combination of parameter-level shuffling with the residue number system (RNS). Our approach provides robust protection against SIAs without affecting the accuracy of the joint model and be seamlessly integrated into other privacy protection mechanisms.
We conduct experiments on series of models and datasets, confirming that stan- dard shuffling approaches fail to prevent SIAs and that, in contrast, our proposed method reduces the attack's 's accuracy to the level of random guessing.
INTRODUCTION
Federated learning (FL) McMahan & Moore (017)) is a machine learning framework that trains a global model across multiple clients without centralizing data. Each client updates the model using its local dataset and sends the updates to central server, which aggregates them to obtain the global model W. The most well-known aggregation function is FedAvg, where W + E N; clients, where each client has N; data points and N Σ, N,e initial concept of FL was that was private by design, as the data each client was not shared with anyone. Unfortunately. an honest-but-curious central server can launch series of privacy attacks, as it observes the clients' reported model updates and can use them to infer information. For instance, the server can launch a membership inference atlack (MIA) Shokri al. (2017): Carlini al. (2022) ; CChoquette- Cheno et al. (2021) which aims to determine if a particular data point exists in the training dataset of any client.
wy for n
N
The source inference attack (SIA) Hu al. (202] 2024) has recently been proposed extension of the MIA. In an SIA, the ad adversary (an exactly which client owns a given data point. To achieve this, the attacker compares the accuracy of the target data point across the received models before they are aggregated into the global model. This can pose a severe violation privacy; consider for example a medical model jointly built by
natural central server) tries to determine
Primary authors with equal contribution.

---

Published as a conference paper at ICLR 2026
different hospitals to treat some disease and suppose that a hospital A is specialized in cancer cases. If the central server learns from a successful SIA that a patient's s data was used by Hospital A, then they can confidently assume that the patient suffers from cancer.
Defending against SIAs While MIAs exploit model overfitting, SIAs work by exploiting dif-
ferences in model predictions across clients due to their heterogeneous data distributions. Model obfuscation techniques such as differential privacy (DP) Dwork et al.] (2006); Abadi et al.] ( have been shown to be inadequate to protect against SIAs, at least without severely deteriorating the accuracy of the joint model Hu al. 2021 2024). That is because the level of noise is required to be large to successfully make the different local models indistinguishable from each other.
Another approach is to consider iigularization-baseee defenses, which can be beneficial against MIAS since they reduce overfitting Kaya et al. (2020). However, such defenses are insufficient for SIAS as they do not focus on reducing the distributional differences between clients Hu al. (2024). To
verify, we include an empirical evaluation on all common regularization based defenses (Appendix F) Our results show that regularization based defenses have virtually no impact against SIAs.
Defenses against Data Reconstruction Attacks (DRAs) (e.g. Instahide Huang et al. (2020), FedAdOb Gu al. (2024) are also ineffective as they focus on preventing gradient inversion. In contrast, SIAs assume that the attacker already knows that a given data point was used in training. We empirically
verify that such defenses have no effect in Appendix [F] Finally, (Hu et al. (2024) investigated whether
knowledge distillation techniques (e.g. FedMD) can be a means of defense. FedMD was only able to slightly decrease the SIA success rate; the attack remains well above random guessing.
In this work, we focus on the shuffle model, which assumes the presence of a trusted shuffler. This approach, which provides additional privacy protection by permuting clients' data, has been widely studied in FL. Interestingly, although standard naive shuffling removes the connection between the data owner and their value, this is not enough to protect against SIAs. To show this, we propose series of attacks aimed at defeating the effect of shuffling by remapping the values back to their original owners (Section 5).
Therefore, new defense strategy against SIAs is necessary. We aim satisfy these specifications:
S.1: Protection: The accuracy of SIAs is reduced to the level of random guessing, even in the challenging scenario where clients hold datasets with a high level of dissimilarity.
S.2: Integrability: The solution can be seamlessly integrated as a "module" into existing shuffle-model FL architectures, and is compatible with other privacy mechanisms, such as DP, which protect from other kinds of privacy attacks.
S.3: Communication efficiency: Considering that SIAs are better suited for the cross-silo setting of FL (ef. Section 4 an increase in the communication cost can be tolerated, as long as it remains reasonable.
S.4: Maintains model accuracy: DP does not protect against SIAs unless we pay a high
price in accuracy. Hence, typical approaches based on DP-SGD would not be optimal.
S.5: Minimal trust assumptions: Each client does not have to trust any additional entity.
Contributions
Our contributions are summarized as follows:
We propose novel reconstruction attacks that defeat standard shuffling in FL by remapping the shuffled values back their original owners. We examine three shuffling methods; model-level, layer-level and parameter-leves and provide corresponding reconstruction algorithm for each. These attacks enable SIAS within the standard shuffle model of FL., making shuffling alone insufficient (Section 5)
We propose the first robust defense against SIAs in the shuffle model of FL. We introduce novel dimension-based granular shuffling method, using the residue number system (RNS). The defense reduces attack accuracy to random guessing without affecting joint model accuracy and can be seamlessly integrated into existing shuffle mechanisms (Section
We conduct experiments on the MNIST and CIFAR-10 with CNN and CIFAR- 100 with ResNet-18 which validate our analyses (Section 7.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
FL remains vuinerable to various attacks despite the fact that raw data are not disclosed Zhu et al.
(2019a); Geiping el al. (2020); Hu et al. (202T 2024). In al. (202T 2024) the authors introduced the concept of SIAs and empirically showed, by performing experiments across variety of datasets, that model overfitting and data distribution (increased heterogeneity) are the most important factors
for making model susceptible to SIAs.
Shuffling has been widely explored in the literature as a means to protect privacy. shuffler can be implemented distributively using trusted hardware Bittau et al. (2017); (Sasy et al. (2022). multi-party computation Lu et al. ( Abraham et al. (2020); Lu & Kate (2022). MixNets Dingledine et al. (2004); Chen et al. (2015); Langowski et al. (2023); Hohenberger et al. (014): Sampigethaya & Poovendran (2007). which can also be verifiable K won et al. (2013 2017) and DC networks Corrigan- Gibbs & Ford (2010); Corrigan Gibbs et al. (2015). In other words, the shuffler does not necessarily need to be single separate server; its functionality could be performed distributively for instance even by the clients themselves (ef. Section 4 This appealing trust assumption of the shuffle model
has led to its adaptation from tech giants, such as Google Bittau et al. (2017) and Brave Minto et al. (202I)
In DP, the shuffle model was first introduced by Bittau et al. (2017) and later formalized in Cheu et al. (2019). This model has been applied in FL in variety of ways amplify the privacy by adding an additional layer of anonymity (Snn et al. (2020); Xu et al. (2024); Girgis et al. (2021): Yang et al. (2023); Liu et al. (202T): Huang et al. (2023): Lebrun et al. (2022). Each user perturbs their model updates, then sends them to the shuffler which randomly permutates them before releasing them to the central server.
As far as we are aware of, no defense for SIAs has been studied in the literature, which is the motivation for this work. We have previously presented preliminary shuffle-based approach to defending against SIAs in poster/Athanasin SIAs but was practically unfeasible due to its high communication cost.
et al. (2024), which partially reduced the accuracy of
3 PRELIMINARIES
The adversary (central server) knows that training record = (2r, y) (where is input vector and y is class label) is present in the training dataset. The source status of each record can be represented by an n-th dimensional multinomial vector s (where client i owns the j-th record) and the others are set to O. For the j-th record 2j. the source inference attack can be defined follows:
Source inference attacks (SIAs) Hu et al. 2021: 2024
the number of clients). Only one element of st,j equal to (indicating that
Definition 1 (Source inference attack). Hu et al. 2022] 2024) Given local optimized model ws and a training record 2j, source inference aims to infer the posterior probability of zj belonging to the client i:
S(w;, 2z) P(si.j
wi, 2z)
Encoding Schemes In this work, we combine shuffling with the following encoding schemes:
Definition 2 (Unary encoding). If x, E N. I k then x is encoded as: U(x, k)) = [1}" u (0)*
Moreover, we employ the residue number system (RNS) Gamer (1959):
Definition 3 (RNS encoding). If m1, m.,..., my are pairwise coprime, then x E I is encoded as {21, J. where I; = I mod m,
Given the residues 31, T2,... Tu. one can reconstruct x using the Chinese remainder theorem (we show example in Appendix C.I). Also, Definition 3 can be extended for x: E Z. If < 0, the encoding is first performed for x.] getting the resulting residues 3 X2, ... Then, x is encoded as (mi 11, m2 222- ... my x., Furthermore, the addition of two RNS encoded numbers can be performed directly in the RNS domain by summing their residues. Finally, the range of the RNS
encoding is defined by the choice of the moduli:
Proposition 3.1.
M M ]] J] can be losslessly encoded in the RNS, where M II, m,
3

---

Published as a conference paper at ICLR 2026
4 SETTING, ASSUMPTIONS & THREAT MODEL
In this section we clarify the setting on which we will focus and define the attacker.
Cross-Silo setting SIAs were proposed for the so-called cross-silo setting of FL, where the number of clients is limited (typically 2-100 clients Kairouz et al. (2019) but each has superior commu- nication/computation capabilities. For instance, it can be hospitals cooperating
produce a joint model for some disease. This model is widely applied in real-world scenarios, ranging from medical
data Heyndrickk et al. (2024); Google Cloud (2023); Mateus et al. (2024); : TNO (2025) : Darzi et al.) (2024); Dayan et al. (2021) to the agricultural domain Durrant et al. (2022); Dembani et al. (2025). The opposite setting, known as cross-device, involves larger number of clients, each with limited communication and computational capabilities (e.g. smart watches and health- monitoring model).
Studying SIAs for the cross-silo setting is more natural, as the attack relies on the fact that each client has a specific attribute linked to its data points. In other words, sensitive attribute that the adversary infers upon identifying which client trained given data point. For example, hospital is typically associated with the medical conditions it specializes in, making it likely that its patients suffer from a respective disease. Therefore, in this work, we focus on the cross-silo setting, in line with previous research on SIAs Hu et al.
2021 2024).
In previous works Hu et al. as we do as well. We also assume that model parameters are clipped in (-1.1); this can be achieved by clipping and properly scaling them. Finally, we focus on the FedAvg aggregation function, but our approach can be generalized to any sum-based aggregation function (cf. Section X)
2021 2024). SIAs focused on supervised learning for classification tasks,
Shuffle Model
We assume a shuffle model architecture (e.g. a mechanism from Lebrun et al. 2022); ;
Sun al. (2020); Xu et al. (2024); Girgis et al. (2021): Yang et al. (2023); Liu al. (2021 y Huang
et al. (2023) and our goal is to propose a defense mechanism which requires minimal modifications. natural question arises: why trusting shuffler more appealing than trusting the central server? Shuffling is a primitive operation that can be performed distributively. Thus, the trust assumption can be distributed across different entities, whereas model aggregation (e.g. FedAvg) cannot (at least without heavy computational cost; we compare with Secure Aggregation in Section 6.2)
To highlight this, we give an example implementation with MixNets (Alg. [8. Our implementation can be adjusted to three levels of trust assumptions on the shuffler: Fully Trusted (allowed to receive plain-text secrets), Semi-Honest (follows the protocol but should not able to see plain-tex, secrets) and Partially Malicious (all but one shuffle entities can deviate from the protocol arbitrarily; for example all but one servers of the MixNets may decide not to shuffle). For the Partially Malicious setting, Alg. [ uses Onion Encryption Dingledine et al. (2004) (preventing the MixNet's 's servers from seeing the messages) and Zero- Kono-Knowleee ledge Proofs (ZKPs) Ps) (preventing the servers from modifying the setting, ZKPs can be omitted since we assume that no server attempts
messages). In the to alter the data. In the Fully Trusted setting, neither Onion Encryption nor ZKPs are necessary.
In other words, Algorithm 8 requires that only one server of the MixNet be (semi or fully) trusted; all the others can be malicious. If we require each FL client to run their own server in the MixNet (a reasonable design choice given their resources in the cross-silo setting), then each client only has to trust themselves and no other entity, which satisfies our design specification S.5.
Attacker We consider an honest-but-curious central server as an adversary who sees the output of a trusted shuffler (or at least partially trusted with MixNets, i.e. at least one server in the MixNet is assumed to be trusted). We assume that the shuffler does not collude with the adversary (e.g. using the aforementioned Algorithm M). The attacker knows that particular data point z was used in the training phase (e.g. from a MIA) and their goal is to find, using an SIA, the client who owns it.
If no other information is known to the adversary then the standard shuffle model is sufficient to protect against SIAs since shuffling breaks the link between the data owner and their value. However, assuming that the adversary does not know anything more about the target client is arguably a strong assumption. In this work, we consider that the attacker knows a small shadow dataset only of the target client. A shadow dataset S₂ of target user x: is dataset disjoint from the one that actually uses for training, which follows (approximately) the same distribution. For instance, using once more the hospital example, if the attacker is a pharmaceutical company it might already know that some of
4

---

Published as a conference paper at ICLR 2026
its patients were treated by the target hospital. Note that similar assumption is often made in other
privacy attacks like the MIA Shokri et al. (2017);[Cam) [arllii et al. (2022); Choquette- Choo et al. (2021). We clarify that this shadow dataset will only be used to reverse the shuffling (Section[5); SIAs do not rely on the shadow dataset at all (Definition) T.
5 RECONSTRUCTION ATTACKS AGAINST SHUFFLING
In this section we show how an attacker can remap shuffled model back to its original owner by using their shadow dataset Sz. The attacker here the central server; this section we assume no collision with the shuffler who is fully trusted. We begin with model-level shuffling, the standard approach used the shuffle model of FL. Then, as illustrated in F we expand the granularity to include layer-level and parameter-leve shuffling, showing that in all three cases reconstruction attacks are possible. The algorithms discussed in the following subsections are placed in the Appendix B
5.1 MODEL-LEVEL SHUFFLING
The current widely-used approach in shuffle-based FL shuffling at the level of model updates. In other words, the shuffler receives the model from each user i, chooses a random permutation и and outputs (1)()) (n)) However, the adversary can defeat the shuffler by remapping the model back to the target client I, by comparing the accuracy of each model on the shadow dataset Sz (Algorithm 2). The model with the highest accuracy on Sy will, most probably, belong to client r. Observe that this attack is feasible for the ad adversary; if n is the number of clients and ||S is the size of the shadow dataset, then Algorithm has (n || complexity (as the adversary needs to find the accuracy on each of the samples of S₂ each of the clients).
5.2 LAYER-LEVEL SHUFFLING
Since standard (model-level) shuffling can be reversed, let us explore shuffling per layer of the neural network Lebrun et al. (2022). J. For instance, if we consider simple CNN with a convolutional layer C and FC layers FC1, FC2, the shuffler releases: {C=m(I)...... Cro(m)) FCI,1()).... FC1, x (n). FC2 ... FC22z(n) }. In other words, for each FC and convolutional layer, the shuffler finds new random permutation π. This does not affect the accuracy of the joint model because in FedAvg the order of the received layers is inconsequential. Observe now that the ad has to run Algorithm 2 on every possible combination of layers. Depending however on the model, the number of combinations can be significant, which might make this approach non-feasible. To counter this, we propose a strategy which focuses only on the final layer of the neural network (Algorithm (3) Assuming w.l.o.g. that this is FC layer, say FCI, the adversary focuses on correctly remapping each FC2 back to its original owner: For the remaining layers, the adversary computes their average (using FedAvg). This reduces the complexity again back O(n ||S² [I). for n clients. The intuition behind this approach is that the final layer of model tends to contribute more to overfitting, As result, it more strongly reflects the distributional differences of the inputs. This is precisely what SIAS exploit, enabling the adversary to focus on the final layer, which provides the greatest advantage.
5.3 PARAMETER-LEVER SHUFFLING
Next, let us consider shuffling per dimension, i.c. for each parameter of each layer the shuffler releases Pr(1)..... Pr(n). an approach not yet explored in FL, as far as we are aware. Each random permutation I has to be resampled for each parameter p as otherwise the adversary could target the most easily distinguishable parameter (in case there are such outliers) to retrieve the permutation This approach does not affect the accuracy of the joint model; the central server can compute the aggregated model unimpeded. This creates an obvious obstacle to the adversary: finding the best accuracy of each possible combination of parameters requires superior computational capabilities. To overcome the hurdle, we follow a similar approach to Algorithm 3] That is, we once again focus only reconstructing the final layer of the neural network (say F FC, with & parameters), taking the average of the other ones. However, now we first compute the average of FC, and change each
We assume clients send all parameters at once, with the shuffler applying distinct permutations using sufficient metadata. Alternatively, parameters he sent individually, which increases communication rounds.
5

---

Published as a conference paper at ICLR 2026
of its parameters p one by For each one, select keep the out of the choices (one from each client) that creates a model with the best accuracy on Sz. To summarize, we copy the global model; each time we change only one of its parameters from the final layer, examining the possible choices and storing the one with the highest accuracy (Algorithm 5), which has a complexity of O(k ||S,]])-
PROTECTION AGAINST SOURCE INFERENCE ATTACKS
6.1 PARAMETER-LEVEE SHUFFLING WITH ENCODING
While parameter-level shuffling presents the greatest challenge for an attacker to reconstruct, the attack still remains feasible especially for heterogeneous datasets, Section this section, we argue that to effectively defend against SIAs, parameter-level shuffling should be combined with encoding, which further enhances the granularity of shuffling.
show experimentally in
To achieve robust protection, we increase the shuffling granularity to bits. We show that this ensures that only the aggregated result of each parameter is leaked to the central server (which is necessary to compute the joint model) and not any information about the individual models. First, we compress the values using the residue number system (RNS) and then encode them into bits, using unary encoding (Definition 2). An outline of the proposed method is presented below; described in detail in Algorithm with an example shown in Figure 4
Recall from Section 3 that RNS encodes an integer a by performing modulo operation with several pairwise coprime integers (called moduli). Since RNS designed for integers we consider scaling factor 10", known to both the clients and the server, where the precision corresponds to the number of digits of the fractional part that will be transmitted. Thus, every parameter p E (-1, 1) becomes [p- 10") and is then encoded using RNS, Each residue is then unary encoded and submitted in separate shuffling round. The server can find the sum of each residue and, using the Chinese remainder theorem, reconstruct the sum of each parameter (which would need to be descaled by 10").
Algorithm 1: P Parameter--eeee shuffling with RNS
Input: n clients, precision function RNS.en(.) for RNS encoding and RNN for decoding, a function (xx, k) for unary encoding x in l bits
Output: Wglob. the joint model
Let M {m,, m............................. m. ) be pairwise coprime integers where IIEM m < <n(10' Client-side (each client with model w:):
// Encode each parameter in RNS
for each parameter p in Wt do R.N.ene(Pp 10" I.
(P1.P2....Pul
for each residue p; in (P1, P2.... pu] do
L Send (p:, m,) the shuffler.
Shuffler:
for each parameter p do Concatenate all the received bit vectors to a vector Bp for each residue j.
Shuffle (bit-wise) each Bp.j and send it to the central server.
Server-side:
Receive the permutated bit vectors B3 for each parameter for each i-th parameter of Wgtob do
Sum and decode the residues to get the average of each parameter y C p.ur B. BB,.RRS
Wgttb []] + (RNS M, M)/10')/n
Return Wglob
Floaating-pontt RNS RNSinh Lu 1991 is unsuitable cannot the values by their shuffled residues.

---

Published as a conference paper at ICLR 2026
Meeting the required specifications Our main insight is that revealing shuffled bit vector is privacy-wise equivalent to revealing its sum (Proposition A.2)) We show that Algorithm Coporithm[rrllaaaeet Treleases only the aggregated model, without revealing any information about the individual local models. Since SIAs work by evaluating the accuracy of the given data point on the individual local models, this reduces their application random guess, there are distinct models to compare.
Formally, we show that Algorithm
satisfies design specification S.1 (Protection), in Theorem [
Theorem 1. Algorithm 7 reduces the accuracy of SIAs to the level of random guessing.
The proof can be found in Appendix
A Theorem I hholds even when an adversary attempts to correlate information across epochs improve their SIA success rate, since the proof shows that the only information leaked in each round is the sum of the models (which is useless for SIAs). Since no information about the individual models is revealed, inter-round correlation offers no advantage.
Then, S.2 (Integrabilityy is also respected since only encoding/decoding operations need to be added. Regarding the communication cost (S.3), assuming n clients, the moduli my, m2, ..... My should be picked such that n V < [M-1) (Proposition 3.1 where M = II; my and v = 10" - (i.e. the largest integer with digits). Therefore, assuming u moduli with m., being the largest, the cost is O(u m.). The number of shuffling rounds can be kept reasonably small, as it will be equal to the number of moduli (Figure IT]. In general, small values are usually used for the residues (m42), hence each user has to send a small number of m, bits in each round, keeping the communication cost reasonable, as we show in Section 7 Furthermore, S.4 (Accuracy) preserved with sufficient r since RNS encoding is lossless (C.. Finally, our proposed solution does not require additional trust assumptions than the ones of the shuffle model. Our proposed defense is fully compatible with the example implementation of shuffling with MixNets (Alg. 8). where each user only has to trust themselves, satisfying S.5.
In summary, the combination of RNS, unary encoding and parameter-level shufilingg enables strong privacy without sacrificing much efficiency. We use Proposition A.2 to introduce a novel approach to privacy amplification without adding any noise. By combining it with RNS, we can minimize the bit vectors and reduce communication cost. With this approach, we provide a novel noise-free yet optimal privacy protection, along with compression to limit efficiency loss. Alg. i compatible for all three defined trust assumptions on the shuffler (Fully Trusted, Semi-Honest, Partially Malicious). For Fully Trusted and Partially Malicious we can optimize Algorithm more, we discuss below. Morcover, Algorithm is fully compatible with DP-SGD as encoding and shuffling can be considered post-processing operations of model obfuscation. We further explore the synergy in Appendix F.8
Fully Trusted Shuffler Algorithm T does not rely on the shuffler to perform any communication optimizations. This allows for encrypted communication (e.g. Onion Encryption in Algorithm 8). preventing the shuffler from seeing the actual secrets. However, the typical assumption in the literature of the shuffle model is that the shuffler is fully trusted Girgis et al. (021). In that case, encryption is not necessary and the communication can be further optimized by coupling Algorithm|] [ with compression techniques such as Run- Run-Length Encoding (RLE); we describe the corresponding algorithm in Appendix B.2 which we further evaluate in Section
Proofs (ZKPs) to ensure that no MixNet server alters the data (as Algorithm B}. Since ZKPs are costly, requiring one for every model parameter would lead to severe computational overhead. Instead, a more practical approach is to select subset of parameters to pair with ZKPs, effectively serving as "traps" for misbehaving servers. If a MixNet server tampers with the data of any such parameter, the corresponding ZKP will fail, flagging the server as malicious for further action (c.g. removal from the MixNet). These parameters may be selected at random, though one could improve by choosing parameters known to localize memorization more strongly Maini et al. 20233
Partially Malicious Shuffler Algorithm can be coupled with
6.2 COMPARISON WITH SECURE AGGREGATION
One can view our approach essentially turning the shuffler into secure aggregator from the adversary's point of view by properly combining shuffling with encoding. A natural question thus arises about how our method compares with Secure Aggregation Bonawiizz et al. (0177).
7

---

Published as a conference paper at ICLR 2026
Applying threshold secret-sharing requires t out of n clients to reconstruct secret, in order to minimize the cost and the risk of dropouts, where << n (e.g. t = 0.5 n + Bonawitz et al. (2017)). Therefore, the protocol is private to any t - malicious coalitions of clients. On the contrary, shuffling with MixNets requires only out of n servers to be trusted (e.g. Algorithm (). Thus, the two models need to be compared under common denominator, which is common trust assumption. This can be achieved by implementing SA with standard threshold secret-sharing with n 1, aligning with the trust assumption of the shuffle model (and our design specification S.S.). Each user must send C' bits to every other user, where C' is the size of each share, increasing the communication cost to C' (n 1). Now the liveness constraints become significant problem since, even if one client drops out the secret cannot be recovered. In contrast, MixNets can still shuffle and release the
output even if all but one server drops out. In conclusion, SA incurs a stronger trust assumption and
liveness constraints; we compare nevertheless our approach with this setting in Section] 7
EVALUATION
This section presents the primary experiments; additional evaluation can be found in Appendix F
Setting For the SIAs we use the same code as Hu et al. 2021 2024) in order to provide comparable results, which also includes the structures the neural networks. We use CNN for MNIST and CIFAR-10 10 and a ResNet-18 for CIFAR-100 (cf. Appendix D). The success rate of the attack is defined as the percentage of the correct guesses on the given data points. Training is performed across 20 rounds for MNIST and across 100 rounds for CIFAR- 10 and CIFAR-100 but only the best SIA accuracy is reported. The number of local epochs is set to 10. As an upper baseline for the experiments lower baseline the random guess (uniform over the clients). We split the dataset among the clients using the Dirichlet distribution with a parameter a (level of heterogeneity). Finally, we assume that the adversary has shadow dataset of 5% the size of the target client's s actual training dataset. We also repeat the experiments for the 0.5% and 1% dataset sizes and evaluate the case where the adversary has access to a noisy shadow dataset. Both variations lead to similar conclusions and are therefore in Appendix [.2 Since the communication cost of Algorithm I depends on the sum of the RNS po-primes, we select the smallest possible pairwise co-pri co-primes that satisfy the constrain
the accuracy of the SIA when no shuffling is used (vanilla FL) and
(M 1) where 10" 1 and n is the number of clients (as explained in Section
7.1 PROTECTION AGAINST SIAS
In this experiment, test the SIA accuracy the proposed Algorithm and also on the Algorithms 2 and [5) that remap the shuffled models back to their original owners from Section 5 Figure [ shows the results relative to the level of heterogeneity (n)). We note that the results below do not depend on the shuffler's trust assumption, since in all cases we assume that the shuffler leaks no information (either through the use of Onion Encryption or by fully trusting the shuffler).
Model-level shuffling is the least effective choice; Algorithm 2 can reliably reverse shuffling, particu- larly when small. Notably, SIAs demonstrate high success rate on CIFAR-100 with ResNet-18,
511 mosees rato (55)
SLD misesss (95)
5LA
05
33
20
Al
At
[Inee Cheaaopprnnii
Divel Inturopemiitt)
(ooe of leterppmiity)
(a) MNIST/CNN
(b) CIFAR-IO/CNN
(c) CITAR-100/ReNNtt-111
Walls dalfee
Mooi offfee (Mg 9)
Tayi deating (Mly 30
Posseter slatting
Tuselao (scodoe gunn)
Figure 1: Success rate of SIA for 10 clients
8

---

Published as a conference paper at ICLR 2026
as the increased complexity of the dataset amplifies the differences between the generated local models. Layer-level shuffling exhibits slightly lower performance on MNIST and CIFAR- 10 than Algorithm
2 On CIFAR- 100, however, the difference is larger; for instance, Algorithm achieves approximately R 78% accuracy, while Algorithm [ reaches only R 60% for a = 0.1. This larger gap may be explained by the increased complexity of the ResNet architecture, where overfitting may also be stored in layers other than the final one, which Algorithm 3 targets. Parameter-level shuffling the best choice among the three. Algorithm [ cannot reconstruct as well the shuffled models; the accuracy of the SIA is reduced, for instance from 50% to 28% on the CIFAR-10 10 for a = 0.1. Still, however, the SIA accuracy remains higher than random guessing. Our proposed solution of D always reduces the accuracy to the level of random guess, validating Theorem In conclusion, the experiment shows that a straightforward application of shuffling might not be enough to protect against SIAs, especially in scenarios with high heterogeneity which are arguably the most relevant cases for SIAs. In contrast, our proposed solution provides an optimal defense. We also evaluate with more clients and other aggregation functions, such as FedSGD and FedProx, well as an MLP network, which are placed in Appendix since they lead to similar conclusions.
Algorithm
Protection against DRAS Although our main focus in this paper on defending against SIAs, we also empirically demonstrate in Appendix [.3 that Algorithm can also mitigate Data Reconstruction Attacks (DRAs). DRAs have been shown to depend heavily on the training batch size Yin et al. (202I). By applying Algorithm 1 we shuffle the models such fine granularity that only the aggregated model is exposed, effectively simulating a larger batch size. For example, if the batch size is with n clients, Algorithm I yields aggregated model similar to having single client train with a batch size of n. Specifically, while the reconstruction loss of the original DRA of et al. (2019b) is 3 10-4, it increases to 0.98 when Algorithm | is applied with 10 clients on the CIFAR- 10 dataset. Consequently, the reconstructed images become heavily degraded, containing no recognizable features. We elaborate further in Appendix F3 showing additional experiments.
7.2 PERFORMANCE ANALYSIS
Accuracy of the joint model Seeorithmoonl) considers the first r digits of the fractional part of each parameter. In this experiment, we show that r can be kept reasonably small to minimize the communication cost while preserving the accuracy of the joint model. Figure BigureBJshowe shows that for the MNIST, which requires simpler model, to vanilla FL and r scores a similar accuracy. On the other hand, CIFAR- 10 and CIFAR-100. which require more complex models, need = 3 digits to approach the performance of vanilla FL, and r = to match it. Note that the results hold for all three trust assumptions on the shuffler, as we assume shuffling does not degrade model accuracy (either with trust or with ZKPs).
2 suffices to reach a level of accuracy comparable
Communication Cost In Figure 2 we compare the communication cost of our approach against the baseline of vanilla FL (standard 32-bit binary encoding), which however transmits the whole value (whereas Algorithm I transmits only the first r digits). As upper baseline compare approach with Secure Aggregation (SA). implemented with standard secret-sharing, with t = n - 1 (cf. Section 6.2), setting the smallest possible C to avoid overflows (for the first r digits). Moreover, we evaluate the combination of Algorithm [ with R.F compression which further reduces the communication cost, when the shuffler is Fully Trusted (described in Appendix B.2). We do not compare SA with the Partially Malicious case, as SA assumes trusted or semi-honest clients. The Partially Malicious setting incurs the same communication cost as the Semi-Honest case for parameters not using ZKPs, plus an extra cost for those that do, depending on the chosen ZKP.
For 10 clients and r=5 the expansion factor, compared with vanilla FL, is 1.81x on CIFAR- 100/ResNet (Figure 14]. which yields s 53% accuracy (compared to =55% vanilla accuracy). This is an arguably manageable additional cost for the cross-silo setting, considering that the state-of-the-a protocol for SA for the cross-device setting exhibits an expansion factor of at least 1.73x [Boawwtz ct al. (2017). Note that a direct comparison between the two is not meaningful as Bonawitz et al. (2017) relies on a stronger trust assumption (Section 6.2). Nevertheless, if an expansion of 1.73x is deemed acceptable for the cross-device setting, a slightly higher factor should also be considered reasonable for the cross-silo setting, given the significantly superior communication capabilities of the clients. Finally, if we follow the literature of shuffle-model FL and assume a Fully Trusted shuffler, then the expansion factor drops to 1. 1.03x, approaching the cost of yanilla FL (Figure 14)

---

Published as a conference paper at ICLR 2026
Mo-04
(a) r
(b) r 8
Figure 2: Communication Cost (bits per client per parameter).
Figure 3: Model Accuracy (top-] 1) Alg. with precision r compared to vanilla FL (10 clients).
Table 1: Summary: Communication Cost for negligible (<3%) accuracy loss
shuffler)
Model
Dataset
Type
r
Expansion
CNN CNN ResNet
MNIST
Image
3
1.04
CIFAR-10
Image
5
1.81
CIFAR-100
Image
5
1.81
MLP
Synthetic Hu et al. (2024)
Tabular
4
1.28 x
CNN Transformer
HAR Reyes-Ortiz al. (2012
Time-Series
4
1.28x
Newsgroups Lang (995))
Text
4
1.28x
Table shows that Algorithm D scales well as the number of clients and r increase. Even with 10 clients (rather unrealistic in the cross-silo setting) and r 16, Algorithm needs 440 bits per parameter (or 79 bits with compression under fully trusted shuffler), compared to 32 bits for vanilla FL. and KBs for SA. Experiments with more complex models and datasets (Table I show that r = 4 suffices for optimal SIA protection with negligible accuracy loss (ef. Appendix F.2.2). The computation cost of Alg. for encoding negligible as is based on primitive operations. For instance, the 11 million parameters of ResNet can be encoded in just 19 seconds (cf. Appendix [.6).
CONCLUSION
We explored defenses against SIAs in FL by combining shuffling with encoding. Our proposed mechanism easily integrable within the shuflle model of FL and fully compatible with other privacy protection mechanisms, such as DP, as its addition does not affect DP guarantees or further degrade accuracy (cf. F.8). Another contribution of our work, potentially of independent interest, is the model reconstruction attacks to defeat standard shuffler in datasets with high level of dissimilarity. Future work should evaluate this attack on state-of-the-a FL mechanisms of the shuffle model, as it has been shown that different mechanisms provide varying privacy guarantees when the shuffler is compromised Athanasiou et al. (025)). this work, we focused on the shuffle model of FL. Developing similar defenses in settings where there is no shuffler remains interesting step for future research. Moreover, we focused on FedAvg but our approach can be generalized to any other sum-based aggregation function, such Li al. (2020); Reddi al. (2020) Li & Wang (2019); Ghosh et al. (2020), where the central server sums the parameters and then performs further processing. To verify, performed experiments FedSGD and FedProx (cf. F.4). Our work covers the vital class of sum-based aggregation functions which is widely used, for example in medical applications Mateus et al.) (2024): TNO y: Darzi al. (2024); (Dyyan al. (202I). I) On the other hand, our approach is not directly applicable to non-sum based frameworks, such as median based, clustering- and ranking-basee (e.g. Yin et al. (2018); Ghosh al. (2020); Iqbal al. (2025)) We include a preliminary discussion and evaluation of applying our proposed method to such cases in Appendix
199 which we aim to explore further. We did not consider disaggregation attacks Marchand et al. (2023), where the server observes only the joint model and attempts to recover local models. Combining them with SIAs is an interesting direction for future work, Finally, since our technique as secure aggregation protocol. It would be interesting to explore other use cases where revealing only the aggregated model suffices for protection, such DRAS, which evaluated in this work.
(Alg. I reveals only the sum of the secrets, it can
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This research was supported by the EU project ELSA: European Lighthouse on Secure and Safe Al (EU grant agreement 101070617) and by the PREP Cybersecurité project IPoP. The work of Andreas Athanasiou was also supported by the European Commission under the Horizon Europe Programme as part of the project RECITALS: An open-source platform for Resilient sECure digITAL identitieS (EU grant agreement 101168490).
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Iyya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference Computer and Communicationn Security, CCS 16, pp. 308- (18.118.2 New York, NY. USA, 2016. Association for Computing Machinery. ISBN 9781450341394 2978318. htttstt:: http://ii.org/////o/ 10. 111111111126711 (w1.5674..97778788 2978318
doi: 10.1145/2976749.
Ittai Abraham, Benny Pinkas, and Avishay Yanai. Blinder scalable, robust anonymous committed broadcast. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Commumications Security, CCS '20, pp. 1233-1252 1252, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781 450370899.
doi: 10.1 00.1145/3372297.3417666
//doi. org/
10.1145/3372299 3417261
Andreas Athanasiou, Kangsoo Jung, and Catuscia Palamidessi. Poster: Protection against source infer- attacks in federated learning using unary encoding and shuffling. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS '24, pp. 5036-5038, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400706363. doi: 10.1145/3658644.36/ 3691411 httthttss ottp:///ooooo..///.././....
www.ooo//......... 1145 018555555644444 1tt.///0111111//3666433333311311 36911668116666.4411111 3691411
Andreas Athanasiou, Konstantinos Chatzikokolakis, and Catuscia Palamidessi. Enhancing metric privacy with a shuffler. Proceedings on Privacy Enhancing Technologies, 2025(2):650-677 2025.
Andrea Bittau, Úlfar Erlingsson, Petros Maniatis, Ilya Mironov, Ananth Raghunathan, David Lie, Mitch Rudominer, Ushasree Kode, Julien Tinnes, and Bernhard Seefeld. Prochlo: Strong privacy for analytics in the crowd. In Proceedings of the 26th Symposium Operating Systems Principles, SOSP '17, pp. 441-459, New York, NY, USA, 2017. Association for Computing Machinery. ISBN 978 9781450308833. doi: 10. 111144/33327473312226666 8132747.313278
Utthttpss: http::::/ddoi.ooo http:///ooor//11.11111/1
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 17. pp. 1175- for Computing Machinery. ISBN 4784449349
17775-1119.1 1191, New York. NY, USA. 2017, Association
doi: 10.144221339566333992. URL
Nicholas Carlini, Steve Chien. Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. 2022 IEEE symposium on security and privacy (SP), pp. 1897-1914. IEEF, 2022.
B. Chen. The bounded gaussian mechanism for differential privacy.
Journal of Pri-
vacy and Confidentiality, 14(1). 2024. doi: 10.29012//pc.850.
URL https:/
Journal patrnalprin bournalprivacyooomm wwwpppcccooniieeeeecoocoocc ident ia wwweenialltt...om www.ii...rg//dd....iiee hwcphp/ppcpcrrrree wtt.iiicceeeeeeeeee. 850
Chen Chen, Daniele E. Asoni, David Barrera, George Danezis, and Adrain Perrig. Hornet: High-
speed onion routing at the network layer. In Proceedings of the 22nd ACM SIGSAC Conference on
Computer and Communications Security, CCS '15, pp. 1441-1454, New York, NY, USA, 2015. doi:
Association for Computing Machinery. ISBN 9781450338325.
URL htt.lhttts//eett /do. wrg/10..000 /145//10101110 2813628
A. Cheu, A. Smith, J. Ullman, D. Zeber, and M. Zhilyaev. Distributed differential privacy via shuffling. In EUROCRYPT. Springer, 2019.
11

---

Published as a conference paper at ICLR 2026
Jen-Shiun Chiang and Mi Lu. Floating poaringg-onttttt numbers in residue number systems. Computers & Mathematics with Applications, 22(10):127-140) 1991. ISSN 1898-1221. doi: http://doi.org/ 10.1016/0898 J902000-N URL https:: //wp://wwww... www.wsiiieneedrrre...... http:///eeerreee..../eoeeeeeeeee cwm www.sciencee.e.eeoeeeeoce.e.eeec article/p11/0896611111 902000N
Christopher A Choquette- Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. International conference on machine learning, pp. 1964 1974. PMLR, 2021.
Henry Conrigan-Gii Gibbs and Bryan Ford. Dissent: Accountable anonymous group messaging. pp. 340-350, 10 2010. doi: 1445//8863377186644444
Henry Corrigan-Gibbs, Dan Bonch, and David Mazieres. Riposte: An Anonymous Messaging System Handling Millions of Users. In 2015 IEEE Symposium on Security and Privacy (SP), pp. 321 -313,,,,110 Los Alamitos, CA. USA, May 2015. IEEE Computer Society. doi: 10.1 10.1109//P.2015.27
2015.27
Thomas M. Cover and Joy A. Thomas. Elements of Information Theory (Wiley Series in Telecommu- nications and Signal Processing). Wiley-Interscience, USA, 2006. ISBN 0471241954.
Erfan Darzi, Nanna M. Sijtsema, and M. A. van Ooijen. A comparative study of federated learning methods for covid-19 detection. Scientific Reports, 14(1):3944, 2024. doi: 10.1038/ 04155-0024-54323
Ittai Dayan. Holger R. Roth, Aoxiao Zhong, Ahmed Harouni, Amilcare Gentili, Anas Z. Abidin, Andrew Liu, Anthony Beardsworth Costa, Bradford J. Wood, Chien-Sung Tsai. Chih- Wang, Chun-Nan Hsu, C. K. Lee, Peiying Ruan, Daguang Xu, Dufan Wu, Eddie Huang, Felipe Campos Kitamura, Griffin Lacey, Gustavo César de Antônio Corradi, Gustavo Nino, Hao-Hsin Shin, Hirofumi Obinata, Hui Ren, Jason C. Crane, Jesse Tetreault, Jiahui Guan, John W. Garrett, Joshua D. Kaggie, Jung Gil Park, Keith Dreyer, Krishna Juluru, Kristopher Kersten, Marcio Aloisio Bezerra Cavalcanti Rockenbach, Marius George Linguraru, Masoom A. Haider, Meena AbdelMaseeh, Nicola Rieke, Pablo Damasceno, Pedro Mario Cruz e Silva, Pochuan Wang, Sheng Xu, Shuichi Kawano, Sira Sriswasdi, Soo Young Park, Thomas M. Grist, Varun Buch, Watsamon Jantarabenjakul, Weichung Wang, Won Young Tak, Xiang Li, Xihong Lin, Young Joon Kwon, Abood Quraini, Andrew Feng, Andrew N. Priest, Baris Turkbey, Benjamin Glicksberg, Bernardo Bizzo, Byung Scok Kim, Carlos Tor-Diez, Chia-Cheng Lee, Chia-Jung Hsu, Chin Lin, Chiu-Ling Lai, Christopher P. Hess, Colin Compas, Deepeksha Bhatia, Eric K. Oermann, Evan Leibovitz, Hisashi Sasaki, Hitoshi Mori, Isaac Yang. Jae Ho Sohn, Krishna Nand Keshava Murthy, Li-Chen Fu, Matheus Ribeiro Furtado de Mendonça, Mike Fralick, Min Kyu Kang, Mohammad Adil, Natalie Gangai, Peerapon Vateekul, Pierre Elnajjar, Sarah Hickman, Sharmila Majumdar, Shelley L. McLeod, Sheridan Reed, Stefan Gräf, Stephanie Harmon, Tatsuya Kodama, Thanyawee Puthanakit, Tony Mazzulli, Vitor Lima de Lavor, Yothin Rakvongthai, Yu Rim Lee, Yuhong Wen, Fiona J. Gilbert, Mona G. Flores, and Quanzheng Li. Federated learning for predicting clinical outcomes in patients with covid- 19. Nature Medicine, 273 2021. doi: 1031038/ 141199-021-00500--3 /ttp:///////////.....///////////
A. De Santis and G. Persiano. Zero-knowledge proofs of knowledge without interaction. In Proceedings., 33rd Annual Symposium on Foundations of Computer Science, pp. 427-436, 1992. doi: 199.:/9///SS........7...
Rahool Dembani, Ioannis Karvelas, Nur Arifin Akbar, Stamatia Rizou, Domenico Tegolo, and Spyros Fountas. Agricultural data privacy and federated learning: A review of challenges and opportunities. Computers and Electronics in Agriculture, 232: 10048, 2025. ISSN 0168- doi:
URL URL.ttts::
com/ http://ccaeeeottte.eeeee//////la
Roger Dingledine, Nick Mathewson, and Paul Syverson. Tor: the second- second-generation onion router. In Proceedings of the 13th Conference on USENIX Security Symposium Volume 13, SSYM'04, pp. 21, USA, 2004. USENIX Association.
12

---

Published as a conference paper at ICLR 2026
Aiden Durrant, Milan Markovic, David Matthews, David May. Jessica Enright, and Georgios Leontidis. The role of cross-silo federated learning facilitating data sharing in the agri- food sector. Computers and Electronics in Agriculture, 193:106648, 2022. ISSN 0168-1699. doi: http://c..oooeeerrrro.e///////// com/
106448. URL htt.httts:///t sc w encedi rect
Cynthia Dwork and Aaron Roth. The algorithmic foundations differential privacy. Foundations
and Trends@ in Theoretical Computer Science, 9(3 (11334))211-4400 407, 2014. ISSN 1551-305X. doi:
10.1561/0400000044. URL http:/ /tt doi. org 10 101110000111100000022222
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. volume Vol. 3876, pp. 265-284, 01 2006. ISBN 978-3-540-32731-4 doi: 10.1007/1 168187788 1878118844
Jie Fu, Zhiyu Sun, Haitao Liu, and Zhili Chen. Truncated laplace and gaussian mechanisms of rdp, 2023. URLbttps:: ptctps:/aarxiv.com haaprrgaab///000. 12679.1677
abs
Harvey L. Garner. The residue number system. In Papers Presented al the March 3-5, 1959, Western Joint Computer Conference, IRE-AIEE-ACM '59 (Western), pp. 146-153, New York, NY, USA, 1959. Association for Computing Machinery. ISBN 9781450378659,
doi: 10.1145/1457838.
1457864. URL http::ttss/////tmm ptttpp::/ddoi.zg///
org.i.oog//00 1et....1111111111111 htt.://................11147//33 7117778888111886 1457864
Jonas Geiping. Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy to break privacy federated learning? Advances in neural information processing systems, 33: 16977-1666977 2020.
Avishek Ghosh, Jichan Chung, Dong Yin, and Kannan Ramchandran. An efficient framework for clustered federated learning. Advances in neural information processing systems, 33: 19586-15977, 2020.
Antonious M. Girgis, Deepesh Data, Suhas N. Diggavi, Peter Kairouz, and Ananda Theertha Suresh. Shuffled model of federated learning: Privacy, accuracy and communication trade-offs. IEEE J. Sel. Areas Inf. Theory, 2( 2(1):464-477) 2021.
Google Cloud. Kakao healthcare advances medical ai with federated learning on google cloud, 2023.
www.oooooooooooooooooooooooooooo URL https://ct oudd. wewoolle.co//oo//ooooooooo.ooooo wtt.coocccoooooooo customers/ kakao- Lakko-healll theealtthcree-eeeeraaaeee federated wewaattddddlerannnnn Accessed: 2025-05-08.
Hanlin Gu, Jiahuan Luo, Yan Kang, Yuan Yao, Gongxi Zhu, Bowen Li, Lixin Fan, and Qiang Yang. Fedadob: Privacy-preserving federated deep learning with adaptive obfuscation, 2024. URL
https://arxiv: wtw.:/xwwww..r.a////...a// 01085
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 770-778, 2016.
Wouter Heyndrickx, Lewis Mervin, Tobias Morawietz, Noé Sturm, Lukas Friedrich, Adam Zalewski, Anastasia Pentina, Lina Humbeck, Martijn Oldenhof, Ritsuya Niwayama, Peter Schmidtke, Niko- las Fechner, Jaak Simm, Adam Arany, Nicolas Drizard, Rama Jabal, Arina Afanasyeva, Regis Loeb, Shlok Verma, Simon Harnqvist, Matthew Holmes, Balazs Pejo. Maria Telenczuk, Nicholas Holway, Ame Dieckmann, Nicola Ricke, Friederike Zumsande, Ajork-Aréé Clevert, Michael Krug, Christopher Luscombe, Darren Green, Peter Ertl, Peter Antal, David Marcus, Nicolas Do Huu, Hideyoshi Fuji, Stephen Pickett, Gergely Acs, Eric Boniface, Bernd Beck, Yax Sun, Arnaud Gohier, Friedrich Rippmann, Ola Engkvist, Andreas H. Göller, Yves Moreau, Mathieu N. Galtier, Ansgar Schuffenhauer, and Hugo Ceulemans. Melloddy: Cross-pharma federated learning un- precedented scale unlocks benefits in qsar without compromising proprietary information. Journal of Chemical Information and Modeling, 64(7):2331 2344, 2024. doi: 10.102 10.102 //cc..jiim.. 3c00799. URL https: /ttp::://do... .:00l..000 org. 11..111.11111110 1021/ acs. jeim. 3c00 7999
PMID: 37642660.
Susan Hohenberger, Steven Myers, Rafael Pass, and Abhi Shelat. Anonize: A large-scale anonymous survey system. In 2014 IEEE Symposium on Security and Privacy, pp. 375-389, 2014. doi: 10.1 10.1109/SP.214.31.
13

---

Published as a conference paper at ICLR 2026
H. Hu, Z. Salcie, L. Sun, G. Dobbie, and X. Zhang. Source inference attacks in federated learning. In ICDM. IEEE, 2021.
Hongsheng Hu, Xuyun Zhang, Zoran Salcic. Lichao Sun, Kim Kim-Kwang Raymond Choo, and Gillian Dobbie. Source inference attacks: Beyond membership inference attacks in federated learning. IEEE Truns. Dependable Secur. Comput., 21(4):3012-302, July 2024. ISSN 1545-5971. doi: 10. 1100/TDDSC.222333225555 URL htL.ttts::20 /doi. org/10. 1109/TDSC. 2023. 3321565
Chenxi Huang, Chaoyang Jiang, and Zhenghua Chen. Shuffled differentially private federated learning for time series data analyties. In 2023 IEEE 18th Conference Industrial Electronics and Applications (ICIEA), pp. 1023-1028, 2023, doi: 00.1009/CIEAA58666220333.. 102.11115....
Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora. InstaHide: Instance- hiding schemes for private distributed learning. In Hal Daumé III and Aarti Singh (eds.). Proceedings of the 37th International Conference Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 4507-4518. PMIR, 13-18 Jul 2020. _RI w...pres/vvliv. wttpaa///v1//hhagg01111
Saeed Iqbal, Adnan N Qureshi, Musaed Alhussein, Khursheed Aurangzeb, Atif Mahmood, and Saaidal Razalli Bin Azzuhri. Dynamic selectout and voting-based federated learning for enhanced medical image analysis. Machine Learning: Science and Technology. 6 6(1):015010, 2025.
Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista A. Bonawitz, Zachary Charles, Graham Cormode. Rachel Cummings, Rafael G. D'Oliveira, Salim EI Rouayheb, David Evans, Josh Gardner, Zachary Garrett, Adrià Gascón, Badih Ghazi, Phillip B. Gibbons, Marco Gruteser, Zaïd Harchaoui, Chaoyang He, Lie He, Zhouyuan Huo, Ben Hutchinson, Justin Hsu, Martin Jaggi. Tara Javidi, Gauri Joshi, Mikhail Khodak, Jakub Konečný, Aleksandra Korolova, Farinaz Koushanfar, Sanmi Koyejo, Tancrède Lepoint, Yang Liu, Prateek Mittal, Mehryar Mohri, Richard Nock, Ayfer Özgür, Rasmus Pagh, Mariana Raykova, Hang Qi, Daniel Ramage, Ramesh Raskar, Dawn Song, Weikang Song, Sebastian U. Stich, Ziteng Sun, Ananda Theertha Suresh, Florian Tramèr, Praneeth Vepakomma, Jianyu Wang, Li Xiong, Zheng Xu, Qiang Yang, Felix X. Yu, Han Yu, and Sen Zhao. Advances and open problems in federated learning. CoRR, abs/1912.04977, 2019. httthttpp//axiiii
abs 9912. 04977
Yigitcan Kaya, Sanghyun Hong, and Tudor Dumitras. On the effectivveness of regularization ofguuaari membership inference attacks, 2020.
against absp////////// 05336
Schoon Kim, Amir Gholami, Zhewei Yao, Michael W Mahoney, and Kurt Keutzer. I-bert: Integer- only bert quantization. In International conference on machine learning, pp. 3506-5518. PMLR, 2021.
Albert Kwon, David Lazar, Srinivas Devadas, and Bryan Ford. Riffle: An efficient communication system with strong anonymity. Proceedings on Privacy Enhancing Technologies, 2016, 08 2015. doi: 10. -00opeet--20--0008..
Albert Kwon, Henry Corrigan-Gibbs, Srinivas Devadas, and Bryan Ford. Atom: Horizontally scaling strong anonymity. Proceedings of the 26th Symposium on Operating Systems Principles, SOSP 17, pp. 406-422, New York, NY, USA, 2017. Association for Computing Machinery. ISBN 978355055 doi: 10.1144/3132247771327777 6132747.313228
htthttss::/ //doi. http://ooooo///1115/55333///
Ken Lang. Newsweeder: Learning to filter netnews. In Proceedings of the 12th International Conference on Machine Leurning (ICML), pp. 331-339, 1995.
Simon Langowski, Sacha Servan-Schreiber, and Srinivas Devadas. Trellis: Robust and scalable metadata-private anonymous broadcast. 01 2023. doi:
http2///dsss2223.33000
Thomas Lebrun, Antoine Boutet, Jan Aalmoes, and Adrien Baud. Mixnn: protection of federated
learning against inference attacks by mixing neural network layers. In Proceedings of the 23rd
ACM/FII International Middleware Conference, Middleware '22, pp. 135-147, New York, NY, USA. 2022. Association for Computing Machinery, ISBN 978 9781450393409, doi: 10. 10.1145/3528555 3565240. URL htttp:://doi http://o..ogg/..111111 /tt.g//....11/3228221 3565240
14

---

Published as a conference paper at ICLR 2026
Daliang Li and Junpu Wang. Fedmd: Heterogenous federated learning via model distillation. arXiv preprint arXiv:1910.0358) 2019.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429-450, 2020.
Ruixuan Liu, Yang Cao. Hong Chen, Ruoyang Guo, and Masatoshi Yoshikawa. Flame: Differentially private federated learning in the shuffle model. Proceedings of the AAAI Conference on Artificial Intelligence, 35(10))8688-8))) 8696, May 2021. doi: 10. 1a1116609aiii33555 17053. URL https
V/ojs. aaai wwwg..ndxx...///// pttp://AA//arttccee/////////e/ea
Donghang Lu and Aniket Kate. RPM: Robust anonymity scale. Cryptology ePrint Archive, Paper 2022/1037, 2022. URL
Donghang Lu, Thomas Yurek, Samarth Kulshreshtha, Rahul Govind, Aniket Kate, and Andrew Miller. Honeybadgermpe and asynchromix: Practical asynchronous mpc and its application to anonymous communication. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS '19, pp. 887-903, New York, NY, USA, 2019. Association for Computing Machinery. ISBN 9781450367479. doi: 10.1145/3319535.3354223 URL
Pratyush Maini, Michael C. Mozer, Hanie Sedghi, Zachary C. Lipton, J. Zico Kolter, and Chiyuan Zhang. Can neural network memorization be localized? In Proceedings of the 40th International Conference on Machine Learning, ICML'23. JMLR.org. 2023.
Tanguy Marchand, Regis Loeb, Ulysse Sauteau-Fereyy Jean Ogier Du Terrail, and Arthur Pignet. SRATTA: Sample C--riiiibttionn attack of secure aggregation in federated learning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), Proceedings of the 40th International Conference Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 23886-23914, PMLR, 23-29 Jul 2023. URL httph:: http::/://pooccciings... www.nnssm.........mm.mm......m.. wtt.sssmlr..rrrr..... v202 w2tp///aacaa/222222222 3a html
Pedro Mateus, Justine Moonen, Magdalena Beran, Eva Jaarsma, Sophie M van der Landen, Joost Heuvelink, Mahlet Birhanu, Alexander G Harms, Esther Bron, Frank J Wolters, Davy Cats, Hailiang Mei, Julie Oomens, Willemijn Jansen, Miranda T Schram, Andre Dekker, and Inigo Bermejo. Data harmonization and federated learning for multi-cohort dementia research using the omop common data model: A netherlands consortium of dementia cohorts case study, Journal of Biomedical Informatics, 155:104661, 2024. doi: 77 //pubmed. ncbi. mlm. nih. gotp///0////0//
10466.. URL https
H. B. McMahan and E. et al. Moore. Communication-Ffffiienn Learning of Deep Networks from Decentralized Data. In AISTATS. PMLR, 2017.
Lorenzo Minto, Moritz Haller, Benjamin Livshits, and Hamed Haddadi. Stronger privacy for federated collaborative filtering with implicit feedback. In Proceedings of the 15th ACM Conference on Recommender Systems, RecSys '21, pp. 342-350, New York, NY, USA, 2021. Association for Computing Machinery. ISBN 9781450384582. doi: 10.1145/3460231 11144//446023333442222. 3374262.. URL
htttss:/ddl..... htttps://dol.org// 1115/144023113332333 3474222
Sashank Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Konečný, Sanjiv Kumar, and H Brendan McMahan. Adaptive federated optimization. arXiv preprint 00X0:20003.0025,, 2020.
Jorge Luis Reyes-Ortiz, Davide Anguita, Alessandro Ghio, Luca Oneto, and Xavier Parra. Human activity recognition using smartphones., December 2012.
Krishna Sampigethaya and Radha Poovendran. A survey on mix networks and their secure applica- tions. Proceedings of the IEEE, 94:2142 2181. 01 2007. doi: 10. (WWp/PPROC.20008886667777
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv: 19100/000000000 2019.
15

---

Published as a conference paper at ICLR 2026
Sajin Sasy, Aaron Johnson, and Ian Goldberg. Fast fully oblivious compaction and shuffling. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 22. pp. 2579, New York, NY. USA, 2022. Association for Computing Machinery. doi: 10. (0.114///548666355666)) URL.https://doo 0tt.iiiorrg11.14.....1
ISBN 978 450394555
3548606. 3560608)
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE S&P, pp. 3-18, 2017. doi: 10.1109//P2017.411
Lichao Sun, Jianwei Qian, and Xun Chen. Ldp-fl: Practical private aggregation in federated learning with local differential privacy. arXiv preprini arXiv:2007.15789, 2020.
TNO. Federated learning: privacy-preserving data analysis, 2025. URL https::/www.w.... tno
nn//en/te htt//em/eecchcooog--scleeeeeeeee http://wwww......oc.ce//cceoeaae 2025-09-23.
Accessed:
Shuangqing Xu, Yifeng Zheng, and Zhongyun Hua. Camel: Communication-cffcienn and maliciously secure federated learning the shuffle model of differential privacy, 2024. URL https://
arxiv.org/abe abspg//bb///// 2ttp//1110.0444 00000//0000011000000000
Qiantao Yang, Xuchui Du Aodi Liu, Na Wang, Wenjuan Wang, and Xiangyu Wu. Adastopk: Adaptive federated shuffle model based on differential privacy. Information Sciences, 642:119186, 2023.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantinerrohust distributed learning: Towards optimal statistical rates. In International conference on machine learning, pp. 5650-5659, Pmlr, 2018.
Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 16337-16346, 2021.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Curran Associates Inc., Red Hook, NY, USA, 2019a.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019b.
16

---

Published as a conference paper at ICLR 2026
SUPPLEMENTARY MATERIAL
Ethics statement As discussed in Section 1 SIAs can pose a significant real-world privacy risk. Our proposed defense offers robust protection, making a positive contribution user privacy. Notably, its case of integration allows clients to implement the defense promptly. On the other hand, the proposed reconstruction attacks of Section can undermine the privacy guarantees of shuffle-based FL mechanisms, thereby compromising the privacy of end users. Additional work is needed to verify their effectiveness across other shuffle-based mechanisms.
Reproducibility statement To make integration easier with current shuffle model mechanisms, have implemented Algorithm I and placed its code in public repository Using this same code, all experiments reported in the main body and appendix can be reproduced; corresponding README file included in the repository as guidance.
We used Grammarly to fix awkward phrasing, grammatical errors and improve the overall clarity of sentences.
Use of LLMs
17

---

Published as a conference paper at ICLR 2026
APPENDIX
A PROOFS
In this section we include the missing proof of Theorem the cermmttion-thooeteee sense Cover & Thomas (2006). We recall that three random variables X, Y and Z form a Markov chain, denoted by
We will use the notion of Markov chain in
- Z. if X and are conditionally independent PIZ = =|Y y]. or, equivalently, dx, y, 2, P = x Z = 2, Y = yl = P(X = x x|Y = y] where P stands for probability. Note that X + Y Z, then also Z - + X.
given Y. Formally, Vx, y, 2, PIZ
x|X = Y =
We will also use other notions from information theory, namely Shannon entropy (X) and condi- tional entropy H(XY)), where X and Y are random variables. We recall that (X) represents the uncertainty about the value of X, and (X Y) represents the remaining uncertainty about X after learn Y.
First, we recall the well-known principle in information theory known as the data processing inequality (DPI), which states that postprocessing cannot increase the amount of information.
Proposition A.1. [Data processing inequality Cover & Thomas (2006)) Let X +Y - Z be Markov chain. Then the Shannon conditional mutual entropy (-I-)) satisfies the following property:
H(X[Y) S H(XIZ).
Since H (x represents the remaining uncertainty about X after we learn Y. the above formula (( < (Z) means that the amount of information that Y carries about X is less than the amount of information that Z (the result of postprocessing Y) carries about X.
To prove Theorem I. we first prove that releasing shuffled unary vector carries the same amount of information about the initial vector releasing sum:
Proposition A.2. Let the random variable V range over vectors of bits of fixed length k. namely over {0. 13x, let S(V) represent the shuffling V, and let EV represent the sum of all elements of V. Assume that the shuffler a probabilistic function that depends only on the number of 1 in the vector. Then, the information that S(V) carries about V is the same as the information that VV carries about V. Namely:
HVV = (V
Proof. Since the sum of the elements of V is the same as the sum of the elements of any shuffling of V, we have that V. S(V) and EV form a Markov chain. Namely:
V S(V) EV
Therefore, by Proposition A.1 have:
H(VIS(V)) S H(VIEV)
(1)
On the other hand, since we are assuming that the result of the shuffling of V (i.e., the probability distribution over the shuffled vectors) depends only on the number of 1's in V, we have that also V. ΣV and S(V) form Markov chain:
VV + S(V)
From which we derive, applying again Theorem A.I that
H(VEV) < H(V)S(V)).
Finally, from Equations and we can conclude.
We note that related result, formulated in terms of probabilities, shown in Cheu et al. (2019) Athanasiou et al. (2025) in the context of differential privacy.
Let us now prove the following property of Markov chains:
18

---

Published as a conference paper at ICLR 2026
Proposition A.3. Consider the following Markov chains:
X + ZZ,
(3)
X + W.
(4)
H( HY)W)) then:
Z( = H(XW)
Proof. From the first Markov chain in Equation
we deduce:
H(X = H(X, 2
[X deterministic]
H( Z) H(
[Chain rule]
H( + Z)
[Markov chain definition]
By applying the same reasoning to the second Markov chain in Equation we obtain:
H(X]W)= H(XXY) H(Y(W).
Since H(1 = H(Y we conclude that H(X 2) HX)))..
Now we are ready to prove our main theorem about the protection of our mechanism. Theorem 1. Algorithm 7 reduces the accuracy of SIAs to the level of random guessing.
Proof. We will show that the result of Algorithm | reveals no more information than the aggregated result (i.e. the joint model), thereby reducing the STA accuracy to that of random guess by definition, as there are no distinct models to compare. We assume is large enough so that the whole value is transmitted, which is the setting which leaks the most information.
Let X be the random variable ranging over the collection of values that the users hold for some parameter j. Define for each residue m.
V == fa mod m. : x X
and let Y be the corresponding random variable. The shuffler in Algorithm 1 receives the unary encoded values, concatenates them to a single vector, and shuffles them altogether, outputting a shuffled version S(Zg) of Z where
3/2
U uuy, m.) VEDT
Namely, Z is the concatenation of the unary encodings of the elements of V Note that Y depends only on YØ. The correlation between X3, Yž. and S(2{) (the latter being the vector observed by the central server), can be described by the following Markov chain:
X + Y + S(Z))
(5)
Now, let us consider scenario where the central server observes the aggregation (i.e., the summation) of all the values in Yg. which we denote by ΣY,, rather than shuffled version of the concatenation of their encodings. We have the following Markov chain:
X Y + ΣYς
Since the summation of the elements of Y the same as the summation of their concatenation Y, we can rewrite Equation as:
X + Yi + ENΙ
From Equation 5 and Equation
we derive. by Proposition
A.2
H(Y S(Y)) = H ΣY).
Given the above equality, and Equations for each parameter j and each residue m...
5 and we can apply Proposition A.3 and and conclude that,
H H(X))S(Z)) = =((
19

---

Published as a conference paper at ICLR 2026
The proof of Theorem relies the information that the central server first observes, since post- processing cannot increase the amount of information (data processing inequality). However, recall that Algorithm [ the aggregated model using RNS addition (Section 3 The only potential loss information may arise from the parameter (precision i.e., the digits transmitted after the decimal point). Since RNS encoding is lossless, we arrive at the following claim:
instructs the server to decode the result. Therefore, the server still recover
Claim A.1. Assuming sufficiently large Algorithm 7 does not impact the accuracy of the joint model.
B ALGORIHTMS
B.1 RECONSTRUCTION ATTACKS OF SECTION 5
We begin with Algorithm 2 which reverses model-level shuffling by remapping the models back to their original owners using the accuracy the shadow dataset S₂ of the target client
Then, for defeating layer- based shuffling, we assume w.l.og. convolutional layers and 2 FC layers, presenting Algorithm 3 Note that for notational convenience, use the FedAvg function to average layers (of neural networks) rather than entire models; the definition of the function remains similar.
Finally, Algorithm shows possible implementation of remapping parameter-level shuffling, assuming again w.l.o.g. 2 convolutional layers and FC layers. Note that FC2.0 notates the shuffled of the first parameters of the final FC layer FC2. Recall that each shuffle set has size nI, if the number of clients. We assume that FC2 has parameters.
Algorithm 2: R.M
Reconstruction attack against Model-leve shuffling
Input :wi,..., w', randomly permutated clients' models, Sz shadow dataset target user x, A(w. D), accuracy of model on the dataset D
Output Wn. the model of user x best w/
for each model w, in w....., w/, do ATW Sa) > A(best, S,) then L best + Wj
Return best
Algorithm 3: Rg
Reconstruction attack against Layer-level shuffling
Input 1C1,C2, randomly permutated convolutional layers, FC1, FC2, randomly permutated FC layers,
Sz. shadow dataset of target user
A(w, D), accuracy of model w on the dataset D
Output: Was model with FC₂ of user and the average of the rest layers / For FC2 find the one with best accuracy; take the FedAvg for the rest for each layer Li in FC2 do CFd Avg(Cr,, FedAug(Ca), FedAvg(FC1)..) I.)
Append in Wmodels
Return RM (ooodels Sg. A)
20

---

Published as a conference paper at ICLR 2026
Algorithm 4: CON
Construct model with given layers (used in Alg- B
Input Ci, C2, FC1, FC2 layers of the model
Output w. a model with the given layers
wCI C1
WC2 f C2
WFC1 FC1
WFC2 f- FC2
Return
Algorithm 5: Rp
Reconstruction attack against Parameter-leve shuffling
Input Wgiob the global model
FC2. randomly permutated parameters of the final layer Sz, shadow dataset of target user x,
A(w, D). accuracy of model w the dataset D
Output: WW. model with FC₂ of user a and the average of the rest layers
w, - Wylob
for each i-th set of parameters 2; in FC2, do
Wbest t- PREPEPPU (WWglob i, 24,0)
best + 24.0
for each parameter j in 2; do
if A(REP(wglen i, j), > A(Wbest, Sx) then Wbest <- REP (LEP(WWar (Wgtob: i,j)
best j
REP(Wask besl)
Return Wyy
Algorithm REP
Replace the i-th parameter of FC2 with (used in Alg. Input
w, a model
i, the i - th parameter of FC2
parameter replace
Output:w! the output model
w/ w
w
PC, p Return w'
B.2 COMMUNICATION IMPROVEMENT FROM SECTION 6
If we assume that the shuffler is Fully Trusted, following the literature Girgis et al. 2021 1) then Onion Encryption necessary to hide the secrets (i.e. parameters) from the MixNet servers. Similarly, Sero-Knowledge Proofs are not required to verify that each server did not tamper with the data. In both cases, since the shuffler is honest, we assume it will follow the protocol and will not leak the secret values to an adversary. Thus, we can further improve the communication cost by adding compression step after the unary encoding.
Run-Length Encoding (RLE) compresses a string by replacing consecutive repeated values with just a single value and count of its repetitions. For example, AABAA will be represented as (2A, 2A). In our case we have bits; more specifically Unary Encoding (Definition 2 creates bit-string by first placing the ones and then appending the zeroes. Since the size of the bit-string is known (i.e. r) we send only the number of ones. For example, if have [1. 1, 1, 0, 0, 0. O. O. 0, 0] we can just send the number The shuffler can create bit-string with ones and illustrates this idea.
3 = zeroes. Algorithm
21

---

Published as a conference paper at ICLR 2026
Algorithm 7: Pa raaette-leeee shuffling with RNS combined with RLE
Input: n clients, precision T; function RN RNSSen()) for RNS encoding and RN Sdeo() for decoding. function (x, k) for unary encoding in & bits
Output: Wyllb, the joint model
Let M {m,, M22..... m.)
be pairwise coprime integers where ImEM m < n(10' - 1)
Client-side (each client with model w;):
// Encode each parameter in RNS
for each parameter p in w, do
(p1,P2,...Pui) t R.N TRNSenn(L) 100-100111 1,M
for each residue p; in (p1,P2,-. ..,... PPu do
L Send pı to the shuffler. // Send the number of ones to the shuffler
Shufffer:
for each parameter p do
+ U(p; m;) for each RNS moduli m, and each received residue p.. // Decompress Concatenate all the decompressed received bit vectors B to vector Bp.j for each residue j. Shuffle (bit-wise) each Bp.j and send it to the central server.
Server-side:
Receive the permutated bit vectors By for each parameter for each i-th parameter of Wglob do
// Sum and decode the residues to get the average of each pa parameter
y By BI
Wylab! [ + (RN M)) M)/10'//n
Return Wglob
C EXAMPLE IMPLEMENTATIONS
This section discusses example of the Chinese remainder theorem and gives an example imple- mentation of shuffling with MixNets. It also includes the figures that are missing from the main-body due to space constraints. Figure shows the different shuffling granularities which we examined in Section 5 and Figure illustrates simple example of Algorithm
Clinst
Round
Busst
0100000
P:3.3
Baund
0111...110
6555
Client
Shutter
Raxx!
010011
+
Boand
200
P:0.21
10000
(1.0,6).ol 1
pt 0.55/2 - 0.275
Roond
0020000
Client-sia side
Server-side
Figure 4: Example of Algorithm D with moduli 3, 5, 7, for a parameter p. where and m 2.
C.I EXAMPLE OF THE CHINESE REMAINDER THEOREM
We show how the Chinese remainder theorem can be applied to reconstruct the secret value from the residues, using the example of Figure
Consider the following system of congruences, where 3, 5, and 7 are pairwise coprime:
mod 3
mod 5
Ø mod 7
22

---

Published as a conference paper at ICLR 2026
We begin by computing the product of the moduli:
M 7 105.
For each congruence, we define M, = M/m,, where m, is the modulus of the i-th equation:
Mi 105/3 35, M2 105/5 21, M3 105/7 15.
Next, compute the modular inverse yı such that M; y; 1 mod m;:
35 y/1 = mod 3 = y/1 = 2,
21 1 mod 5 + y2
1/3 mod 7 = 1/3
We now apply the Chinese remainder theorem formula:
I 01 M1yI + M2y22 ag Mays mod M,
where a₁ = 1, a2 = 0, ag =
By substituting the values have:
x 35 21 1+ 15
160 mod 105.
Thus, the solution is:
55 mod 105.
Observe that 55 indeed satisfies all original congruences:
55 mod 3 = 1, 55 mod 5 = 0, 55 mod 7 = 6.
C.2 SHUFFLING
Model leael shuftling
Client
L:
por modill
Layen- flod ahaffling
Client
P2
Paremeten- lovel shufliing
poramete
M
Client-side
Shuffler
Serven-side
Figure 5: Shuffling methods in FL with different granularity
Algorithm usees Onion Encryption Dingledine et (2004) ensure that server can view the messages and dero-Knowledge Proofs (ZKPs) De Santis & Persiano (1992) to assert that no server can change the messages. Each server decrypts the outermost layer of onion encryption, verifies that no tampering has occurred with ZKP, shuffles and sends the shuffled vector to the next server. Since an honest shuffling (i.e. the fact that the previous server chose a uniformly random permutation) cannot be proved via ZKPs, at least one server of the MixNet needs to be trusted.
In scenarios where the clients cannot run their own MixNet server, they can instead choose more servers from the network to shuffle. For instance, they can decide to always select 100 servers out of all the available ones (a different set servers for each parameter), meaning that the adversary must control all 100 servers compromise the defense for each parameter. However, this requires an omnipotent adversary that controls a significant part of the MixNet network (even hacking honest servers like those run by the honest clients). This attacker is arguably unrealistie: often, anonymity systems, like Tor Dingledine et al. (2004), assume that an attacker can only control parts of the network.
23

---

Published as a conference paper at ICLR 2026
Algorithm 8: Shuffling with MixNet
Input :M, Message client wishes to send, number clients, List of participating mix servers, Onion [M, pk) and Chionnec(MMsn for onion encryption/decryption Output messages M'
// client-side
for each client in parallel do
C 4 1,
// onion-encryption
for each mix server j in reverse order of P do
L C O pky)
Send Pt
// Mi MiNet-side
for each mix server in P do
// First server receives the messages (no 2KP to verify)
it = 1 then
L C [C
< None
// Last server outputs the messages
jf Pl then
L Return Je).
C, π t MixVerify(C.j.rr
Algorithm Mix Verify(C..j.z)
Input C: Message from previous server, j: Current mix server, πT-1 7KP from previous server, Verifyzkp (C, T) and Generatezkp C') to verify and generate ZKPs. Output:Partian decrypted and shuffled message C'
M + Onionpee (Cksk)
if j > and VerifyzKp( (M, 1)) then
L reject and abort
M' < Shuffle(M
J + Generatezxp(MM,
Return M', .T
D MODELS AND HYPERPARAMETERS
This section describes the models which we used in the experiments of Section For MNIST and CIFAR-10 10 we used exactly the same models as in Hu et al. (2021) 2024 as we used their code for evaluating the SIAs. For CIFAR-100 we used the ResNet- 8, in order to illustrate that the proposed mechanism works even on more complex models.
D. MNIST
We use a CNN which consists of two convolutional layers with 5x5 kemels,, followed by two max- nox-pooling layers, and three fully connected layers. Specifically, the architecture follows:
Comv2D layer: 32 filters with a kerell size x Activation: ReLU. Input shape: (1, 28, 28).
MaxPoolingg2D(222 2)).
Comv2D layer: 64 filters with kemel size of 5 x 5. Activation: ReLU.
Mo 2)).
Flatten layer: Flattens the feature maps into a ID tensor of size 64 x 4 4 4.
24

---

Published as a conference paper at ICLR 2026
Dense layer: 512 neurons. Activation: ReLU.
Dense layer: 128 neurons. Activation: ReLU.
Output: Dense layer: 10 neurons. Activation: none (logits).
D.2
CIFAR-10
The CNN consists two convolutional layers with 5x5 kernels (the first convolutional layer takes input images with three color channels (RGB)), followed by two max-pooling layers, and three fully connected layers. Specifically, the architecture is as follows:
Conv2D layer: 32 filters with a kernel size of x 5. Activation: ReLU. Input shape: (3, 32, 32).
Max 2)).
Comv2D layer: 64 filters with kernel size of 5 x 5. Activation: ReLU.
(a 2)).
Flatten layer: Flattens the feature maps into a ID tensor size 64 x x 5.
Dense layer: 512 neurons. Activation: ReLU
Dense layer: 128 neurons. Activation: ReLU.
Output: Dense layer: /0 neurons. Activation: none (logits).
D.3 CIFAR-100
We use standard ResNet-18 18 architecture He et al. (2016) for CIFAR-100. Specifically, we use the implementation provided by the Py PyTTocch library, initialized without pretrained weights (pre- trained=False). The architecture is as follows:
Conv2D layer: 64 filters with kernel size of 7 stride 2, padding 3. Activation: ReLU.
Input shape: (3, 224, 224).
MuxPoolingg2D(1,, 3)), stride
Residual Block (x2): Two convolutional layers with 64 filters, kernel size 3, batch normalization, and skip connections.
Residual Block (x2): Two convolutional layers with 128 filters. The first block includes downsampling via stride
Residual Block (x2): Two convolutional layers with 256 filters. Includes downsampling.
Residual Block (x2): Two convolutional layers with 512 filters. Includes downsampling.
Global Average Pooling: Output size reduced to 512-dimensional vector.
Fully Connected Layer: Output size 100 (number of classes). Activation: none (logits).
D.4 HYPERPARAMETERS
For training, we used stochastic gradient descent (SGD) as the optimizer with a learning rate of 0.01 and momentum of ().9. Each client trained the model using a local batch size of 64, while the testing batch size was set to 128. These hyperparameters were selected following standard practice FL. literature and remained fixed across all experiments.
E RESOURCES
To compute each point in Figure Algorithm and Algorithm take approximately 1/2/7 hours for the ANIST/CIFAR-IO/CHIII Algorithm 5 the time required is approximately 20/40/70 hours for MNIST/CIFAR CWCCIIIAII//IIFARRRR 10/CIFAR-100. respectively. Our proposed method (Algorithm [] takes around 0.5/1/3 hours for MNIST/CIFAR- 10/CIFAR 100, respectively, with nearly all of that time spent training. We limit training the
100 datasets, respectively. For the parameter reconstruction attack of
25

---

Published as a conference paper at ICLR 2026
first 10 epochs to reduce unnecessary computational cost, SIA accuracy tends to be higher in early rounds when client models are more diverse. The experiments were conducted on server equipped with two NVIDIA RTX 6000 GPUs (24 GB each), two AMD EPYC 7302 16-core processors, 512 GB of RAM, and 10 Gbps Ethernet connectivity.
The other experiments that do not necessitate the of GPU (i.e. Table 10 and Figure were computed on a Mac M1 Laptop with a Apple Mac M1 Max chip and 64 GB of memory.
ADDITIONAL EVALUATION
F.1 OTHER DEFENSES AGAINST SIAS
Hu et al. (2024) discusses that regulaziration-based defences are insufficient against SIAs. this section we verify this claim by performing experiments MNIST and CIFARIO datasets with 10 clients and a = 0.1 (the level of heterogeneity). Table 2 shows that all standard regularization approaches fail address SIAs; rather, they may make the model even slightly more susceptible to them, as they might increase the distributional differences between clients.
Furthermore, also Instahide Huang et al. (2020), which was designed for Data Reconstruction Attacks (DRAs). Instahide works by having each client blend their images with some h (a parameter of the mechanism) random, publicly accessible ones. This forms layer of obfuscation which prohibits the adversary from reconstructing the images. Table 3 shows that this defense is ineffective against SIAs. Instahide focuses on preventing the adversary from reconstructing particular image, but SIAs consider that the adversary does know that the image exists in the dataset. If the images are blended, with Instahide, then this means that the adversary already knows the blended image. Since this blend is not happening between clients (c.g. shuffling their images) but between each client and public dataset, the distributional differences are not affected. Note that Instahide is small, meaning that only small portion of the image is altered, to retain model accuracy.
Table 2: Regularization--asse defenses against SIAs with 10 clients
Model Ace. (vanilla FL)
SIA Acc. (vanilla FL)
Experiment
Parameter
Dataset
Model Acc.
SIA Acc.
Crop=24
MNIST
92.56
97.22
50.24
45.01
Crop=20
MNIST
83.30
97.22
53.17
45.01
Crop=16
MNIST
62.15
97.22
56.10
45.01
Random cropping
Crop=28
CIFARIO
58.78
61.07
52.50
51.57
Crop=24
CIFAR10
53.66
61.07
53.07
51.57
Crop=20
CIFARIO
44.81
61.07
59.20
51.57
p=0.2
MNIST
96.45
97.22
55.70
45.01
p=0.5
MNIST
96.28
97.22
50.92
45.01
p=0.8
MNIST
96.42
97.22
45.17
45.01
Dropout
p=0.2
CIFAR10
60.76
61.07
$7.77
51.57
p=0.5
CIFAR10
60.38
61.07
55.20
51.57
0-0.8
CIFARIO
60,52
61.07
54.54
51.57
e05
MNIST
97.34
97.22
50.94
45.01
-044
MNIST
97.32
97.22
52.87
45.01
e=3.3
MNIST
97.00
97.22
55.27
45.01
Weight decay
005.5
CIFARIO
61.01
61.07
$6.89
51.57
c=0.4
CIFARIO
61.02
61.07
57.70
51.57
c=0.3
CIFAR10
60.59
61.07
61.97
51.57
26

---

Published as a conference paper at ICLR 2026
Table 3: Instahide against SIAs with 0.1, clients on the MNIST dataset. SIA accuracy on vanilla FL is 45.01% and vanilla model accuracy is 97. 22%
k
Model Accuracy
SIA Accuracy
97.48
50.3
2
86.65
49.9
81.52
50.9
4
78.65
50.45
78.37
52.71
F.2 PROTECTION FROM SIAS
F.2.1 DIFFERENT HYPERPARAMETERS
F sisows the success of SIA for Algorithm I and the reconstruction Algorithms 2 S and 5) with varying number of clients when a is fixed to 0.1 with 10 local epochs. We observe that the success rate depends on the number of clients which clarifies the reason why SIAs are more of threat in the cross-silo setting. In all cases, model-level and layer-level shuffling offer insufficient protection, while parameter-
shuffling performs better but the SIA accuracy is still better than random guessing. In contrast our proposed method of Algorithm I offers robust protection.
Moreover, we conduct an experiment where vary the number local epochs (Figure 77. which does not yield notably different results because of the small a (i.e. datasets are already easily distinguishable).
pade
SIA purooe oade
Nambar of Climia
Numlber of Clastla
Numbar of Clanls
(a) MNIST/CNN
(b) CIFAR-IO/CNN
(c) CIFAR-1O0/ResNel
Nallh (oddae
Saad4 daffin 1Ag,
Tayor lned dedfing LMla
Placester Ind deallig (8lg.
Alp
Therder Dreakies gronn)
Figure Success rate of SIA for varying number of clients when a 0.1 with local epochs
8TA ancrrve cate
Number Local Epoda
Nundos of Local Epocka (b) CIFAR-10
(a) MNIST
Vaaila ee
Shakklent statkng (Alg 2)
Lavns www seafing (Mlg.
Prnsenttniie siatting (Ml
Mp
Jowiber (puesies grns))
Figure 7: SIA success rate across different number of local epochs with 10 clients and a 0.1
Finally, examine how the accuracy of the Reconstruction Attacks of Section 5 is affected when the adversary has only an "approximate" shadow dataset. In this setting, instead of exactly knowing few data points, the adversary knows noisy version of them. We run experiments CIFAR-10 (a: 0.1, 10 elients, 10 global epochs, 10 local epuchs) using two noise types: geometric noise (Table 44) and color noise (Table 5). Both tables show that standard shuffling techniques fail to guarantee perfect
27

---

Published as a conference paper at ICLR 2026
protection (i.e., equal to random guessing, which is 10% in this case). In contrast, proposed approach consistently provides robust protection, as our theoretical guarantees are independent the adversary's side knowledge (Theorem T
Table 4: SIA success rate (%) shadow dataset with geometrical noise
Method
Original
Good (30% rotation)
Mid (H-Flip)
Bad (V-Flip)
Model-level shuffling (Alg.
45
40.6
32
26
Layer-level shuffling (Alg.
42
33
27.3
25
Parameter- shuffling (Alg.
24.1
21.7
19.3
Proposed Solution (Alg.
10
10
10
10
Table 5: SIA success rate (%) on a shadow dataset with color noise (brightness = contrast = saturation z, hue = z/10)
Method
Original
Good (æ 0.2)
Mid (x 0.4)
Bad (r 0.6)
Model-level shuffling (Alg.
45
31.9
22
18
Layer-level shuffling (Alg.
42
39
18
16
Parameter-level shuffling (Alg.
5
27
19
14
12
Proposed Solution (Alg.
10
10
10
10
In the experiments of the main body we assumed that the adversary holds shadow dataset that is 5% of the one actually used. Table shows that even when this percentage is smaller, the adversary still has an accuracy greater than random guessing (which is 10%).
Table 6: SIA success rate for smaller shadow dataset (CIFAR-10/CH))
10, = 0.1)
Method
0.5 % shadow db
1 1% shadow db
Vanilla FL
51.57
51.57
Model-level shuffling (Alg.
21.2
25.4
Layer-level shuffling (Alg.
20.24
23.5
Parameter-level shuffling ( (ATg. gg.
5
16.2
19.1
Proposed Solution (Alg.
10
10
F.2.2 DIFFERENT MODELS
We conduct experiments the Synthetic tabular dataset of Hu al. (2024). using the same MLP architecture as Hu et al. (002) for a fair comparison. Table shows results consistent with the previous experiments, supporting the generality of SIAs. We observe that model-level, layer-level and parameter-level shuffling reduce the success rate of SIAs but fail to completely mitigate the attack. However, the proposed Algorithm [ shows the same SIA accuracy as random guessing.
To evaluate the proposed method across different data modalities, we conducted additional experi- ments time-series dataset (UCI HAR dataset Reyes-Ortiz al. (2012)) and text dataset (the 20 Newsgroups dataset Lang (1995) in addition to synthetic data. For the UCI HAR dataset, we employ ID CNN, and for the 20 Newsgroups dataset, we use DistilBERT Sanh et al. (2019). The experimental results are summarized in Table 8 In the Synthetic and HAR datasets,
4 can achieve the baseline accuracy. For the 20 Newsgroups dataset, the model accuracy close to the accuracy of Vanilla FL when set = 3 and almost matches it when 4.
Our experimental results show that reducing the model parameters with r is sufficient to achieve balance between model accuracy and protection against SIAs. Further compression beyond this point provides marginal accuracy benefit while incurring greater communication cost. In conclusion, preserves accuracy close to that of the vanilla model across all evaluated datasets (MNIST, CIFAR10, CIFAR100, Synthetic, HAR, and 20 Newsgroups). while significantly reducing the success rate of SIA.
28

---

Published as a conference paper at ICLR 2026
We would also like to discuss an alternative approach for LLMs. Instead of scaling by 10" (as in Algorithm 1). one could perform integer quantization. Notably, recent work has shown that each parameter of BERT can be represented (2021). When such 8-bit quantization is combined with our RNS-based encoding, the resulting co- prime moduli introduce only 1.28x expansion factor over Vanilla FL's 32-bit binary encoding, while still enabling a full depiction of the quantized model parameters. In other words, the combination of integer quantization with Algorithm [T achieves 1.28x expansion with exactly the same model accuracy of Kim et al. (202T) (i.e. negligibly less than vanilla FL). With this combination, the SIA accuracy in BERT decreases 10% (i.e. equivalent to random guessing) compared the 69.8% SIA success rate of Vanilla FL.
8-bit integer with negligible accuracy loss Kim et al.]
Table 7: SIA success rate on the synthetic dataset of Hu et al. 2021 with MLP
Method
Success Rate (%)
Vanilla FL.
46.2
Model-level shuffling (Alg.
39.3
Layer-level shuffling (Alg.
37.0
Parameter-level shuffling (Alg.
21.1
Proposed Solution (Alg.
10.0
Table 8: Model Accuracy (top-1) of Alg. Synthetic, HAR, and 20 Newsgroups datasets.
1 with precision compared to vanilla FL (10 clients) on
Model Accuracy
SIA Accuracy
Dataset
Vanilla FL.
r=
r = 2
y= 3
r r=
Vanilla FL
Alg.
Synthetic
80.48
65.19
75.96
76.07
80.30
54.30
10
HAR (time-series)
90.38
16.83
53.58
87.72
89.28
55.60
10
20 Newsgroups (text)
67.90
3.03
5.16
64.00
66.90
69.80
10
F.3 PROTECTION AGAINST DATA RECONSTRUCTION ATTACKS
In this section we discuss how our proposed method can effectively defend against DRA. One of the earliest works DRA, Deep Leakage from Gradients (DI.) Zhu et al. (2019b), assumes that each client uses very small batch size for local training (at most 8 samples). However, in our approach, all client gradients (or model parameters) are mixed before being transmitted the server (using Algorithm|] D. Thus, even if each client employs batch size of 1, the aggregated gradient reflects n data points, where the number of clients.
We conducted experiments against the DLG attack of Zhu et al. (201b)). which show that our approach can substantially reduce its effectiveness. Specifically, while the reconstruction loss of the original attack is 0.0003, it increases to 0.98 when Algorithm i applied (even with as few as five clients). Thus the reconstructed images under Algorithm| become severely degraded, with no recognizable features Figure g Other DRA techniques are capable of operating with larger batch sizes (c.g.. Yin et al. (202I) employs up to 48 samples per client). However, Yin et al. (202I) also shows that the success rate of the attack decreases the batch size increases. This suggests that our method, by effectively conveying larger batch sizes, can further help mitigate DRA.
F.4 OTHER AGGREGATION FUNCTIONS
Federated Proximal (FedProx) Li et al. (2020) adds proximal term regularization penalty during local model optimization. The global model is then computed as the average of the local models. In Federated Stochastic Gradient Descent (FedSGD) McMahan & Moore (2017) clients compute gradients over their data just once per round. The central server collects all local models and averages them.
Figure Jssows that for both cases SIAs have higher success rate than random guessing for all standard shuffling approaches. In contrast, the proposed framework reduces the accuracy of the attacks to
29

---

Published as a conference paper at ICLR 2026
Iter=0
iter=
iter=20
iter=30
iter=40
iter=
iter=
iter=
iter=80
iter=90
(a) 2 clients
iter=0
iter= 10
iter=20
iter= 30
iter=40
iter=50
iter=60
iter= 70
iter=80
iter=90
(b) 10 clients
Figure 8: DLG attack on Algorithm| (CIFAR-10 with batch size 1)
random guessing. This indicates that our approach can be extended to other sum-based aggregation functions. Figure 10 shows that suffices reach an accuracy comparable to vanilla FL and r =5 5 to match it.
SIA surves rade (96)
SIA success rasle (96)
0.1
335
82 (level of heterogeneity)
05
0.1
0b
07
10
(level of heterogemeity)
(a) FedProx (CIFAR1O/CNN)
(b) FedSGD CIFARIO/CNN)
Figure 9: Success rate of SIA for 10 clients on FedProx and FedSGD
Model Accuraey (%))
Re
Nethi Dig
Precision
Figure 10: Model Accuracy (top-1) CIFAR-IO/CNN of Alg.
with precision compared
vanilla FL (10 clients).
F.5 COMMUNICATION COST
Figure II shows that RNS encode even large numbers using small set of moduli, minimizing the number of shuffling rounds. Moreover, Figure presenns a zoomed-in view of Figure for up to 20 clients. For 4, we observe that Algorithm| requires approximately 23 extra bits per parameter
30

---

Published as a conference paper at ICLR 2026
compared vanilla FL, increasing around 78 additional bits when = 8. The communication cost of SA is slightly lower only when and the number of clients small (i.e. fewer than 5).
Note that Figure 12 shows that Alg. [ with compression However, recall that Alg. transmits only the first r digits the parameter whereas vanilla FL transmits the whole value. Conversely, if one wants FL to transmit only the first digits, they might be able to use less bits. For example r = 3 than a 12-bit binary encoding is sufficient. In any case, we want to note that the proposed technique does not outperform vanilla FL in terms of communication cost, as transmits less information.
surpass standard vanilla FL.
the standard binary compression of vanilla
Sbbleeevaluates the proposed technique for more clients and complex models (necessitating larger r). We observe that for both parameters Secure Aggregation scales poorly; in contrast the proposed technique offers reasonable communication cost, especially when combined with compression. Recall that Algorithm| I assumes a Semi-Honest shuffler; if the shuffle is Fully Trusted than coupling with RLE is possible.
Table 9: Communication cost for larger parameters (bits per user per parameter)
Alg.
Clients
SA
Alg.
Vanilla FL
+ RLE
1000
8
36926
160
43
32
10000
8
399920
160
42
32
1000
12
49900
281
61
32
10000
12
539892
328
67
32
1000
16
63872
381
73
32
10000
16
669866
440
79
32
Finally, Figure 14 shows the expansion factor, that the ratio of the encoded model size to the size of the initial vanilla FL model (i.e. using standard 32-bit binary encoding). The plot shows that for 10 clients, an expansion factor of 1.81x is sufficient to achieve nearly the same accuracy as vanilla FL. and 2.4x is needed fully match it. If RLE compression is used, the expansion factor is 1.03x, which is a negligible overhead.
Shafflnng Ronndk
Shurfting Rounck g. of
Sh ottting Reurds
Clinnt
(a) r 10
(b) 10 clients
(c) 10 clients
Figure 11: Number of shuffling rounds in Algorithm
31

---

Published as a conference paper at ICLR 2026
Comregoodiing Aocunwey
Commmnettio Cont (14t0)
Coumenicttoon tut Clal (1.bs)
100
IBA (Faly Touid dlc)
Vedaa It.
Expaceion Factor
Figure 12: == 4
Figure 13: r = 8
Figure 14: Expansion factor CIFAR--O0/ReeNet when 7 10
32

---

Published as a conference paper at ICLR 2026
F.6 COMPUTATION COST
The encoding overhead of Algorithm 1 is negligible for the clients since it relies on fast and primitive operations (modulo and unary encoding). As shown in Table T0 even ResNet can be encoded in just 19.1 seconds, which is negligible compared to the total training time. Similarly, decoding (performed by the central server) slightly slower but still remains efficient (e.g. slightly less than minute for ResNet).
Table 10: Computation Time in seconds
DB/Model
# of Parameters
Encoding
Decoding
MNIST/CNN
643850
1.16
3.8
940362
1.6
5.6
CIFAR-I00ReeSNG
11237432
19.1
57
F.7 SIA SUCCESS RATE WITH SUBSAMPLING
Figure 15 illustrates the accuracy of SIA when subsampling is applied. In the case of MNIST, the SIA accuracy drops significantly when the number of clients increases from 10 to (from 45% to 10.2%), but rises again when client sampling is applied (44.1% 1% at a 20% sampling rate). Similar trends are observed for CIFAR-10 10 and CIFAR-100, where SIA accuracy decreases with more clients (from 51% 16% in CIFAR- 10, and from 77% to 26% in CIFAR-100) 100), but increases when only subset of clients is sampled (up to 50.33% and 72.5%, respectively). This experiment highlights that SIAs can be generalized to settings with more clients, if subsampling is applied.
Figure 15: SIA accuracy MNIST (blue), CIFAR-10 (orange) and CIFAR-100 (green) under client sampling with = 0.1 and 10 local epochs.
33

---

Published as a conference paper at ICLR 2026
F.8 SYNERGY WITH DP
Privacy of DP-SGD A well-known property of DP is that post-processing does not affect the privacy guarantees of mechanism:
Lemma 2 (Post-Processing). Dwork & Roth (2014) I is (e, -pprrxxmaaa differentially private thenfor every function A, A M is (E, approximate differentially private.
Combining Algorithm| with DP-SGD, involves encoding the parameters (using RNS) after they have been obfuscated with DP. Hence, encoding is post-processing (i.e. performed after the addition of noise) and thus the privacy analysis of DP-SGD is not affected.
However, Algorithm I is based on the assumption that the parameters of the model can be bounded; in our work, we assume w.l.o.g. that every parameter is in (-1,1). DP-SGD Abadi et al. (2016) bounds (i.e. clips) the gradient but then adds unbounded Gaussian noise. While clipping does help.
the noisy output might, theoretically. fall outside of (-1.1).
To avoid this problem we can use a truncated Gaussian; it is known that such mechanism offers the same Rényi-DP (RDP) privacy guarantees as the standard non-trunce con-truncated Gaussian Fu et al. (2023). DP-SGD measures privacy by the Moments Accountants method, which is essentially scaled variant of RDP Abadi et al. (2016), thus using truncated Gaussian will not affect its privacy analysis. Furthermore, the truncated Gaussian mechanism also satisfies the same DP-guarantee as the unbounded version Chen (2024).
In case one wishes to use something other than the standard Gaussian mechanism for DP-SGD, one solution would be to bound the probability that the mechanism outputs out-of-bounds value by the å term of DP (c.g. by using Markov's incquality, which is a common technique Athanasiou et al.) (2025). Another approach, to avoid adding 6, would be for the clients collectively find the bounds after adding noise by calculating their minimum and maximum values (e.g. with an MPC protocol). In that case the communication cost does not depend the number of dimensions (i.e. number of parameters) as each client will first compute locally their minimum and maximum over all of their dimensions.
In practice, anyway, even with the standard Gaussian, it is very rare to get result out of range, since the amount of noise added is usually rather small. The standard deviation of the noise C. NooiscMultiilerr /BatchSize, which is typically very small. For example, with clipping norm C = 1, noise multiple =1.0, batch size 64, the resulting standard deviation only o 0.015. Furthermore, the (noisy) gradient is also multiplied by the learning rate, thus the DP noise is also downscaled.
To empirically validate this behavior, we conducted experiments on the MNIST dataset under three different privacy budgets (c) using 10 clients, 10 local epochs, 10 global epochs and a = 0.1. Table shows that not single parameter of any client outside of the range (-1,1).
Table I1: Range of Parameters for different
Range of Parameters
1
0.438, 0.592
2 0.412, 0.573
5
- 0.400, 0.543
SIA protection Regarding protection (i.e. SIA accuracy), coupling DP-SGD with our mechanism does not affect the defense, since Algorithm and DP are orthogonal to each other, in the sense that adding DP noise does not affect the analysis of Theorem I We conducted an evaluation combining Algorithm I with SP- MNIST (10 clients, 10 local epochs, 10 global epochs, 0.1), and the SIA accuracy was 10% (i.e. equal to random guessing).
Communication Cost We also tested if adding DP affects the selection of the parameter 7 on the MNIST dataset (10 clients, 10 local epochs, 10 global epochs, 0.1). Table 12 shows that selecting r = 3 achieves comparable accuracy and r matches baseline accuracy (i.e. that of combining Vanilla FL with DP-SGD). In comparison, = 2 and 3 are necessary for Vanilla FL
34

---

Published as a conference paper at ICLR 2026
without DP. This means that adding DP slightly increases the communication cost, precision necessary to accurately depict the noisy parameters.
Table 12: Model Accuracy with different r on MNIST
Setting
No DP
E E=1
E
E
Baseline
98.2%
87%
88.46%
90.21%
Alg.
with r
12%
11%
11.48%
11.65%
Alg.
with 96.13%
70%
71.67%
75.94%
Alg.
with 3 98%
83.51%
84.72%
87.56%
Alg.
with
98.07%
85.95%
87.32%
89.83%
Alg.
with
98.12%
86.44%
88.07%
90.12%
In conclusion, the synergy offers the same privacy guarantees, albeit with a slightly higher communi- cation cost achieve baseline-level accuracy.
F.9 EXPANSION TO NON-SUM BASSED FUNCTIONS
Algorithm T reveals only the aggregated model, which works well with sum-based aggregation functions (e.g. FedAvg, FedSGD, FedProx). A natural question, however, arises: what if the central server wishes to compute something other than the sum the average? Consider, for example, FedMedian, where the server outputs the median of each parameter. To compute the median, the server needs access all the parameters, not just their sum. Thus, the threat of SIAs emerges again. Since model obfuscation is not feasible approach (cf. Appendix F). we must once more resort to our proposed method of Algorithm to provide protection.
Instead of shuffling the gradients of all n clients (as in Algorithm D we can group them into small groups (clusters) of k clients and shuffle the gradients within each group before sending them the server. From the analysis of Algorithm we know that only the uggregated group model is disclosed. For instance, with 10 and the FedMedian algorithm to these 5 aggregated groups (naturally, when k = this is the same as FedAvg). SIA can at most determine which group value belongs to, but not the specific client. The clients themselves can coordinate the formation of clusters by using secure channel (e.g. MPC) to decide which peers join each group. The central server remains oblivious to the client composition of every cluster. Therefore, learning the cluster which client belongs does not reveal any sensitive information.
the server receives shuffled groups. The server can then apply
We conducted preliminary experiments MNIST with 10, k selecting the clusters at random. The resulting model accuracy (97.2%) was nearly identical to vanilla FedMedian (=s 98%). Moreover, under this approach the SIA accuracy remained random-guesse levels (i.e. 10%). Thus, mixing as few as two clients' gradients might be sufficient to prevent SIAs, while still allowing the server to approximate the median using aggregated information from the small client groups
0.1, and 2,
We aim to further explore such approaches for other-sum-based functions part of future work.
35


Reviews:
[{"review_id": "rpABk20G9N", "reviewer": "Reviewer_79dB", "summary": "This paper investigate the defense against source inference attacks in FL in the shuffle model. On a high level, if the server knows a subset of the target client's training data, it can use that to identify the target client's share from the shuffled results it receives. To address this, the authors propose to do bit-level shuffling for each parameter of the client. The authors argue that this means that after reconstructing the server knows nothing more than the aggregated result. Empirical results demonstrate the effective of such defense.", "questions": "1. In the experiments, how are the coprimes set? Does this affect security?\n1. There are different levels of trust for the shuffler. This should be clarified and explained in a clearer way. If it is completely trusted, then we can send the model weights or bits in plaintext to the shuffler and trust it to perform shuffling. We can also only trust it to perform shuffling and then hide the plaintext weights or bits from it, i.e., it is a trusted shuffling router of encrypted messages (like Cloudfare). It can further be malicious where we would need ZKPs. In section 7, is the shuffler trusted? i.e., are the bits/models sent to the shuffler in plaintext and it shuffles without verification and sends the shuffled results to the server? I understand that we need an honest shuffler for the compression technique to work, but for the other experiments, is the shuffler also trusted? If we are encrypting messages to the shuffler, then doing more granular shuffling would means more overhead for the client and the server.\n1. Compared to secure aggregation, I understand that each client's message size do not increase with the number of clients, and the assumptions on the server/shuffler can be different. However, is the security guarantees the same? Does the shuffling with encoding scheme provide cryptographic semantic security? If so, its power shouldn't be limited to SIAs.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Interesting setting and important problem to study.\n1. Theoretical results on the security of the proposed shuffling algorithm.\n1. Comprehensive discussions on different trust models and different variations of the proposed method.\n1. A lot of experiments of different settings.\n1. Comparison to secure aggregation.", "weaknesses": "1. Unclear settings for the experiments in Section 7.\n1. I would like more clarification on the trust model of the shuffler.\n1. Discussions of the security of the proposed method beyond SIA.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "30giA5rfbJ", "reviewer": "Reviewer_kvmB", "summary": "This paper addresses Source Inference Attacks (SIAs) in Federated Learning (FL)—attacks where a central server identifies which client owns specific training data. It highlights that traditional defenses (e.g., Differential Privacy, regularization) and conventional shuffling (model-level, layer-level, parameter-level) fail to block SIAs without harming model accuracy.\nA new defense combining parameter-level shuffling and Residue Number System (RNS) is proposed: parameters are scaled, RNS-encoded, unary-encoded, bit-wise shuffled, then decoded/aggregated by the server. Validated on MNIST/CIFAR-10/CIFAR-100 with CNN/ResNet-18, it reduces SIA accuracy to random guessing, preserves model performance, integrates seamlessly into shuffle-model FL, and has controllable communication costs.\nKey Contributions:\n1. Identifies vulnerabilities of conventional shuffling via 3 reconstruction attacks.\n2. Proposes the first shuffle-model FL defense to neutralize SIAs (random-guess accuracy).\n3. Extends defense to resist Data Reconstruction Attacks.", "questions": "It is suggested to supplement the \"quantitative correlation analysis between RNS modulus selection, communication cost, and model accuracy\" and clarify the decision-making basis for the optimal modulus combination under different scenarios.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. First systematic defense against Source Inference Attacks (SIAs) in Federated Learning, introducing a novel parameter-level shuffling and RNS-based mechanism that reduces SIA accuracy to random guessing.\n2. Well-structured “problem–proposal–verification” format with clear explanations, visual aids, and comprehensive appendices.\n3. Addresses a core privacy challenge in cross-silo FL, offering compatible, low-cost protection against both SIAs and DRAs. Expands FL privacy theory and establishes a new paradigm for noise-free privacy amplification.", "weaknesses": "1. Lack of Discussion on Detailed Synergistic Optimization Between the Mechanism and Differential Privacy (DP)：\nThe paper claims that the proposed mechanism can be \"seamlessly integrated with other privacy mechanisms such as DP\" (meeting Specification S.2), yet it fails to verify the actual performance after integration or provide a specific integration scheme. DP requires adding noise to protect privacy, but the RNS encoding of the mechanism may interact with the noise distribution (e.g., noise could cause parameters to exceed the RNS encoding range). Additionally, the balance among \"privacy gain, accuracy loss, and communication cost\" after integration has not been quantified. As a result, this feature remains at the theoretical level and lacks practical guiding significance.\n2. Improvement: Design an integrated \"RNS + DP\" scheme where clients first add DP noise to parameters, followed by RNS encoding and shuffling. Test the SIA defense effect, model accuracy, and communication cost under different DP noise intensities (ε= 1, 2, 5) on the MNIST dataset to identify the optimal integration parameters (e.g., when ε= 2, the mechanism + DP can reduce the SIA accuracy to below 10% while maintaining 95% model accuracy).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EhFyfSFGtZ", "reviewer": "Reviewer_jeWK", "summary": "This paper studies source inference attacks (SIA) in cross-silo FL and argues that naïve shuffling at different granularity (model/layer/parameter) does not protect against a curious server equipped with a small shadow dataset. The authors then propose a hybrid encoding–shuffling defense: fixed-point quantization, RNS decomposition, unary encoding, and per-bit shuffling, aiming to leak only the aggregated sum. Experiments on CNN/ResNet over MNIST/CIFAR claim to suppress SIA to random chance without model degradation.", "questions": "1. What if the shadow data distribution does not match exactly?\n\n2. Can a server correlate updates across rounds and break anonymity?\n\n3. Comparison to threshold secure aggregation under the same drop-rate constraints?\n\n4. Does this work for Transformers/LLMs or non-image workloads?\n\n5. How realistic is the trusted shuffler assumption? Any decentralized variant?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Clearly identifies that basic shuffling in FL still leaks client identity.\n\n2. Proposes a new bit-level encoding + shuffling defense, not just adding noise.\n\n3. Shows strong privacy improvement with almost no accuracy loss.\n\n4. Provides both attack and defense experiments to support claims.", "weaknesses": "1. Shadow-dataset assumption is strong; needs sensitivity analysis under distribution shift.\n\n2. Relies on a trusted shuffler, not obvious in many deployments.\n\n3. No evaluation on text/LLM/tabular medical/time-series with only CV toy setups.\n\n4. Multi-round leakage not addressed (momentum, clipping signals, correlated updates).\n\n5. Communication claims hinge on compression + trust assumption, which is not apples-to-apples vs secure aggregation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7hmlmqyDVg", "reviewer": "Reviewer_nh8m", "summary": "This paper investigates source inference attacks (SIAs) in federated learning, where an honest-but-curious server aims to identify which client owns a given training sample, and proposes both new reconstruction attacks and a defense mechanism under the shuffle model. The authors first demonstrate that standard model-, layer-, and parameter-level shuffling are insufficient to prevent SIAs by designing effective remapping attacks. To counter these, they introduce a parameter-level bit-wise shuffling strategy combined with residue number system (RNS) encoding, which theoretically ensures that only aggregated information is revealed to the server and empirically reduces attack accuracy to random guessing while maintaining model performance. Extensive experiments on MNIST, CIFAR-10, and CIFAR-100 validate the approach, showing strong protection with reasonable communication overhead.", "questions": "1. How can the authors clearly differentiate the real contributions of this work from the previously submitted (under-review) reference [3]?\n2. Could the authors provide a quantitative analysis of the communication cost required to achieve lossless precision on the CIFAR-100 dataset?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper targets the relatively unexplored source inference attack (SIA) in federated learning, extending beyond traditional membership or gradient inversion attacks, and contributes both new attack formulations and corresponding defenses within the shuffle model framework.\n2. The authors provide a systematic exploration of reconstruction attacks at different granularities (model-, layer-, and parameter-level), clearly demonstrating the limitations of naive shuffling and motivating the need for a more fine-grained defense.\n3. Experimental results on multiple benchmarks (MNIST, CIFAR-10, CIFAR-100) show that the proposed method consistently reduces SIA success rates to the level of random guessing, while maintaining comparable accuracy and reasonable communication overhead.", "weaknesses": "1. The reconstruction attacks heavily rely on a shadow dataset that is directly obtained from the attacked clients or from data sources with a similar distribution. This assumption is impractical in most real-world scenarios, and moreover, it introduces severe privacy leakage risks in sensitive domains such as healthcare or finance. The paper should also provide a comprehensive analysis of the impact of shadow data quality, for example, when the shadow dataset does not come from the specific attacked client or exhibits significant distributional bias, or contains noisy data.\n2. The proposed attack and defense assumptions are overly idealized. The attacker is assumed to be an honest-but-curious server with a small shadow dataset, while the defense relies on the existence of a fully or partially trusted MixNet shuffler. Both assumptions seem contradicted or are difficult to guarantee in realistic federated learning settings.\n3. The limitations of numerical precision in encoding may significantly affect both model convergence and potential information leakage, especially in complex models or datasets. For example, in the CIFAR-100 experiments, achieving lossless precision requires several times higher communication overhead.\n4. All experimental datasets and models are designed for vision tasks, which limits the generalizability of the proposed approach to other modalities, such as medical tabular data.\n5. The proposed defense is only applicable to sum-based aggregation scenarios, which represents a major limitation given the existence of numerous non–sum-based secure aggregation algorithms designed to counter adversarial attacks.\n6. The aggregation formula of FedAvg mentioned around Line035 lacks mathematical rigor regarding aggregation weights.\n7. The overall paper structure could be improved. For example, Section 6.1 appears as the only subsection under Section 6.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)