arXiv:2609.08476v1 [cs.CR] 8 Sep 2026
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning Wenrui Yu
Changlong Ji
Johannes Bjerva
Qiongxiu Li∗
Aalborg University Copenhagen, Denmark [email protected]
Institut Polytechnique de Paris Paris, France [email protected]
Aalborg University Copenhagen, Denmark [email protected]
Aalborg University Copenhagen, Denmark [email protected]
Abstract Secure Aggregation (SA) is widely regarded as a strong defense against model-update leakage in Federated Learning (FL), as it reveals only aggregate results while hiding individual updates. In Decentralized Federated Learning (DFL), SA is commonly instantiated as local neighborhood aggregation, where each node obtains a weighted aggregate over its neighbors. We show that this locality creates a structural leakage surface: sparse decentralized topologies provide colluding semi-honest nodes with asymmetric aggregate views, exposing multiple hidden linear combinations of honest participants’ private states. Reconstructing private states from these aggregate views is fundamentally challenging, as both the private states and the aggregation coefficients are hidden. We tackle this challenge by establishing a formal connection to the Hidden Subset Sum Problem, a long-studied problem in cryptography. Building on this formulation, we design a lattice-based reconstruction approach that combines lattice reduction with structural filtering to reconstruct protected model states. We evaluate our attack on image, tabular, and text tasks under sparse DFL topologies. Our results show that colluding semi-honest nodes can recover the original local updates of honest nodes, enabling downstream reconstruction of private training data. These findings demonstrate that SA alone does not guarantee privacy in DFL when local aggregation induces asymmetric observations.
CCS Concepts • Security and privacy → Cryptanalysis and other attacks; Privacy-preserving protocols; • Computing methodologies → Distributed algorithms; Distributed artificial intelligence.
Keywords Lattice, Federated Learning, Distributed Computing, Secure Aggregation ACM Reference Format: Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li. 2026. When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure ∗ Corresponding author.
CCS ’26, The Hague, Netherlands. © 2026 Copyright held by the owner/author(s). This is the author’s version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS ’26), November 15–19, 2026, The Hague, Netherlands, https://doi.org/10.1145/3830454. 3846666.
Aggregation in Decentralized Federated Learning. In Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS ’26), November 15–19, 2026, The Hague, Netherlands. ACM, New York, NY, USA, 43 pages. https://doi.org/10.1145/3830454.3846666
1
Introduction
Federated Learning (FL) has gained significant attention as a paradigm for collaborative machine learning. Beyond centralized architectures, Decentralized Federated Learning (DFL) enables peer-topeer collaboration without relying on a central coordinator, thereby avoiding vulnerabilities such as a single point of failure and communication bottlenecks at the server side. Despite the privacy-centric design of FL, a growing body of literature, primarily focusing on centralized settings, has demonstrated that FL is not a panacea for data security and privacy. Various reconstruction attacks [16, 58, 67] have proven that private training data can be leaked through shared model updates. In the context of DFL, the privacy landscape is even more complex. While some studies suggest that DFL does not inherently offer superior security compared to centralized FL (CFL) [46], others argue that the peer-to-peer nature of DFL provides a privacy advantage via an information-theoretical perspective [24, 60]. Regardless of the underlying architecture (CFL or DFL), Secure Aggregation (SA) has emerged as the foundational defense mechanism to bolster privacy [3, 5, 51]. The prevailing intuition is that as long as a sufficient number of nodes are aggregated, individual contributions remain obscured within the collective sum. However, even in the more mature field of CFL, research shows that SA can be compromised by malicious servers or through specific partial participation patterns [45, 50]. The security guarantees of SA become even more tenuous when moved to a decentralized setting, where they lack rigorous analytical support. Unlike the star topology of CFL, DFL relies on localized, neighborhood-based aggregation governed by complex graph structures. Indeed, recent literature has begun to expose the shortcomings of existing DFL security proofs; for instance, Dekker et al. [14] point out the fallacious assumption in many works that "if a single summation is secure, the protocol remains secure across multiple training iterations." However, beyond these temporal vulnerabilities, DFL suffers from a more immediate structural vulnerability rooted in the network topology itself. The heterogeneous connectivity in DFL inherently creates uneven observational perspectives for colluding adversaries. This mismatch between the idealized algebraic symmetry expected by SA and the structural reality of DFL raises a critical question: Can
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
topology-induced observational asymmetry turn secure neighborhood aggregates into a solvable inverse problem? Although recent works have hinted at potential vulnerabilities in DFL-SA, current discussions remain limited to relatively restricted cases. An example is provided by [46], which demonstrates that model updates can be recovered if an adversary can intercept two specific aggregated values: one containing the honest node’s contribution and another that does not. We categorize this straightforward differencing as a trivial attack (see (7)). As the authors themselves acknowledged, a comprehensive "topology-aware" analysis is still lacking. Indeed, the security boundaries of SA in DFL have remained blurry for a long time; while the research community suspects inherent risks, there has been no systematic, generalized analysis to explain the precise conditions under which the privacy of SA can be systematically breached. In this paper, we provide a systematic study of this problem. By reformulating the DFL-SA process into a unified mathematical framework, we demonstrate that the privacy of honest nodes can be compromised through structural and algebraic analysis. Our main contributions are as follows: • Exploiting Structural and Observational Asymmetry: We reveal that the intrinsic sparsity of DFL networks leads to the observational asymmetry for corrupted nodes. We demonstrate that this structural heterogeneity allows colluding attackers to triangulate and expose the private features of honest nodes. • Unified Formulation via Lattice Challenges: We establish a formal connection between decentralized aggregation and the Hidden Subset Sum Problem (HSSP) - a wellestablished NP-hard challenge in lattice-based cryptography that involves recovering hidden coefficients from a weighted sum. By exploiting the inherent sparsity of DFL topologies, we reveal that neighborhood-based SA can be reduced to a multi-dimensional HSSP (or its generalization, the Hidden Linear Combination Problem). This unified formulation allows us to apply lattice basis reduction techniques to systematically deconstruct SA, enabling the reconstruction of private model updates in the first round, or for intermediate states in later rounds. • Extensive Empirical Validation: We validate our attack framework across diverse data modalities, including image, tabular, and text datasets. Our results demonstrate that the proposed framework successfully disentangles individual honest updates from the aggregated sum. We show that once these private model updates are recovered, they can be used as inputs to downstream gradient inversion attacks to reconstruct raw training samples, suggesting that current SA implementations in DFL may not provide additional privacy. The remainder of this paper is structured as follows. Section 2 establishes the fundamental concepts required and Section 3 presents the threat model. In Section 4, we present the problem formulation, in which the privacy inference task is cast into a unified matrix representation and mapped to the HSSP framework. Section 5 introduces the core lattice-based attack framework. This is followed by the optimized methodology detailed in Section 6. Section 7 provides extensive numerical results to validate the efficacy of our proposed
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
framework. Section 8 introduces the related work. Section 9 discusses the limitations of our analysis. Finally, Section 10 concludes the paper and discusses potential directions for future work.
2 Preliminaries 2.1 Notation Throughout this paper, we adopt the following notation: scalars are denoted by lowercase letters (𝑥), vectors by lowercase boldface letters (𝒙), and matrices by uppercase boldface letters (𝑿 ). The 𝑖-th entry of vector 𝒙 is denoted by 𝑥𝑖 , and the (𝑖, 𝑗)-th entry of matrix 𝑿 is denoted by 𝑋𝑖 𝑗 . We use (·) ⊤ to represent the transpose and | · | for the cardinality of a set. The symbols 0, 1, and 𝑰 refer to the all-zero vector, the all-one vector, and the identity matrix of appropriate dimensions, respectively. Additionally, the superscript (·) (𝑡 ) indicates the value of a variable at the 𝑡-th iteration. The Euclidean norm is denoted by ∥ · ∥ and ⟨·, ·⟩ denotes the standard inner product.
2.2
Decentralized Federated Learning
2.2.1 Formulation. In a standard machine learning setting, the primary objective is to find optimal model parameters 𝒙 ∈ R𝑑 that minimize the expected loss over a data distribution D. This can be formulated as an Expected Risk Minimization problem min 𝑓 (𝒙) := E𝜉∼D [ℓ (𝒙, 𝜉)], 𝒙
where 𝑓 (𝒙) denotes the expected loss over the data distribution D and ℓ (·, ·) denotes the loss function that quantifies the discrepancy between the model’s prediction and the ground truth for a data sample 𝜉. In the context of FL, data is not centrally stored but distributed across a set of nodes/clients V = {1, 2, . . . , 𝑛}. Each node 𝑖 ∈ V has access only to its local data distribution D𝑖 . So the global objective can be expressed as minimizing the average of the local loss functions min 𝐹 (𝒙) := 𝒙
1 ∑︁ 𝑓𝑖 (𝒙), |V | 𝑖 ∈ V
where 𝑓𝑖 (𝒙) := E𝜉∼D𝑖 [ℓ (𝒙, 𝜉)].
Further, for DFL, nodes communicate through a peer-to-peer network without the coordination of a central server. We represent the network topology as a graph G = (V, E), which can be either undirected or strongly connected directed to ensure convergence, where V denotes the set of nodes and E ⊆ V × V denotes the set of communication links. A link (𝑖, 𝑗) ∈ E indicates that there exists a directed connection from node 𝑖 to node 𝑗. We also define the set of in-neighbors of 𝑖 as N𝑖𝑖𝑛 = { 𝑗 | ( 𝑗, 𝑖) ∈ E }, and the set of out-neighbors of 𝑖 as N𝑖𝑜𝑢𝑡 = { 𝑗 | (𝑖, 𝑗) ∈ E }. The number of in-neighbors and out-neighbors of node 𝑖 is represented as 𝑑𝑖𝑖𝑛 = |N𝑖𝑖𝑛 | and 𝑑𝑖𝑜𝑢𝑡 = |N𝑖𝑜𝑢𝑡 | respectively. For the undirected graph, we have N𝑖 = N𝑖𝑖𝑛 = N𝑖𝑜𝑢𝑡 and 𝑑𝑖 = 𝑑𝑖𝑖𝑛 = 𝑑𝑖𝑜𝑢𝑡 . To solve the global optimization problem in a decentralized manner, each node 𝑖 maintains its own local copy of the model parameters 𝒙𝑖 . So the DFL problem can be equivalently formulated with
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
consensus constraints as 1 ∑︁ min 𝑓𝑖 (𝒙𝑖 ), {𝒙𝑖 :𝑖 ∈ V } |V | 𝑖∈V s.t. 𝒙𝑖 = 𝒙 𝑗 , ∀(𝑖, 𝑗) ∈ E, where the constraints 𝒙𝑖 = 𝒙 𝑗 ensure that all nodes in the network converge to a common global model. 2.2.2 Common Paradigm. The prevalent paradigm in DFL is primarily based on the average aggregation mechanism [46]. This process can be generally decomposed into two sequential steps: 1) local update and 2) neighborhood aggregation. In the local update step, in each iteration 𝑡, every node 𝑖 ∈ V first performs a local computation step (e.g., gradient descent) to update its local model parameters based on its private dataset D𝑖 : (𝑡 + 12 )
∀𝑖 ∈ V : 𝒙𝑖
= 𝒙𝑖(𝑡 ) + Δ𝒙𝑖(𝑡 ) ,
(1)
where Δ𝒙𝑖(𝑡 ) represents the local update increment, typically involving the local gradient −𝜇∇𝑓𝑖 (𝒙𝑖(𝑡 ) ), where 𝜇 is the learning rate, or multiple local SGD steps. Also, following the standard practice in federated learning [37], all nodes are initialized with identical weights to ensure a consistent starting point for the optimization process, such that 𝒙 1(0) = 𝒙 2(0) = · · · = 𝒙𝑛(0) . Following the local update, nodes transmit their parameters to their (out-)neighbors to achieve consensus. This communication and mixing process is governed by a weight matrix 𝑾 (𝑡 ) ∈ Q𝑛×𝑛 ∩ [0, 1] 𝑛×𝑛 . 1 To respect the network topology, 𝑾 (𝑡 ) must belong to the set of matrices W defined by the graph’s connectivity n o W = 𝑾 (𝑡 ) ∈ Q𝑛×𝑛 | 𝑊𝑖 (𝑡𝑗 ) = 0 if ( 𝑗, 𝑖) ∉ E and 𝑖 ≠ 𝑗 . (2) Then the global aggregation step can be expressed in a compact matrix form 1
𝑿 (𝑡 +1) = 𝑾 (𝑡 +1) 𝑿 (𝑡 + 2 ) ,
(3)
where 𝑿 (𝑡 ) = [𝒙 1(𝑡 ) , . . . , 𝒙𝑛(𝑡 ) ] ⊤ ∈ R𝑛×𝑑 concatenates the local parameters of all nodes. In fact, the convergence of DFL algorithms heavily relies on the spectral properties of 𝑾 (𝑡 ) . For undirected graphs, most existing work [28, 34, 57, 61] assumes that 1) 𝑾 (𝑡 ) is doubly stochastic (and often symmetric), i.e., 𝑾 (𝑡 ) 1 = 1 and 1⊤𝑾 (𝑡 ) = 1⊤ . 2) ⊤
𝜌 𝑾 (𝑡 ) − 11𝑛 < 1, where 𝜌 (·) denotes the spectral radius. This condition ensures that the local models contract toward the global average at a geometric rate [44]. For scenarios involving directed graphs, where the communication links are not necessarily bi-directional, a doubly stochastic matrix may be difficult or impossible to construct. A few recent works, such as [2, 33], employ the Push-Sum algorithm [27] to handle such topologies. However, regardless of whether a standard consensus or a Push-Sum-based mechanism is employed, the fundamental update paradigm remains structurally consistent with the linear mixing form in (3), as we explain in Appendix A. For the sake of brevity and clarity, we will adopt this unified representation in the subsequent sections of this paper to describe the general decentralized aggregation process. 1We assume rational weights instead of real-valued ones, which aligns with the practi-
cal setting adopted in most existing implementations.
2.2.3 Temporal Dynamics of the Weight Matrix. In the majority of DFL literature, the weight matrix is typically assumed to be static, meaning 𝑾 (𝑡 ) = 𝑾 for all iterations 𝑡. From a physical perspective, this assumption implies that the network topology is invariant and that all participating nodes engage in the aggregation process in every round with constant mixing weights. This static assumption does not always hold in practice. For instance, asynchronous updates [14, 25] or time-varying topologies [31] can result in a dynamic weight matrix 𝑾 (𝑡 ) that evolves over time. 2.2.4 (Approximated) Gradient Inversion Attack. Gradient Inversion Attack (GIA) is a potent privacy threat in FL, where an adversary aims to reverse-engineer private local datasets by intercepting the information exchanged during training. Recent systematizations provide comprehensive analyses of GIA threat models and attack mechanisms [7, 20]. The underlying intuition of GIA is that the shared model updates (gradients or gradient-related increments) may encode rich information about the local training samples. Formally, given the local update Δ𝒙𝑖(𝑡 ) from node 𝑖, the attacker attempts to reconstruct the private dataset D𝑖 by solving a constrained optimization problem (𝑡 ) (𝑡 ) arg min Dist Δ𝒙 , Δ̂𝒙 , 𝑖 𝑖 ′ D
where D ′ is the dummy dataset, Δ̂𝒙𝑖(𝑡 ) is the update generated by the dummy data, Dist is a distance metric, such as Euclidean distance [67] or cosine similarity [16] between the observed update Δ𝒙𝑖(𝑡 ) and the update generated by the dummy data Δ̂𝒙𝑖(𝑡 ) . Existing literature has explored numerous variants of GIA, ranging from early methods targeting single-batch gradients [16, 66, 67] to more complex approximated attacks [22, 52, 58] capable of handling multiple local steps or aggregated updates. In fact, the efficacy of any GIA variant fundamentally relies on the attacker’s ability to process the obtained Δ𝒙𝑖(𝑡 ) . In this work, our focus remains on the structural exploitability of the communication protocol. Specifically, we investigate the extent to which an adversary can intercept or reconstruct Δ𝒙𝑖(𝑡 ) when it is shielded by SA primitives, rather than focusing on the refinement of the GIA algorithm itself. GIA is therefore used as a downstream instantiation to demonstrate the privacy consequences of exposing individual updates. For clarity, we first consider a standard singlestep SGD update [16], ∑︁ 1 Δ𝒙𝑖(𝑡 ) = −𝜇𝒈𝑖(𝑡 ) , with 𝒈𝑖(𝑡 ) = (𝑡 ) ∇ℓ (𝒙𝑖(𝑡 ) , 𝜉), |B𝑖 | (𝑡 ) 𝜉 ∈ B𝑖
where B𝑖(𝑡 )
⊆ D𝑖 is the mini-batch of private samples. So the leakage of Δ𝒙𝑖(𝑡 ) directly exposes the batch-averaged gradient.
2.3
Secure Aggregation in Decentralized Network
In a decentralized setting, for each node 𝑖, the objective of SA is to compute the weighted sum of updates from its (in)-neighbors N𝑖𝑖𝑛 (𝑡 + 1 )
without revealing the weight 𝑊𝑖 𝑗 and the specific vector 𝒙 𝑗 2 of any individual neighbor 𝑗 ∈ N𝑖𝑖𝑛 . Following (2) and the global aggregation representation in (3), the protocol aims to output the
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
weighted result at node 𝑖: (𝑡 + 12 )
∑︁
𝒙𝑖(𝑡 +1) =
𝑊𝑖 𝑗 𝒙 𝑗
.
(4)
𝑗 ∈ N𝑖𝑖𝑛 ∪{𝑖 }
Under this formulation, the decentralized SA problem can be viewed as a series of local instances of the SA in centralized FL. Consequently, established protocols from centralized FL can be migrated and adapted to the decentralized topology [46]. Each node 𝑖 effectively executes a SA protocol with its direct neighborhood, treating its (in)-neighbors as "clients" and itself as the "local server". While this framework theoretically provides a layer of privacy by "shrouding" individual updates within the weighted sum (4), we will demonstrate in the following sections that this structural dependency on the topology introduces vulnerabilities that can be exploited for data reconstruction for exact local neighborhood SA protocols that reveal aggregate states to corrupted participants.
2.4
Fundamentals of Hidden Subset Sum Problem
The formal definitions of the HSSP and HLCP problem are Definition 1 (Hidden Subset Sum Problem [18]). Let 𝑄 be 𝑁 be a set of unknown secret a positive integer modulus and {𝑥𝑖 }𝑖=1 integers in Z𝑄 . Let 𝜶 1, . . . , 𝜶 𝑁 ∈ {0, 1}𝑀 be 𝑁 unknown binary 𝑀 that vectors. Given 𝑄 and an observed vector 𝒉 = (ℎ 1, . . . , ℎ𝑀 ) ∈ Z𝑄 satisfies: 𝑁 ∑︁ 𝒉≡ 𝑥𝑖 𝜶𝑖 (mod 𝑄), 𝑖=1 𝑁 and the binary vectors {𝜶 } 𝑁 , the HSSP is to recover the secret {𝑥𝑖 }𝑖=1 𝑖 𝑖=1 up to a permutation of the indices 𝑖 ∈ {1, . . . , 𝑁 }.
Definition 2 (Hidden Linear Combination Problem (HLCP) [18]). 𝑁 be a set of unknown Let 𝑄 be a positive integer modulus and {𝑥𝑖 }𝑖=1 secret integers in Z𝑄 . Let 𝜶 1, . . . , 𝜶 𝑁 ∈ {0, 1, · · · , 𝑐}𝑀 be 𝑁 unknown vectors for a given 𝑐 ∈ N+ . Given 𝑄 and an observed vector 𝑀 that satisfies: 𝒉 = (ℎ 1, . . . , ℎ𝑀 ) ∈ Z𝑄 𝒉≡
𝑁 ∑︁
𝑥𝑖 𝜶𝑖
(mod 𝑄),
𝑖=1 𝑁 and the vectors {𝜶 } 𝑁 , up the HLCP is to recover the secret {𝑥𝑖 }𝑖=1 𝑖 𝑖=1 to a permutation of the indices 𝑖 ∈ {1, . . . , 𝑁 }.
We further extend the HSSP and HLCP to the case where the secrets are multidimensional. Definition 3 (Multidimensional Hidden Subset Sum Prob𝑁 lem (mHSSP) [32]). Let 𝑄 be a positive integer modulus and {𝒙𝑖 }𝑖=1 𝑢 𝑀 be 𝑁 unknown secret vectors in Z𝑄 . Let 𝜶 1, . . . , 𝜶 𝑁 ∈ {0, 1} be 𝑁 unknown binary vectors. For each dimension 𝑗 ∈ {1, . . . , 𝑢}, let 𝑀 be an observed sample vector satisfying: 𝒉 𝑗 ∈ Z𝑄
𝑁 and the binary vectors {𝜶 } 𝑁 , up to a common pervectors {𝒙𝑖 }𝑖=1 𝑖 𝑖=1 mutation of the index 𝑖. The problem can be expressed more compactly in matrix form. Let 𝑁 ×𝑢 and 𝑨 = [𝜶 , . . . , 𝜶 ] ∈ {0, 1}𝑀 ×𝑁 . 𝑿 = [𝒙 1, . . . , 𝒙 𝑁 ] ⊤ ∈ Z𝑄 1 𝑁 The mHSSP is then characterized by the relation:
𝑯 ≡ 𝑨𝑿
(mod 𝑄).
Analogously, the Multidimensional Hidden Linear Combination Problem (mHLCP) follows the same definition, with the exception that the entries of 𝑨 are drawn from {0, . . . , 𝑐} for some 𝑐 ∈ N+ .
3
Threat Model
In this study, we consider local neighborhood SA protocols, where a corrupted receiver observes only its post-aggregation state together with its own and colluding nodes’ states, while individual honest contributions and their exact coefficients remain hidden. The attack assumes access to aggregate outputs over a finite field. We consider a set of honest-but-curious (semi-honest) nodes, denoted by V𝑐 , which follow the prescribed training and SA protocols but collude by sharing their locally observed information. The adversaries aim to infer the private states of the honest participants Vℎ , with the goal of reconstructing their intermediate (𝑡 + 21 )
model parameters 𝒙ℎ
, which are intended to be protected by (𝑡 + 1 )
the SA mechanism. These local parameters 𝒙𝑖 2 (and the corresponding updates Δ𝒙𝑖(𝑡 ) ) are highly sensitive, as they encode rich information about the underlying training data. As demonstrated in Section 2.2.4, such information can be leveraged to reconstruct raw training samples with high fidelity. Formally, for all iterations 𝑡 ∈ T , where T = {0, 1, . . . , 𝑡 max − 1}, the minimum collective information set available to the adversaries is defined as n o n o (𝑡 + 12 ) (0) (𝑡 ) O ≔ 𝒙𝑖 ∪ 𝒙𝑖 , 𝒙𝑖 ∪ 𝑊𝑖 (𝑡𝑗 +1) . 𝑖∈V
𝑖,𝑗 ∈ V𝑐 , 𝑡 ∈ T
𝑖 ∈ V𝑐 , 𝑡 ∈ T
(5) This set captures the adversaries’ local states before and after aggregation, their mutual weights, and the globally shared initialization (cf. Section 2.2.2). Beyond this baseline information, the adversary may possess varying degrees of topological metadata depending on the specific SA protocol in use. We categorize this prior knowledge into three hierarchical scenarios: • Case 1: Full Neighbor Awareness (Identity-Aware). In this scenario, each corrupted node 𝑖 ∈ V𝑐 knows the exact global identities (indices 𝑗) of its incoming neighbors. By colluding, adversaries can cross-reference these indices to reconstruct the local adjacency structure. The information set in this case is augmented by the support of the weight matrix O ≔ O ∪ 1 {𝑊𝑖 𝑗 >0} 𝑖 ∈ V ,𝑗 ∈ V , 𝑐
𝒉𝑗 ≡
𝑁 ∑︁
𝑥𝑖,𝑗 𝜶𝑖
(mod 𝑄),
𝑖=1
where 𝑥𝑖,𝑗 is the 𝑗-th component of vector 𝒙𝑖 . Given 𝑄 and the sample 𝑀 ×𝑢 , the goal is to recover the secret matrix 𝑯 = [𝒉 1, . . . , 𝒉𝑢 ] ∈ Z𝑄
where 1 { · } is the indicator function. This allows the adversary to pinpoint which honest nodes’ parameters are involved in their specific aggregation. • Case 2: Partial Awareness (Degree-Only). Each corrupted node 𝑖 ∈ V𝑐 is aware of its in-degree 𝑑𝑖𝑖𝑛 (i.e., the number of
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
nodes it aggregates from) but cannot map these neighbors to specific global identities. Since identities are masked, colluding adversaries cannot link their local observations to form a global map. The additional knowledge is restricted to the cardinality of the neighbor sets O ≔ O ∪ 𝑑𝑖𝑖𝑛 𝑖 ∈ V . 𝑐
• Case 3: Zero Awareness. The SA protocol provides no information regarding the identities or the quantity of incoming neighbors. The three cases correspond to different real-world implementations, as detailed in Appendix B.
4
Problem Formulation
In this section, we first establish a unified matrix formulation for the inference problem. Building upon this, we propose a topologyaware reduction method to further simplify the model by stripping away redundant connections. Finally, we map the resulting matrix structure of the core sub-graph to the HSSP framework for joint reconstruction.
4.1
Matrix Representation
By analyzing the global model evolution from the adversarial perspective, we characterize the resulting privacy leakage as an algebraically decoupled linear inverse problem. We partition the weight matrix 𝑾 (𝑡 ) according to the indices of corrupted nodes V𝑐 and honest nodes Vℎ . Without loss of generality, assuming the first |V𝑐 | rows/columns correspond to V𝑐 , 𝑾 (𝑡 ) is partitioned as: ! (𝑡 ) 𝑾𝑐𝑐(𝑡 ) 𝑾𝑐ℎ (𝑡 ) 𝑾 = (𝑡 ) , 𝑾ℎ𝑐(𝑡 ) 𝑾ℎℎ (𝑡 ) (𝑡 ) where 𝑾𝑐𝑐(𝑡 ) and 𝑾ℎℎ represent internal weights, while 𝑾𝑐ℎ and
𝑾ℎ𝑐(𝑡 ) represent cross-group influences. Let 𝑿𝑐(𝑡 ) and 𝑿ℎ(𝑡 ) denote the model parameters held by the respective node sets, we summarize this structural reduction in the following proposition. Proposition 1. Given the adversarial observation set O, the global aggregation process over 𝑡 max iterations can be algebraically decoupled into independent round-wise linear systems. Specifically, for any iteration 𝑡 ∈ T , the privacy inference of honest states reduces to solving the core sub-problem: 1 (𝑡 + 1 ) (𝑡 +1) (𝑡 + 2 ) ∀𝑡 ∈ T : 𝑾𝑐ℎ 𝑿ℎ = 𝑿𝑐(𝑡 +1) − 𝑾𝑐𝑐(𝑡 +1) 𝑿𝑐 2 ,
(6)
where the right-hand side consists entirely of information accessible to the adversaries. The adversary’s capability differs across iterations. At 𝑡 = 0, the adversary can exactly recover the local updates Δ𝒙𝑖(0) for all 𝑖 ∈ Vℎ , due to the globally known initialization. For 𝑡 ≥ 1, (𝑡 + 12 )
the adversary can recover the intermediate states 𝑿ℎ
but cannot
determine the corresponding updates Δ𝒙𝑖(𝑡 ) , as reconstructing 𝑿ℎ(𝑡 ) (𝑡 +1) requires access to the internal weights 𝑾ℎ𝑐(𝑡 +1) and 𝑾ℎℎ , which are not observable. Therefore, exact gradient reconstruction is only possible at 𝑡 = 0, which is sufficient for the downstream attack considered in this work.
Proof. See Appendix C.
□
4.2
Topology-aware Simplification
By inspecting (6), it is evident that the reconstruction of honest (𝑡 + 12 )
states 𝑿ℎ
depends heavily on the structure and properties of
(𝑡 +1) 𝑾𝑐ℎ . In decentralized networks, the sparsity of the graph often dictates that the global inference task is not a single monolith, but rather a collection of loosely coupled or even isolated sub-problems. The motivation for simplifying the problem based on topology is two-fold. First, the computational complexity of the HSSP attack is highly sensitive to the number of unknown honest variables (|Vℎ |). By decomposing the graph into smaller sub-components, we can significantly reduce the search space for the lattice-based solver. Second, specific topological configurations allow for trivial reconstructions that do not require complex solvers. To systematically reduce the problem size, we classify nodes into three categories based on their neighborhood connectivity. We begin our discussion with undirected graphs, noting that the logic naturally extends to directed graphs with minor adjustments to the weight constraints.
4.2.1 Undirected Graph. As also noted in [14], secure summation is vulnerable if a corrupted node has only one honest neighbor. In a weighted aggregation setting, this vulnerability persists as such trivial attack. If a corrupted node 𝑖 has exactly one honest neigh(𝑡 + 1 )
bor 𝑗, the adversary can directly compute 𝒙 𝑗 2 by subtracting the contributions of its corrupted neighbors and itself from the aggregated result, i.e., Í (𝑡 + 1 ) 𝒙𝑖(𝑡 +1) − 𝑘 ∈ ( N𝑖 ∩V𝑐 )∪{𝑖 } 𝑊𝑖𝑘(𝑡 +1) 𝒙𝑘 2 (𝑡 + 12 ) 𝒙𝑗 , = 𝑊𝑖 (𝑡𝑗 +1)
(7)
Í where𝑊𝑖 (𝑡𝑗 +1) = 1− 𝑘 ∈ ( N𝑖 ∩V𝑐 )∪{𝑖 } 𝑊𝑖𝑘(𝑡 +1) due to the row-stochastic property of 𝑾 (𝑡 +1) . Thus, corrupted nodes 𝑖 ∈ V𝑐 can be categorized into three types based on their honest neighborhood N𝑖 ∩ Vℎ : • If |N𝑖 ∩ Vℎ | = 0, the node provides no extra information about honest participants, as its observations are entirely determined by other corrupted nodes. • If |N𝑖 ∩ Vℎ | = 1, the state of its sole honest neighbor can be uniquely and directly recovered via (7). • If |N𝑖 ∩Vℎ | ≥ 2, the local observation at node 𝑖 is individually underdetermined. This categorization is applicable to both Case 1 and 2, since the knowledge of 𝑑𝑖𝑖𝑛 allows it to determine the exact number of honest contributors. Correspondingly, from the perspective of each independent honest node 𝑖 ∈ Vℎ , its exposure risk within a single iteration is determined as • If there exists at least one corrupted neighbor 𝑗 ∈ V𝑐 such that 𝑖 is its only honest neighbor (|N𝑗 ∩ Vℎ | = 1), node 𝑖 is compromised by a trivial attack. • If the node has no corrupted neighbors (N𝑖 ∩ V𝑐 = ∅), its information cannot be leaked to the adversary within a single iteration, as DFL updates only propagate to immediate neighbors in one hop. • Otherwise, its privacy depends on the resolvability of the resulting HSSP attack.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Based on these classifications, the network can be simplified into a reduced bipartite graph, as illustrated in Figure 1(a), by stripping away redundant or trivial connections. In this refined structure, red dashed lines represent communication between corrupted nodes, which is fully transparent to the adversaries. Conversely, black dashed lines denote internal interactions among honest nodes that remain inaccessible to the adversaries within a single iteration. The red solid lines highlight "trivial" links where an honest node serves as the sole neighbor of an adversary; the privacy states of these nodes are directly reconstructed and subsequently removed from the inference set. Finally, the yellow solid lines constitute the core sub-graph, where each corrupted node is coupled with multiple honest neighbors. This reduced structure represents the minimal and most challenging form of the inference problem. 2
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
DFL are rational numbers constrained within [0, 1), the adversary can still narrow down the possible values. By identifying the least common denominator of the potential weights (see Section 4.3), the adversary can restrict the honest node’s privacy state to a finite set of candidate solutions. This "directed trivial attack" yields a discrete solution space rather than a unique value. Figure 1(b) illustrates the simplification of a directed graph. We use the arrow to signify the direction of information flow. Edges from corrupted nodes to honest nodes do not provide useful observations for inferring honest states at corrupted receivers (represented by the grey line). The red solid line indicates scenarios where a directed trivial attack can be executed to obtain a finite solution set.
4.3
Connection to HSSP
Following the topological simplification process, the task reduces to a matrix decomposition inverse problem. In this subsection, we establish a formal reduction showing that localized aggregation in DFL can be formulated as solving a lattice-based cryptographic problem.
Figure 1: Example of (a) undirected graph and (b) directed simplification. For an undirected graph, red dashed lines denote transparent intra-adversary communication; black dashed lines represent inaccessible intra-honest interactions. Red solid lines highlight trivial links for direct reconstruction, while yellow solid lines identify the core sub-graph targeted for HSSP-based inference. For a directed graph, arrows indicate the direction of information flow. Grey solid arrows represent information flowing from corrupted nodes to honest nodes, providing no utility for inference, and other symbols are consistent with the undirected graph. 4.2.2 Directed Graph. We assume the directed graph is strongly connected, as this is a necessary condition for achieving consensus. Strong connectivity ensures that information flow covers the entire network, implying that every node possesses at least one in-neighbor and one out-neighbor. While the simplification logic for directed graphs parallels that of undirected graphs, several distinctions need to be addressed. First, the classification of corrupted nodes must focus exclusively on their in-neighbors, as these represent the direction of information flow from honest participants to the adversaries. Second, unlike undirected protocols, directed graph algorithms typically do not satisfy the row-stochastic constraint. Consequently, even if a corrupted node has exactly one honest in-neighbor, its privacy states cannot always be uniquely recovered because the precise weight is unknown. However, since weights in 2 As any arbitrary graph can be systematically decomposed through this methodology, we adopt the convention that all graphs discussed hereafter are the simplified core sub-graphs. This simplification allows us to focus the analysis on the fundamental solvability of the HSSP-based attack within the most difficult components of the network.
Theorem 1. Let the continuous linear system 𝒀 = 𝑾𝑐ℎ 𝑿ℎ denote the core sub-problem after topological pruning, where 𝒀 ∈ R𝑀 ×𝑢 is the known adversarial observation matrix, 𝑾𝑐ℎ ∈ Q𝑀 ×𝑁 is the hidden weight matrix, and 𝑿ℎ ∈ R𝑁 ×𝑢 encapsulates the unknown private honest states. Under the conditions of: ˜ = (1) There exists a known scaling integer 𝛽 ∈ Z+ such that 𝑾 𝛽𝑾𝑐ℎ ∈ Z𝑀 ×𝑁 . (2) The honest states can be mapped exactly into the integer domain using a precision factor 𝛾, yielding 𝑿˜ ℎ = 10𝛾 𝑿ℎ ∈ Z𝑁 ×𝑢 .3 (3) The scaled integer weights 𝑊˜ 𝑖 𝑗 are bounded within a known discrete set C ⊂ Z. ˜ and state 𝑿˜ℎ Then the recovery of the hidden scaled weight matrix 𝑾 from the aggregated observations can be formulated as an instance of mHSSP if C ⊆ {0, 1}, or mHLCP if C ⊆ {0, 1, . . . , 𝑐} for some integer 𝑐 ≥ 2. Proof. See Appendix D.
□
Theorem 1 establishes the algebraic framework of the attack. However, whether the adversary can uniquely recover the groundtruth solution from the resulting system critically depends on the information diversity induced by the network topology. Remark 1 (Topological Asymmetry). The unique identifiability of the honest nodes’ private states is governed by the rank of the joint observation matrix. Within the minimal core sub-graph, all "trivial" instances have already been resolved and removed; the remaining system consists of honest nodes whose states are coupled. A prerequisite for identifying a unique solution is that the resulting system must not be underdetermined. Mathematically, this imposes a structural necessity: the number of independent observations (corrupted nodes) 3We consider the idealized setting in which the integer-domain conversion is exact
here. The truncation errors introduced by finite-precision conversion are addressed in Section 4.4.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
must be at least equal to the number of hidden variables (honest nodes) within the core sub-graph, i.e., |V𝑐 | ≥ |Vℎ |. While this node cardinality is a necessary condition, topological asymmetry is the essential catalyst that ensures the system is not rank-deficient. In a perfectly symmetric network, such as a fully connected graph with uniform weights (e.g., [65]), all adversaries share redundant observational vantage points. This causes the rows of 𝑾𝑐ℎ to be linearly dependent, resulting in a rank-deficient system (rank = 1) where a unique solution to the HSSP cannot exist regardless of the number of adversaries. Conversely, the heterogeneous neighborhood structures and non-uniform weights inherent in practical DFL break this symmetry. This observational diversity ensures that colluding adversaries capture linearly independent projections of the honest nodes’ states, allowing 𝑾𝑐ℎ to achieve the full column rank necessary for a unique and deterministic reconstruction.
4.4
Finite-Precision Reduction to Noisy mHSSP/mHLCP
Theorem 1 focuses on settings in which the aggregation process admits an exact integer-domain representation. This condition is satisfied when the protocol operates directly over an integer or finite-field domain, or when all represented states lie exactly on a prescribed fixed-point grid. In practical finite-precision implementations, rounding and truncation may introduce a bounded numerical mismatch. Define the scalar integerization operator 𝑞𝛾 (𝑧) = trunc(10𝛾 𝑧), where trunc(·) denotes truncation operation. For a matrix 𝒁 , 𝑞𝛾 (𝒁 ) denotes the element-wise application of 𝑞𝛾 . Let 𝒀˜ = 𝑞𝛾 (𝛽𝒀 ) and 𝑿˜ ℎ = 𝑞𝛾 (𝑿ℎ ). We ues 𝑬 to represent the aggregate numerical residual. Then the finite-precision observation therefore satisfies ˜ 𝑿˜ ℎ + 𝑬 (mod 𝑄). 𝒀˜ ≡ 𝑾 (8) The residual 𝑬 jointly captures the numerical errors introduced by finite-precision aggregation and by the integerization of the aggregate and local states. This reformulation recasts the reconstruction problem as a noisy mHSSP/mHLCP instance.
5
HSSP and attacks
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
The parameter 𝑁 denotes the rank of the lattice, which is also represented as dim(L). When 𝑁 = 𝑀, the lattice is referred to as full-rank. The lattice can be expressed compactly as L (𝑩) = {𝑩 · 𝒙 : 𝒙 ∈ Z𝑁 }, where matrix 𝑩 ∈ R𝑀 ×𝑁 comprises the basis vectors 𝒃1, . . . , 𝒃𝑁 as its columns. In this work, we focus on integer lattices, i.e., sublattices of Z𝑀 . Given a lattice L ⊆ Z𝑀 , it is useful to consider the following concept. Definition 5 (Orthogonal Lattice). For an integer lattice L ⊆ Z𝑀 , its orthogonal lattice L ⊥ is defined by L ⊥ := {𝒚 ∈ Z𝑀 : ∀𝒙 ∈ L, ⟨𝒙, 𝒚⟩ = 0}. Furthermore, the orthogonal lattice modulo 𝑄 is defined as L𝑄⊥ := {𝒚 ∈ Z𝑀 : ∀𝒙 ∈ L, ⟨𝒙, 𝒚⟩ ≡ 0
(mod 𝑄)}.
The lattice completion L̄ is defined as L̄ = SpanR (L) ∩ Z𝑀 = (L ⊥ ) ⊥ . Definition 6 (Shortest Vector and Successive Minima). The length of the shortest non-zero vector 𝒗 in L is the first minimum, denoted as 𝜆1 (L) = ∥𝒗 ∥. More generally, for a lattice of rank 𝑁 , the 𝑖-th successive minimum 𝜆𝑖 (L) is the smallest radius 𝑟 such that the closed ball of radius 𝑟 centered at the origin contains at least 𝑖 linearly independent lattice vectors, for 𝑖 ∈ {1, 2, · · · , 𝑁 }. Following these definitions, lattice basis reduction algorithms are important tools for addressing cryptographic challenges such as HSSP, where they are used to recover short vectors corresponding to hidden structures. The prominent techniques are briefly summarized as follows: • LLL Algorithm: Proposed by Lenstra, Lenstra, and Lovász [30], this polynomial-time algorithm transforms an arbitrary lattice basis into an LLL-reduced basis. Such a basis consists of relatively short, nearly orthogonal vectors, which significantly simplifies tasks such as finding the shortest lattice vector. • BKZ Algorithm: The Block Korkine-Zolotarev (BKZ) algorithm [9] generalizes LLL by performing basis reduction on blocks of size 𝑘. It offers a tunable trade-off, where larger block sizes provide higher reduction quality (i.e., closer to the shortest vector) at the cost of increased computational effort. While BKZ with the lowest block size 𝑘 = 2 runs in polynomial time, finding the absolute shortest vector generally requires exponential time with full block size.
In this section, we provide an introduction to HSSP attack and the fundamental concepts essential to the proposed attack framework.
5.2
5.1
Based on LLL and BKZ algorithm, the Nguyen-Stern (NS) attack framework [41] is a cornerstone technique for solving HSSP. The attack is executed in two primary phases.
Lattice Fundamentals
A lattice L in R𝑀 is a discrete additive subgroup formed by the integer linear combinations of a set of basis vectors. It is defined as [8, 38]: Definition 4 (Lattice). Given a set of 𝑁 linearly independent vectors {𝒃1, . . . , 𝒃𝑁 } in R𝑀 (where 𝑀 ≥ 𝑁 ), the lattice L generated by these vectors is the set: (𝑁 ) ∑︁ L (𝒃1, . . . , 𝒃𝑛 ) = 𝑥𝑖 𝒃𝑖 : 𝑥𝑖 ∈ Z, 𝑖 = 1, . . . , 𝑁 . 𝑖=1
The Nguyen-Stern Attack for HSSP and mHSSP
Step 1: This phase aims to identify the orthogonal lattice associated with the hidden coefficient matrix 𝑨 = [𝜶 1, . . . , 𝜶 𝑁 ] in Í𝑁 Definition 1. Given the observed vector 𝒉 ≡ 𝑖=1 𝑥𝑖 𝜶𝑖 (mod 𝑄), the attack begins by constructing the orthogonal lattice modulo 𝑄 of 𝒉, denoted as L𝑄⊥ (𝒉). Since 𝒉 is a linear combination of the hidden binary vectors {𝜶𝑖 }𝑖=1,...,𝑁 , the orthogonal lattice L ⊥ (𝑨) is inherently contained
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
within L𝑄⊥ (𝒉). Under the assumption that the 𝜶𝑖 vectors are binary and sufficiently short, the first 𝑀 − 𝑁 short vectors obtained from an LLL-reduced basis of L𝑄⊥ (𝒉) are highly likely to span L ⊥ (𝑨). Subsequently, the completion lattice L̄ (𝑨) = (L ⊥ (𝑨)) ⊥ is computed by applying the LLL algorithm a second time. This resulting lattice contains the target lattice L (𝑨), effectively isolating the span of the hidden coefficients. This methodology can be naturally extended to the mHSSP setting by replacing the observation vector 𝒉 with the matrix 𝑯 ∈ 𝑀 ×𝑢 , as formally established in [32]. Z𝑄 Step 2: The second phase focuses on extracting the specific binary vectors 𝜶𝑖 from the reduced basis of L̄ (𝑨). To achieve higher precision than LLL, the BKZ algorithm is typically employed to 𝑁 be the set of discover shorter vectors within this space. Let {𝒗𝑖 }𝑖=1 short vectors obtained. Due to the binary nature of the target vectors, the 𝜶𝑖 coefficients are expected to be either the vectors 𝒗𝑖 themselves or simple linear combinations, such as 𝒗𝑖 ±𝒗 𝑗 . By searching the set {𝒗𝑖 } ∪ {𝒗𝑖 −𝒗 𝑗 } ∪ {𝒗𝑖 + 𝒗 𝑗 }, the adversary identifies 𝑁 candidate binary vectors to reconstruct the matrix 𝑨. Once 𝑨 is determined, a non-singular 𝑁 × 𝑁 sub-matrix 𝑨′ is selected alongside its corresponding observation 𝒉′ . The hidden private data 𝒙 is then recovered by solving the linear system: 𝒙 ≡ (𝑨′ ) −1 𝒉′
(mod 𝑄).
(9)
The effectiveness of the NS attack is contingent upon the parameters 𝑀, 𝑁 , and 𝑄 satisfying specific density conditions. The fundamental intuition is that any vector 𝒚 orthogonal to 𝒉 modulo 𝑄 must also be orthogonal to each hidden vector 𝜶𝑖 . Specifically, we consider ⟨𝒚, 𝒉⟩ = 𝑥 1 ⟨𝒚, 𝜶 1 ⟩ + · · · + 𝑥 𝑁 ⟨𝒚, 𝜶 𝑁 ⟩ ≡ 0
(mod 𝑄).
Let 𝒑 𝒚 = (⟨𝒚, 𝜶 1 ⟩, . . . , ⟨𝒚, 𝜶𝑛 ⟩). If the norm of 𝒑 𝒚 is smaller than the first minimum of the lattice L𝑄⊥ (𝒙), then 𝒑 𝒚 must be the zero vector, which confirms that 𝒚 ∈ L ⊥ (𝑨). To guarantee this with high probability, the parameters should satisfy the following bound [18] 𝛾𝑀 −𝑁 𝑀𝑁 𝑁 log 𝑄 > 𝜄𝑀𝑁 + log 𝑀 + log(𝑁 ), 2(𝑀 − 𝑁 ) 2 𝛾𝑁 where 0 < 𝜄 < 1 represents the LLL Hermite factor and 𝛾 (·) represents the Hermite constant with corresponding dimensions, which characterizes the quality of the basis reduction.
5.3
Extending the Nguyen-Stern Attack for HLCP
When transitioning from HSSP to the more general HLCP, where hidden coefficients are drawn from the integer range {0, . . . , 𝑐}, the NS attack framework remains structurally applicable but requires significant parameter adjustments and algorithmic enhancements. In the first phase, identifying the orthogonal lattice L ⊥ (𝑨), follows the same procedural logic as the binary case. However, the presence of larger coefficients in {0, . . . , 𝑐} necessitates a substantially larger modulus 𝑄 to ensure that the target vectors remain among the shortest in the lattice. To guarantee the success of the orthogonal attack with non-negligible probability, the bitsize of 𝑄
must satisfy a higher theoretical lower bound, specifically 𝛾𝑀 −𝑁 𝑀𝑁 𝑁 𝑀𝑁 log 𝑄 > 𝜄𝑀𝑁 + log 𝑀 + log(𝑁 )+ log 𝑐. 2(𝑀 − 𝑁 ) 2 𝛾𝑁 𝑀 −𝑁 As 𝑐 increases, 𝑄 must scale exponentially to maintain a sufficiently low density, ensuring that the short vectors found in L𝑄⊥ (𝑯 ) correctly span the hidden subspace. In the second phase, recovering the coefficient vectors from the basis of the completed lattice L̄ (𝑨), becomes significantly more challenging. In the HLCP setting, the recovered LLL basis vectors can be much larger than the original vectors. Since the hidden 𝜶𝑖 vectors are still expected to be among the shortest non-zero elements of the lattice, the more powerful BKZ algorithm is required. By providing a superior approximation factor, BKZ enables the adversary to search the lattice more effectively and pinpoint the true hidden coefficients within the expanded search space. While the standard NS attack is effective, several optimizations [10, 11] have been proposed to improve its computational efficiency, reducing the complexity of the second step from exponential to polynomial time. We provide a brief overview in Appendix E.
5.4
Complexity Analysis
The computational bottleneck of the NS attack resides in the second step, as lattice reduction problems are inherently difficult as the dimension 𝑛 grows. For the standard HSSP, the heuristic running time is dominated by the exponential term 2Ω (𝑁 ) . In the context of the HLCP where coefficients are bounded by 𝑐, the complexity scales as [18, Section 6.4.4] 2Ω (𝑁 ) · log O (1) 𝑐. This indicates that while the complexity is exponential with respect to the number of honest nodes 𝑛, it only grows polynomially with the bitsize of the coefficient range 𝑐. For the first step, the heuristic polynomial complexities for constructing the basis and performing reduction are approximately 𝑂 (𝑁 9 ) and 𝑂 (𝑁 7 (𝑁 + log 𝑐) 2 ), respectively.
5.5
Noise-tolerant orthogonal-lattice recovery
The reformulation in Section 4.4 recasts the reconstruction problem as a noisy mHSSP/mHLCP instance. In this section, we briefly show how such instances can be addressed heuristically by lifting the exact orthogonality constraints into an augmented lattice that explicitly carries their residuals [12, 43]. This extension only modifies the lattice construction in Step 1 of the NS attack. 𝑀 ×𝑟 denote the submatrix formed by selecting 𝑟 of the Let 𝒀˜ 𝑟 ∈ Z𝑄 𝑢 columns of 𝒀˜ . We can construct the augmented lattice with row basis 𝜆𝑰𝑀 −𝒀˜ 𝑟 ∈ Z (𝑀+𝑟 ) × (𝑀+𝑟 ) , 0 𝑄𝑰𝑟 where 𝜆 ∈ Z+ balances the original and residual coordinates. If we multiply this basis by any integer row vector (𝒗 ⊤ | 𝒘 ⊤ ), where 𝒗 ∈ Z𝑀 and 𝒘 ∈ Z𝑟 , we will get the lattice vector 𝜆𝒗 ⊤ −𝒗 ⊤ 𝒀˜ 𝑟 + 𝑄𝒘 ⊤ . (10) The first 𝑀 coordinates represent the candidate left-kernel vector 𝒗, while the last 𝑟 coordinates measure its modular residual with respect to the noisy observations.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
˜ , i.e., Now consider a genuine integer left-kernel vector 𝒗 of 𝑾 ˜ = 0⊤ . By (8), the selected observations satisfy 𝒗 ⊤𝑾 𝒗 ⊤ 𝒀˜ 𝑟 ≡ 𝒗 ⊤ 𝑬𝑟
(mod 𝑄),
Hence, 𝒘 can be chosen so that the last 𝑟 coordinates of (10) are the centered representatives of −𝒗 ⊤ 𝑬𝑟 . Provided that 𝑄 is sufficiently large to avoid modular wraparound, the corresponding lattice vector becomes 𝜆𝒗 ⊤ −𝒗 ⊤ 𝑬𝑟 . (11) Therefore, if the numerical residual is small, a short left-kernel ˜ gives rise to a short vector in the augmented lattice. vector of 𝑾 ˜ , the residual In contrast, for a vector 𝒗 outside the left kernel of 𝑾 ˜ 𝑿˜ ℎ,𝑟 and is generally contains the additional structural term 𝒗 ⊤𝑾 therefore not expected to remain comparably small. The augmented coordinates thus provide a heuristic separation between genuine left-kernel vectors and unrelated lattice vectors. ˜ has full column rank, its left kernel has dimension Assuming 𝑾 𝑀 − 𝑁 . We retain reduced vectors whose residual coordinates are sufficiently small and whose first-block projections provide 𝑀 − 𝑁 linearly independent candidates. We then discard the residual coordinates and divide the first 𝑀 coordinates by 𝜆. The resulting vectors are passed to the original completion-lattice and BKZ-based Step 2, which remains unchanged.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
a powerful secondary filter to validate the weights by checking if the reconstructed scalars match the observed evolution. Note that the recovered solution set {𝒂 1, . . . , 𝒂 𝑁 } is inherently unordered. While the topological prior knowledge in Case 1 and 2 can help establish a partial ordering, a unique sequence is not always guaranteed. This lack of ordering leads to a permutation ambiguity in the columns of the reconstructed matrix 𝑾𝑐ℎ . Thus while the quality of the reconstructed private data 𝑿ℎ remains high, the identities of the data, i.e., the specific mapping between a reconstructed model update and its corresponding honest node may be shuffled. This means the adversary may not always be certain who contributed which specific update, unless further identitylinking information is available. Therefore, we build an end-to-end procedure for the proposed attack to circumvent SA, which is formalized in Algorithm 1. Algorithm 1 Optimized HSSP attack for SA 1: Input: Adversarial observations O
ˆ ℎ ∈ R | Vℎ | ×𝑢 and corre2: Output: Recovered honest updates 𝑿 sponding training data batch B𝑖 3: Phase 1: Topological Reduction
⊲ Case 1 and 2
4: for all 𝑖 ∈ V𝑐 do
if |N𝑖 ∩ Vℎ | = 0 then V𝑐 ← V𝑐 \ {𝑖} ⊲ Pruning 7: if |N𝑖 ∩ Vℎ | = 1 with honest neighbor 𝑗 then 8: Resolve trivial attack for node 𝑗 via (7) 9: V𝑐 ← V𝑐 \ {𝑖}, Vℎ ← Vℎ \ { 𝑗 } ⊲ Pruning 10: Build up core sub-graphs and calculate corresponding 𝒀 5: 6:
6
Optimized HSSP attack for Secure Aggregation
As established in previous sections, reconstructing private updates in DFL can be formulated as solving an mHSSP or mHLCP. But gaps still exist between theoretical solvability and practical execution. Firstly, theoretical solvers for the HSSP require more observations than the naive condition 𝑀 ≥ 𝑁 to guarantee unique recovery. The NS attack typically requires 𝑀 = 2𝑁 , while the methods of Caron and Gini require 𝑀 ≈ 𝑁 2 . In a DFL core sub-graph, 𝑀 corresponds to the number of colluding corrupted nodes, while 𝑁 is the number of honest targets. Such a condition is not always satisfied in realistic decentralized networks. When 𝑀 is small, lattice reduction algorithms produce a candidate vector pool that contains the true weight vectors but also many spurious vectors that satisfy the lattice short-vector criteria but not the physical DFL constraints. Therefore, to reduce the spurious solutions, the adversary can apply filters to extract the correct 𝑁 weight vectors from the candidate set with different protocols. Secondly, the filtering is primarily derived from the prior knowledge established in Cases 1-3. By verifying whether each candidate combination is consistent with these topological constraints, we can systematically eliminate part of spurious solutions. Additionally, the inherent mathematical properties of the DFL mixing matrix 𝑾 provide rigorous constraints to prune the HSSP result set. For undirected graphs, 𝑾 is typically doubly stochastic. After scaling by 𝛽, the 𝑁 chosen candidate vectors 𝒘˜ 𝑗 must satisfy the Í exact row-sum identity as 𝑗 ∈ Vℎ 𝒘˜ 𝑗 = 𝛽 (1 − 𝑾𝑐𝑐 1). Any combination of 𝑁 vectors that does not sum to this known constant is eliminated. In directed graphs, row-stochasticity is not guaranteed. The sum of 𝑁 candidate vectors is instead relaxed to a bound ≤ 𝑐𝑁 . However, if the protocol utilizes auxiliary mass-balance scalars 𝑎𝑖(𝑡 ) that are transparent (e.g., initialized to 1), their evolution serves as
11: Phase 2: Orthogonal Lattice Construction
≡ 10𝛾 𝛽𝒀 (mod 𝑄), with unknown coefficients 𝑨 ≡ 𝛽𝑾𝑐ℎ (mod 𝑄) 13: Execute NS attack: ⊥ (𝑯 ) 14: Extract L ⊥ (𝑨) via LLL reduction of L𝑄 15: Compute completion lattice L̄ (𝑨) = (L ⊥ (𝑨)) ⊥ ∩ Z𝑀 16: Execute BKZ on L̄ (𝑨) to extract short independent vectors S𝑐𝑎𝑛𝑑 ⊂ Z𝑀 12: Map to mHSSP or mHLCP: 𝑯
17: Phase 3: Filtering 18: Ω 𝑣𝑎𝑙𝑖𝑑 ← ∅ 19: for all 𝑷 ∈ 20: 21: 22:
S𝑐𝑎𝑛𝑑 do | Vℎ |
if 𝑷 violates topology prior and constraints then continue Ω𝑣𝑎𝑙𝑖𝑑 ← Ω𝑣𝑎𝑙𝑖𝑑 ∪ {𝛽 −1 𝑷 }
23: Phase 4: State Inversion
ˆ 𝑐ℎ ∈ Ω𝑣𝑎𝑙𝑖𝑑 do 24: for 𝑾 25: 26:
7
ˆ 𝑐ℎ ) † 𝒀 𝑿ˆ ℎ(𝑡 +1/2) ← (𝑾 Use downstream GIA to recover training data
Numerical Results
In this section, we present numerical evaluations to demonstrate the effectiveness of the proposed attack and its practical implications in DFL. 4 The experimental setup is given in Appendix G. 4 The code is available at: https://github.com/Wenrui-Yu/hssp_dfl_sa
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
7.1
Evaluation Metrics
Let S𝑔𝑡 be the set of ground-truth (GT) column vectors constituting ˜ 𝑐ℎ ∈ Z𝑀 ×𝑁 and S𝑐𝑎𝑛𝑑 be the set of the hidden weight matrix 𝑾 candidate vectors recovered via lattice reduction. We define the success of the SA breach through the following metrics: Recall: An attack achieves a primary success if the GT set is a subset of the candidate set, i.e., S𝑔𝑡 ⊆ S𝑐𝑎𝑛𝑑 . This indicates that the lattice reduction has successfully captured all necessary basis vectors of the hidden weights. Solution Set Cardinality (Ambiguity): We define the set of feasible solutions (filtered with different cases) as F = {P ⊂ S𝑐𝑎𝑛𝑑 : |P | = 𝑁 and P satisfies O}, where P is a combination of the vectors in S𝑐𝑎𝑛𝑑 . The attack potency is measured by the cardinality |F |. If the attack succeeds and |F | = 1, the adversary has uniquely identified the true matrix. Since the recovered solution set is inherently unordered, so identifying the correct combination of vectors, regardless of their sequence, is regarded as a successful reconstruction. This permutation leads to an identity ambiguity among honest nodes but does not compromise the fidelity of the reconstructed data itself. ˆ 𝑐ℎ is selected, the adversary reconOnce a candidate matrix 𝑾 structs the honest updates 𝑿ˆ ℎ via (6) and subsequently the raw data 𝑫ˆ ℎ . We utilize common evaluation metrics to evaluate the reconstruction quality, e.g., Peak Signal-to-Noise Ratio (PSNR) and SSIM [56] to evaluate the structural and visual similarity of reconstructed images, Mean Square Error (MSE) for the feature accuracy of tabular data, and Cosine Similarity over sentence embeddings alongside ROUGE-L [35] and BERTScore [64] to quantify the semantic and structural alignment of recovered text sequences. We first present the attack’s performance in recovering the weight matrix 𝑾𝑐ℎ under various network topologies, which focuses on the fundamental solvability of the mHSSP/mHLCP formulation. We then apply the recovered gradients to reconstruct private training samples. The primary objective of the HSSP-based attacks is the accurate inference of the weights 𝑾𝑐ℎ and then correspondingly disentangle the mixed gradients. Thus, the quality of the final data reconstruction depends predominantly on the performance of the downstream gradient inversion attacks rather than the HSSP process itself. The data reconstruction results serve to validate the downstream utility of our recovered gradients.
7.2
Topological Simplification
We first empirically explore the graph simplification logic discussed in Section 4.2. Recall that honest nodes are categorized into three classes: those directly recoverable via trivial attacks, those constituting the core sub-graph susceptible to HSSP-based inference, and those remaining unrecoverable within a single iteration. We conducted a statistical analysis across a large ensemble of randomly generated undirected graphs and strongly connected directed graphs with fixed node counts 𝑛 and edge counts 𝑒. The proportions of each node category, averaged over 100 independent trials, are illustrated in Figure 2 and Figure 8 in Appendix K.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Key Takeaway: Topological sparsity and the corruption ratio 𝜂 are the primary catalysts for privacy leakage. Specifically, sparse graphs lack the path redundancy necessary to mask honest updates at low 𝜂. For undirected graphs, the results indicate that as the corruption ratio 𝜂 increases, the proportion of honest nodes recoverable via trivial attacks rises consistently. This trend occurs because a higher density of corrupted nodes more easily creates "isolation" for honest nodes. Also, within the 𝜂 = 0.4 ∼ 0.6 interval, the proportion of unrecoverable nodes undergoes a precipitous decline. This sharp transition signifies the point where the adversary set V𝑐 begins to outnumber the honest set Vℎ in the core sub-graphs, frequently satisfying the necessity |V𝑐 | ≥ |Vℎ | for reconstruction. For directed graphs, the vulnerability is heavily influenced by the sparsity of the topology. In sparse directed configurations, as shown in Figure 8(a), honest nodes are highly susceptible to isolation even at low corruption ratios. Since directional communication requires specific in-flow paths that are less redundant in sparse configurations, a significant portion of honest nodes becomes either trivial-attack targets or HSSP-eligible even when 𝜂 is small. Conversely, as the graph becomes denser, the trend aligns more closely with that of undirected graphs, as seen in Figure 8(d), which the unrecoverable node proportion remains high until the 𝜂 = 0.4 ∼ 0.6 threshold is reached.
(a) 𝑛 = 20, 𝑒 = 40
(b) 𝑛 = 20, 𝑒 = 60
Figure 2: Topological vulnerability analysis in undirected graphs as a function of the corrupted node ratio 𝜂. The total proportion of honest nodes is partitioned into three mutually exclusive categories: (i) nodes directly recoverable via trivial attacks (blue line), (ii) nodes constituting the core subgraph targeted for HSSP-based inference (green line), and (iii) inaccessible nodes that remain hidden within a single iteration (orange line). Note that these three categories are exhaustive, with their sum normalized to 1.
Appendix H examines how the sizes of the core subgraphs produced by the simplification strategy scale with the size of the underlying network. These results inform the choice of subgraph sizes in the subsequent experiments. In addition, to assess the dependence of attack feasibility on network topology, we also additionally evaluate several other representative graphs.
7.3
Attack Performance on Undirected Graph
Following the topological simplification discussed in the previous subsection, we evaluate the effectiveness of the mHSSP/mHLCP
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
attacks on the resulting core sub-graphs. To ensure a fair comparison, we randomly generate core sub-graphs with a fixed number of honest nodes and corrupted nodes, specifically targeting those identified as potentially resolvable through lattice-based inference. Key Takeaway: Ambiguity in the recovered solution set is significantly mitigated by topological prior knowledge (Cases 1–3) and adversarial density. To evaluate the robustness and efficiency of the proposed attack, we conducted 100 independent trials for different parameter configurations, as shown in Table 1. In each trial, a new core subgraph was randomly generated, and we recorded the successful inclusion of all GT vectors. The results demonstrate a high vector inclusion rate, confirming that the recovered candidate pool consistently contains the complete set of true weights. The cardinality of the candidate vector pool grows significantly as the ratio of honest nodes increases. In sparse-observation settings, lattice reduction produces a larger number of spurious short vectors. Config Recall (%) Avg. Found Vec. 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.6 98.0% 1497.1 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.7 92.0% 88.0 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.8 100.0% 17.7 𝑛 = 20, 𝑒 = 40, 𝜂 = 0.7 72.0% 4052.7 𝑛 = 20, 𝑒 = 40, 𝜂 = 0.8 97.0% 328.4 Table 1: mHLCP attack performance with different configurations in undirected graphs.
Table 7 and Table 8 of Appendix K provide a granular look at the results for the first 10 subgraphs under the configuration 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.6 and a higher corruption ratio (𝜂 = 0.7), showcasing the impact of the filtering process. We observe that the precision of the final reconstruction is heavily contingent on the level of topological awareness (Cases 1-3). Specifically, the availability of neighbor identities (Case 1) or node degrees (Case 2) provides powerful structural constraints that effectively prune spurious vector combinations. This reduction in the candidate set size significantly mitigates solution ambiguity. Also, a higher density of adversarial nodes grants the attacker more heterogeneous and asymmetric observational viewpoints within the network. This increase in independent constraints significantly narrows the number of valid combinations, often leading to the identification of a unique, correct weight matrix in Table 8. For the mHSSP scenario involving uniform weights in undirected graphs, we set the edge weights to 𝑊𝑖 𝑗 = 𝑑max1 +1 for (𝑖, 𝑗) ∈ E and Í the self-weights to 𝑊𝑖𝑖 = 1 − 𝑗 ∈ N𝑖 𝑤𝑖 𝑗 for 𝑖 ∈ V, where 𝑑 max is the maximum degree of the whole graph. The corresponding results are detailed in Tables 9, 10 and 11 in the Appendix K. Case 1 is not applicable to the mHSSP formulation. If the adversary possesses exact knowledge of neighbor identities and the protocol employs uniform weights, the subset-sum problem becomes trivial, as the weights for each neighbor are fixed and known beforehand, leaving no hidden parameters to resolve. The results on directed graphs are presented in Appendix I.
7.4
Attack on Real Dataset
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Key Takeaway: Information leakage occurs even in the absence of a unique solution, as some spurious candidates still leak recognizable semantic information. Figure 3 illustrates representative reconstruction results for the image dataset, showcasing both the GT solution (specifically, the 24th entry in Case 1) and instances of spurious solutions recovered under Cases 1-3. Detailed results for tabular and text modalities, including the set of 30 random candidate reconstructions for each case, are provided in Appendix L. All experiments were conducted on an undirected graph with non-uniform mixing weights (mHLCP) under the configuration 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.6. For each candidate solution identified by the HSSP solver, we first resolve the corresponding latent model updates via (6) and subsequently perform gradient inversion to recover the raw data. As observed in Figure 3, while the GT solution yields a better reconstruction fidelity, several spurious candidates also produce outputs that closely resemble the original training samples. This highlights that, even in the absence of a unique solution, an adversary can still obtain approximations of private data that retain significant semantic information.
Figure 3: Visual comparison of reconstructed images derived from the GT solution and representative spurious candidates across Cases 1-3. The final reconstruction quality also depends on the effectiveness of the downstream inversion algorithm. In settings where gradient inversion is theoretically lossless, such as in logistic regression models for text data, the private input vectors can be perfectly recovered. For example, a representative reconstruction in Table 2 achieves a cosine similarity of 1.0. However, inherent limitations in the subsequent conversion of embeddings back to natural language via vec2text still introduce semantic distortions. The statistical results are illustrated in Figure 4. For the true solution, the reconstructed gradients are identical to the ground truth (with a negligible machine epsilon of 10−32 ). In contrast, the average MSE for the sampled spurious candidates is significantly higher, leading to a corresponding decrease in image reconstruction quality. These statistical metrics exhibit high variance, reflecting the significant heterogeneity in reconstruction fidelity across the candidate set. While some lead to evident reconstruction failures, a substantial portion still yields high-quality approximations where semantic information remains clearly discernible.
7.5
Robustness to Finite-Precision Errors
We also evaluate whether numerical errors introduced by integerization degrade the exact-arithmetic attack. All other experimental
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Ground Truth
Spurious solution
True solution
Node 2 3 6 9
Cosine Similarity -
2 3 6 9 2 3 6 9
0.714 0.956 1.000 1.000 1.000 1.000 1.000 1.000
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Recovered Text Crunch berries! im tired. Who wants to do something tomorrow? @LAmale really? They’re a band... good music! Where are all the banana slugs? @Jack_thm aww why not?! Heck they do the job! I can’t find those anywhere nemore either!! ur ipod ones hurt!!! @Lammahey they’re a good band! @Lamem They’re a good band! Where are all the banana slugs? mmmm Why can’t anyone find them They hurt Crunch berries! i am tired. Who wants to do something tomorrow? @Lameah... They’re a really good band! music Where are all the banana slugs? mmmm Why can’t you find them
Rouge-L -
BERTScore -
0.000 0.571 1.000 0.071 0.947 0.625 1.000 0.276
-0.346 0.255 1.000 -0.031 0.811 -0.474 1.000 -0.499
Table 2: Example of text reconstruction results from candidate weight matrices. Exact matches and matching substrings are highlighted in green, while mismatched errors are highlighted in red.
those of the exact control, indicating that the attack effectiveness is preserved at this level of finite-precision truncation.
7.6
Figure 4: Statistical reconstruction performance on the CIFAR-10 dataset. (a) MSE between the HSSP-reconstructed gradients and the GT gradients. (b) Distribution of SSIM and PSNR scores for training data reconstructed from the sampled candidate gradients.
settings are kept the same as in Section 7.4; only the observation and the Step 1 construction are varied. For clarity and to facilitate comparison with the idealized setting, the original values are stored in float64 format and quantized to ten decimal places before integerization. Based on that, we conduct the finite-precision evaluation by applying truncation with 𝛾 ∈ {4, 6, 8, 10} and vary the number of selected observation columns as 𝑟 ∈ {1, 2, 4, 8} in noisy mHLCP. For baseline, we apply the exact Step 1 to the exact ideal observation using 𝑟 = 4. We heuristically √ √ set 𝜆 = ⌈1.25(𝛽 + 1) 𝑟 ⌉. The factor 𝑟 accounts for the growth of the Euclidean norm across the 𝑟 residual coordinates. Key Takeaway: When sufficient numerical precision is retained, the noisy mHSSP/HLCP attack is robust to finiteprecision truncation. Table 3 reports the recovery results under finite-precision truncation. The integerization precision 𝛾 has a clear impact on recovery: a smaller 𝛾 retains fewer decimal places, producing a coarser fixedpoint representation and a larger truncation error in the original numerical domain. In our experimental setting, when 𝛾 = 8, selecting 𝑟 = 4, as in the exact mHLCP control, is sufficient to tolerate the resulting numerical error for all tested datasets. Both the column recall and the number of retained candidate vectors match
Defense Mechanisms
Key Takeaway: Lattice-based attacks exhibit algebraic sensitivity to aggregation-level DP while local DP does not perturb the global structure. To evaluate the robustness of our HSSP-based attack, we further investigate the impact of DP mechanisms, as DP is commonly adopted to provide privacy guarantees and can be combined with SA [53]. DP can typically be applied in two paradigms: Local DP (LDP), where noise is injected into individual gradients before aggregation, and Aggregation-level DP (analogous to Centralized DP, or CDP), where noise is added to the final aggregated result. When noise is applied to the aggregated sum, the observation matrix 𝑯ˆ available to the adversary is perturbed by noise 𝑬. The mHSSP relation in (3) becomes 𝑯ˆ ≡ 𝑨𝑿 + 𝑬 (mod 𝑄), which takes the similar noisy modular form as in Section 4.4. Conversely, when nodes apply LDP, the noise matrix 𝑬 is added directly to the local parameters 𝑿 prior to the SA protocol. The observed aggregated system becomes 𝑯ˆ ≡ 𝑨(𝑿 + 𝑬) (mod 𝑄). Let 𝑿ˆ = 𝑿 + 𝑬 represent the perturbed local updates. The system can be rewritten as 𝑯ˆ ≡ 𝑨𝑿ˆ (mod 𝑄). This preserves the exact structural invariant of the mHSSP/mHLCP formulation. Therefore, LDP does not directly disrupt the algebraic structure exploited by the lattice reduction algorithm, which can still recover 𝑨 under the considered settings. In this scenario, the protection of the raw data primarily depends on the magnitude of the LDP noise 𝑬, while the structural protection provided by SA against recovering the mixing coefficients remains limited. To empirically validate this algebraic brittleness, we distribute 5000 training images to each of the 10 nodes. We evaluate the model’s utility degradation and the attack’s success rate when applying LDP and CDP during training. The DP parameters are configured with a clipping norm of 1.0, 𝛿 = 10−5 , and varying privacy budgets 𝜖s. As illustrated in Figure 5, in the CDP scenario, aggregate-level unknown perturbation disrupts the exact algebraic
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Dataset
𝑟 =1
𝑟 =2
𝑟 =4
𝑟 =8
Sentiment140
Baseline 𝑆 = 104 𝑆 = 106 𝑆 = 108 𝑆 = 1010
1.00 / 1152 – – – –
– 0.50 / 4096 0.00 / 1068 1.00 / 1152 1.00 / 1152
– 0.50 / 4096 1.00 / 1152 1.00 / 1152 1.00 / 1152
– 0.50 / 4096 1.00 / 1152 1.00 / 1152 1.00 / 1152
– 0.50 / 4096 1.00 / 1152 1.00 / 1152 1.00 / 1152
Purchase
Baseline 𝑆 = 104 𝑆 = 106 𝑆 = 108 𝑆 = 1010
1.00 / 1152 – – – –
– 0.50 / 4096 0.50 / 4096 0.50 / 4096 0.50 / 4096
– 0.50 / 4096 0.50 / 4096 0.50 / 4096 0.50 / 4096
– 0.50 / 4096 1.00 / 1152 1.00 / 1152 1.00 / 1152
– 0.50 / 4096 0.25 / 1776 1.00 / 1152 1.00 / 1152
CIFAR
Baseline 𝑆 = 104 𝑆 = 106 𝑆 = 108 𝑆 = 1010
1.00 / 1152 – – – –
– 0.50 / 4096 0.50 / 4096 0.50 / 4096 0.50 / 4096
– 0.50 / 4096 0.25 / 2752 1.00 / 1152 1.00 / 1152
– 0.50 / 4096 0.00 / 1776 1.00 / 1152 1.00 / 1152
– 0.50 / 4096 0.50 / 4096 1.00 / 1152 1.00 / 1152
Table 3: Robustness to finite-precision errors via noisy mHSSP/mHLCP. Each entry is reported as Recall/Found Vec.
relation required by our lattice attack. However, in the LDP scenario, the injected noise presents no structural obstacle to the solver; while model utility predictably declines as the noise scale increases, the underlying weights and gradients remain resolvable. These results demonstrate that aggregation-level perturbations are effective under our exact-arithmetic attack model.
Figure 5: Test accuracy and HSSP attack success rate under different DP paradigms. (a) LDP and (b) CDP. Moreover, although the noisy mHSSP/mHLCP construction is robust to bounded truncation errors as shown in Section 7.5, CDP remains effective against full reconstruction under our current experimental setting. We replace the original exact Step 1 with its noise-tolerant variant while leaving the remaining attack pipeline unchanged. As shown in Figure 11 in Appendix K, the exact Step 1 recovers no ground-truth vector, whereas the noisy attack finds 25−50% true vectors under CDP. This partial recovery is insufficient to complete the attack, but it shows that the noisy construction can retain partial structural information that is entirely lost in the exact formulation. We regard this as a preliminary result, suggesting that the interaction between DP perturbation and more advanced noise-tolerant lattice attacks warrants further investigation.
8
Related Works
SA has been extensively studied in centralized FL to ensure that the central server only observes the aggregate of client updates, thereby
mitigating individual privacy leakage [3, 5, 51] to some extent. This paradigm has naturally been extended to decentralized networks. For instance, several studies adapt distributed protocols to achieve efficient secure summation for DFL [54, 62], often leveraging Secure Multi-Party Computation to safeguard single-node contributions [13, 26, 55]. However, a distinction must be made regarding the communication topology of these protocols. Certain existing works [6, 23, 47] implement SA in peer-to-peer environments but remain fundamentally predicated on the centralized FedAvg logic. These designs require each node to broadcast information to all other participants to achieve global synchronization. This deviates from the mainstream DFL paradigm, which prioritizes localized communication and single-hop aggregation exclusively with direct neighbors. Since our study focuses on the privacy vulnerabilities inherent in sparse, neighborhood-based aggregation models, these global-broadcasting approaches fall outside our immediate scope. Meanwhile, several related works aim to recover individual private information from CFL or DFL aggregation processes. A summary is provided in Table 4. In addition, we discuss the intrinsic connections between our approach and prior works such as [40] and [14] in Appendix F.
9
Limitations
The current attack remains subject to several limitations. Its strongest exact-update data-reconstruction result applies to the first training round, where the common initialization is known. Moreover, the basic identifiability condition requires that the number of independent corrupted observations in the core be at least as large as the number of unknown honest states. The attack also relies on sufficient prior topology information to filter spurious lattice candidates. The purpose of this work is not to suggest that every DFL deployment satisfies the demonstrated operating conditions, but to identify a topology-induced privacy risk that can arise in 5 For works employing uniform weights, the weights are treated as a priori known.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Work
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Perspective
Setting
SA
Weight
Rounds
Key Mechanism & Insight
Pasquini [46] Mrini [40] Dekker [14] So [50] Pasquini [45] Zhang [65]
attack attack attack defense attack defense
DFL DFL summation CFL CFL DFL
partial no yes yes yes yes
known known known5 known known known
multi multi multi multi one one
Lam [29]
attack
CFL
yes
known
multi
Boenisch [4] Marchand [36]
attack attack
CFL CFL
yes yes
known known
one multi
Ours
attack
DFL
yes
unknown
one
Exploits inherent leakage in DFL caused by local generalization. Leverages the quasi-static nature of gradients across iterations. Resolves secure summation via repeated asynchronous observations. Constrains user participation combinations to prevent leakage. Exploits active server control to inject non-identical models. Establishes perfect security bounds for simple sums in fully connected DFL. Reconstructs binary participant matrix via side-channel analytics to disaggregate updates. Injects malicious devices to nullify SA masking. Exploits neuron activation sparsity and discrete data priors to disentangle aggregated updates. Exploits structural asymmetry to resolve unknown weights via mHLCP.
Table 4: Comparison with related works.
neighborhood-based SA. As the corresponding theory and attack techniques develop, operating regimes that are currently difficult may become more accessible, motivating early consideration of these structural risks in protocol design.
10
Conclusion
In this paper, we present a systematic investigation of privacy vulnerabilities in SA within DFL environments. By formulating the privacy reconstruction problem under SA as instances of mHSSP and mHLCP, we show that structural asymmetries in DFL topologies can render these otherwise challenging problems tractable. Empirical results across multiple data modalities further demonstrate that colluding adversaries can recover individual updates with high fidelity, and consequently, reconstruct the underlying training data. These results show that, in asymmetric topologies, SA alone may not provide sufficient structural protection against inference attacks, as individual contributions can be disentangled under favorable conditions. This highlights a gap between the intended privacy guarantees of SA and its behavior in decentralized settings.
Acknowledgments This paper was edited for grammar using Gemini and ChatGPT. We thank the Aalborg University AI:X initiative for enabling this work via the AI:SECURITY lab.
References [1] Geoffrey Hinton Alex Krizhevsky. 2009. Learning multiple layers of features from tiny images. (2009). [2] Mahmoud Assran, Nicolas Loizou, Nicolas Ballas, and Mike Rabbat. 2019. Stochastic gradient push for distributed deep learning. In International Conference on Machine Learning. PMLR, 344–353. [3] James Henry Bell, Kallista A Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mariana Raykova. 2020. Secure single-server aggregation with (poly) logarithmic overhead. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security. 1253–1269. [4] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. 2023. Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 241–257.
[5] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1175–1191. [6] Carlo Brunetta, Georgia Tsaloli, Bei Liang, Gustavo Banegas, and Aikaterini Mitrokotsa. 2021. Non-interactive, secure verifiable aggregation for decentralized, privacy-preserving learning. In Australasian Conference on Information Security and Privacy. Springer, 510–528. [7] Vincenzo Carletti, Pasquale Foggia, Carlo Mazzocca, Giuseppe Parrella, and Mario Vento. 2025. { SoK } : Gradient inversion attacks in federated learning. In 34th USeNIX security symposium (USeNIX security 25). 6439–6459. [8] John William Scott Cassels. 1971. An introduction to the geometry of numbers. Vol. 99. Springer. [9] Yuanmi Chen and Phong Q Nguyen. 2011. BKZ 2.0: Better lattice security estimates. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 1–20. [10] Jean-Sébastien Coron and Agnese Gini. 2020. A polynomial-time algorithm for solving the hidden subset sum problem. In Annual International Cryptology Conference. Springer, 3–31. [11] Jean-Sébastien Coron and Agnese Gini. 2021. Provably solving the hidden subset sum problem via statistical learning. Transactions on Mathematical Cryptology 1, 2 (2021), 70–84. [12] Jean-Sébastien Coron and Luca Notarnicola. 2019. Cryptanalysis of CLT13 multilinear maps with independent slots. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 356–385. [13] Gábor Danner, Árpád Berta, István Hegedűs, and Márk Jelasity. 2018. Robust fully distributed minibatch gradient descent with privacy preservation. Security and Communication Networks 2018, 1 (2018), 6728020. [14] Florine W Dekker, Zekeriya Erkin, and Mauro Conti. 2025. Topology-Based Reconstruction Prevention for Decentralised Learning. Proceedings on Privacy Enhancing Technologies 1 (2025), 553–566. [15] Whitfield Diffie and Martin E Hellman. 2022. New directions in cryptography. In Democratizing cryptography: the work of Whitfield Diffie and Martin Hellman. 365–390. [16] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. 2020. Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems 33 (2020), 16937–16947. [17] Jonas Geiping, Liam Fowl, and Yuxin Wen. 2022. Breaching: A Framework for Attacks against Privacy in Federated Learning. https://github.com/JonasGeiping/ breaching. GitHub repository, accessed August 5, 2026. [18] Agnese Gini. 2022. On the hardness of the hidden subset sum problem: algebraic and statistical attacks. (2022). [19] Alec Go, Richa Bhayani, and Lei Huang. 2009. Twitter sentiment classification using distant supervision. CS224N project report, Stanford 1, 12 (2009), 2009. [20] Pengxin Guo, Runxi Wang, Shuang Zeng, Jinjing Zhu, Haoning Jiang, Yanran Wang, Yuyin Zhou, Feifei Wang, Hui Xiong, and Liangqiong Qu. 2025. Exploring the vulnerabilities of federated learning: A deep dive into gradient inversion attacks. IEEE Transactions on Pattern Analysis and Machine Intelligence (2025). [21] Aric A Hagberg, Daniel A Schult, and Pieter J Swart. 2008. Exploring network structure, dynamics, and function using NetworkX. In Proceedings of the python in science conference. SciPy, 11–15.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
[22] Ali Hatamizadeh, Hongxu Yin, Pavlo Molchanov, Andriy Myronenko, Wenqi Li, Prerna Dogra, Andrew Feng, Mona G Flores, Jan Kautz, Daguang Xu, et al. 2023. Do gradient inversion attacks make federated learning unsafe? IEEE Transactions on Medical Imaging 42, 7 (2023), 2044–2056. [23] Beomyeol Jeon, SM Ferdous, Muntasir Raihan Rahman, and Anwar Walid. 2021. Privacy-preserving decentralized aggregation for federated learning. In IEEE INFOCOM 2021-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 1–6. [24] Changlong Ji, Richard Heusdens, Stephane Maag, and Qiongxiu Li. 2025. Reevaluating privacy in centralized and decentralized learning: An informationtheoretical and empirical study. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 1–5. [25] Peter H Jin, Qiaochu Yuan, Forrest Iandola, and Kurt Keutzer. 2016. How to scale distributed deep learning? arXiv preprint arXiv:1611.04581 (2016). [26] Renuga Kanagavelu, Zengxiang Li, Juniarto Samsudin, Yechao Yang, Feng Yang, Rick Siow Mong Goh, Mervyn Cheah, Praewpiraya Wiwatphonthana, Khajonpong Akkarajitsakul, and Shangguang Wang. 2020. Two-phase multi-party computation enabled privacy-preserving federated learning. In 2020 20th IEEE/ACM international symposium on cluster, cloud and internet computing (CCGRID). IEEE, 410–419. [27] David Kempe, Alin Dobra, and Johannes Gehrke. 2003. Gossip-based computation of aggregate information. In 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings. IEEE, 482–491. [28] Anastasia Koloskova, Tao Lin, Sebastian U Stich, and Martin Jaggi. 2019. Decentralized deep learning with arbitrary communication compression. arXiv preprint arXiv:1907.09356 (2019). [29] Maximilian Lam, Gu-Yeon Wei, David Brooks, Vijay Janapa Reddi, and Michael Mitzenmacher. 2021. Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix. In International Conference on Machine Learning. PMLR, 5959–5968. [30] Arjen K Lenstra, Hendrik Willem Lenstra, and László Lovász. 1982. Factoring polynomials with rational coefficients. (1982). [31] Huan Li and Zhouchen Lin. 2024. Accelerated gradient tracking over time-varying graphs for decentralized optimization. Journal of Machine Learning Research 25, 274 (2024), 1–52. [32] Qiongxiu Li, Lixia Luo, Agnese Gini, Changlong Ji, Zhanhao Hu, Xiao Li, Chengfang Fang, Jie Shi, and Xiaolin Hu. 2024. Perfect gradient inversion in federated learning: A new paradigm from the hidden subset sum problem. arXiv preprint arXiv:2409.14260 (2024). [33] Qinglun Li, Miao Zhang, Nan Yin, Quanjun Yin, Li Shen, and Xiaochun Cao. 2025. Asymmetrically decentralized federated learning. IEEE Trans. Comput. (2025). [34] Xiangru Lian, Ce Zhang, Huan Zhang, Cho-Jui Hsieh, Wei Zhang, and Ji Liu. 2017. Can decentralized algorithms outperform centralized algorithms? a case study for decentralized parallel stochastic gradient descent. Advances in neural information processing systems 30 (2017). [35] Chin-Yew Lin. 2004. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out. 74–81. [36] Tanguy Marchand, Regis Loeb, Ulysse Marteau-Ferey, Jean Ogier Du Terrail, and Arthur Pignet. 2023. SRATTA: Sample Re-ATTribution Attack of Secure Aggregation in Federated Learning.. In Proceedings of the 40th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 202), Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (Eds.). PMLR, 23886–23914. https://proceedings.mlr.press/v202/marchand23a.html [37] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics. PMLR, 1273–1282. [38] Daniele Micciancio and Shafi Goldwasser. 2002. Complexity of lattice problems: a cryptographic perspective. Vol. 671. Springer Science & Business Media. [39] John Morris, Volodymyr Kuleshov, Vitaly Shmatikov, and Alexander M Rush. 2023. Text embeddings reveal (almost) as much as text. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing. 12448–12460. [40] Abdellah El Mrini, Edwige Cyffers, and Aurélien Bellet. 2024. Privacy Attacks in Decentralized Learning. In Proceedings of the 41st International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 235), Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (Eds.). PMLR, 36419–36433. https: //proceedings.mlr.press/v235/mrini24a.html [41] Phong Nguyen and Jacques Stern. 1999. The hardness of the hidden subset sum problem and its cryptographic implications. In Annual International Cryptology Conference. Springer, 31–46. [42] Phong Q Nguyen and Oded Regev. 2006. Learning a parallelepiped: Cryptanalysis of GGH and NTRU signatures. In Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 271–288. [43] Luca Notarnicola and Gabor Wiese. 2021. The hidden lattice problem. arXiv preprint arXiv:2111.05436 (2021).
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
[44] Alex Olshevsky and John N Tsitsiklis. 2009. Convergence speed in distributed consensus and averaging. SIAM journal on control and optimization 48, 1 (2009), 33–55. [45] Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. 2022. Eluding secure aggregation in federated learning via model inconsistency. In Proceedings of the 2022 ACM SIGSAC Conference on computer and communications security. 2429– 2443. [46] Dario Pasquini, Mathilde Raynal, and Carmela Troncoso. 2023. On the (in) security of peer-to-peer decentralized machine learning. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 418–436. [47] Diogo Pereira, Paulo Ricardo Reis, and Fábio Borges. 2024. Secure aggregation protocol based on dc-nets and secret sharing for decentralized federated learning. Sensors 24, 4 (2024), 1299. [48] Adi Shamir. 1979. How to share a secret. Commun. ACM 22, 11 (1979), 612–613. [49] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP). IEEE, 3–18. [50] Jinhyun So, Ramy E Ali, Başak Güler, Jiantao Jiao, and A Salman Avestimehr. 2023. Securing secure aggregation: Mitigating multi-round privacy leakage in federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 9864–9873. [51] Jinhyun So, Chaoyang He, Chien-Sheng Yang, Songze Li, Qian Yu, Ramy E Ali, Basak Guler, and Salman Avestimehr. 2022. Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning. Proceedings of Machine Learning and Systems 4 (2022), 694–720. [52] Yongcun Song, Ziqi Wang, and Enrique Zuazua. 2023. Approximate and weighted data reconstruction attack in federated learning. arXiv preprint arXiv:2308.06822 (2023). [53] Timothy Stevens, Christian Skalka, Christelle Vincent, John Ring, Samuel Clark, and Joseph Near. 2022. Efficient differentially private secure aggregation for federated learning via hardness of learning with errors. In 31st USENIX security symposium (USENIX Security 22). 1379–1395. [54] Katrine Tjell and Rafael Wisniewski. 2020. Private aggregation with application to distributed optimization. IEEE Control Systems Letters 5, 5 (2020), 1591–1596. [55] Anh-Tu Tran, The-Dung Luong, Jessada Karnjana, and Van-Nam Huynh. 2021. An efficient approach for privacy preserving decentralized deep learning models based on secure multi-party computation. Neurocomputing 422 (2021), 245–262. [56] Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing 13, 4 (2004), 600–612. doi:10.1109/TIP.2003.819861 [57] Hong Xing, Osvaldo Simeone, and Suzhi Bi. 2020. Decentralized federated learning via SGD over wireless D2D networks. In 2020 IEEE 21st international workshop on signal processing advances in wireless communications (SPAWC). IEEE, 1–5. [58] Jin Xu, Chi Hong, Jiyue Huang, Lydia Y Chen, and Jérémie Decouchant. 2022. Agic: Approximate gradient inversion attack on federated learning. In 2022 41st International Symposium on Reliable Distributed Systems (SRDS). IEEE, 12–22. [59] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. 2021. See through gradients: Image batch recovery via gradinversion. In 2021 IEEE/CVF conference on computer vision and pattern recognition (CVPR). IEEE, 16332–16341. [60] Wenrui Yu, Qiongxiu Li, Milan Lopuhaä-Zwakenberg, Mads Græsbøll Christensen, and Richard Heusdens. 2024. Provable privacy advantages of decentralized federated learning via distributed optimization. IEEE Transactions on Information Forensics and Security (2024). [61] Ye Yuan, Jun Liu, Dou Jin, Zuogong Yue, Ruijuan Chen, Maolin Wang, Chuan Sun, Lei Xu, Feng Hua, Xin He, et al. 2021. DeceFL: A principled decentralized federated learning framework. arXiv preprint arXiv:2107.07171 (2021). [62] Edvin Listo Zec, Johan Östman, Olof Mogren, and Daniel Gillblad. 2024. Efficient node selection in private personalized decentralized learning. In Northern Lights Deep Learning Conference. PMLR, 244–250. [63] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In 2018 IEEE/CVF conference on computer vision and pattern recognition. IEEE, 586–595. [64] Tianyi Zhang*, Varsha Kishore*, Felix Wu*, Kilian Q. Weinberger, and Yoav Artzi. 2020. BERTScore: Evaluating Text Generation with BERT. In International Conference on Learning Representations. https://openreview.net/forum?id=SkeHuCVFDr [65] Xiang Zhang, Zhou Li, Shuangyang Li, Kai Wan, Derrick Wing Kwan Ng, and Giuseppe Caire. 2026. Information-Theoretic Secure Aggregation in Decentralized Networks. arXiv preprint arXiv:2601.17970 (2026). [66] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610 (2020). [67] Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep leakage from gradients. Advances in neural information processing systems 32 (2019).
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
A
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Push-Sum Algorithm in Directed Graphs
For scenarios involving directed graphs, 𝑾 (𝑡 ) is typically required to be column-stochastic (i.e., 1⊤𝑾 (𝑡 ) = 1⊤ ). Specifically, for Push-Sum algorithm, each node 𝑖 maintains two variables, 𝒙𝑖(𝑡 ) and an auxiliary scalar 𝑎𝑖(𝑡 ) ∈ R+ . The actual consensus model at node 𝑖 is then computed by the ratio 𝒙˜ 𝑖(𝑡 ) =
(𝑡 )
𝒙𝑖
(𝑡 ) 𝑎𝑖
to correct the bias induced by the asymmetry of the graph. This pair can be interpreted as an augmented
state 𝒛𝑖(𝑡 ) = [𝒙𝑖(𝑡 )⊤, 𝑎𝑖(𝑡 ) ] ⊤ ∈ R𝑑+1 , where both the model parameters and the auxiliary scalar evolve under the same mixing dynamics, i.e., 1 𝒁 (𝑡 +1) = 𝑾 (𝑡 +1) 𝒁 (𝑡 + 2 ) . 6 Consequently, regardless of whether a standard consensus or a Push-Sum-based mechanism is employed, the fundamental update paradigm remains structurally consistent with the linear mixing form in (3). For the sake of brevity and clarity, we will adopt this unified representation in the subsequent sections of this paper to describe the general decentralized aggregation process. 7
B
Prior Knowledge
Case 1 is common in decentralized peer-to-peer systems. To implement SA protocols based on pairwise masking [5], nodes often perform a Diffie-Hellman (DH) key agreement [15] or similar handshakes. In a DFL graph, this requires nodes to obtain network-level identifiers (e.g., IP addresses, node IDs, or public keys) of their neighbors to establish shared secrets. While DH does not require explicit identity disclosure, practical implementations involving identity-bound certificates typically expose the identities of communication partners. Case 2 corresponds to protocols utilizing anonymizing relays or secure hardware like Trusted Execution Environments as intermediate aggregators. While these primitives can obscure the source of individual updates, the recipient often observes metadata regarding the incoming encrypted contributions. For instance, threshold-based Shamir secret-sharing schemes [48] require the system to verify that a sufficient number of shares have been received, thereby inherently leaking the in-degree 𝑑𝑖𝑖𝑛 . Finally, Case 3 represents an idealized setting where both identities and structural metadata are strictly hidden, e.g., through fully anonymous communication or blind homomorphic aggregation. In this case, the adversary only observes the final aggregated state 𝒙𝑖(𝑡 +1) without reliable information about the provenance or the size of the participating set.
C
Proof of Proposition 1
Proof. By stacking the aggregation process across 𝑡 max iterations, the global model evolution can be initially characterized as a blockdiagonal linear system: 𝑿 (1) 𝑾 (1) © 𝑿 (2) ª © 0 ® . ®= . . ® . . ® . «𝑿 (𝑡max ) ¬ « 0
1
0 𝑾 (2) .. . 0
... ... .. . ...
𝑿(2) ª 1 ª © ® 𝑿 (1 2 ) ®® ® ®. .. ® ® ® . ® 𝑾 (𝑡max ) ¬ «𝑿 (𝑡max − 12 ) ¬ 0 0 .. .
(12)
By extracting the rows corresponding to V𝑐 from (12), we isolate the system from the adversaries’ perspective: (1) (𝑾 (1) 𝑾𝑐ℎ ) 𝑿 (1) © 𝑐(2) ª © 𝑐𝑐 𝑿𝑐 ® 0 ® . ®= .. .. ® . ® (𝑡 max ) 𝑿 0 « 𝑐 ¬ «
0 (2) ) (𝑾𝑐𝑐(2) 𝑾𝑐ℎ .. . 0
1
... ... .. . ...
0 𝑿(2) ª © (1+ 1 ) ª ® ® 0 ® 𝑿 2 ® ®. ® . .. .. ® ® . ® ® 1 (𝑡 max ) (𝑡 max ) ) ¬ «𝑿 (𝑡max − 2 ) ¬ (𝑾𝑐𝑐 𝑾𝑐ℎ
Given the prior knowledge of mutual weights 𝑾𝑐𝑐(𝑡 ) among corrupted nodes, we move all known terms to the left-hand side, yielding the compact matrix representation 𝒀 = 𝑨𝑩: (1)
(1) 𝑿𝑐(1) − 𝑾𝑐𝑐(1) 𝑿𝑐 2 © ª ©𝑾𝑐ℎ 1 ® (1+ ) ® 0 𝑿𝑐(2) − 𝑾𝑐𝑐(2) 𝑿𝑐 2 ®= . .. ® . ® . . ® 1 (𝑡 max ) (𝑡 max ) (𝑡 max − 2 ) 0 − 𝑾𝑐𝑐 𝑿𝑐 «𝑿𝑐 ¬ « | {z } | 𝒀
0 (2) 𝑾𝑐ℎ .. . 0
... ... .. . ... {z 𝑨
(1)
𝑿ℎ 2 ª ª © (1+ 1 ® 𝑿 2 ) ®® ® ℎ ®, ® .. ® ® ® . ® ® (𝑡 max ) (𝑡 max − 12 ) 𝑾𝑐ℎ ¬ «𝑿 } | ℎ {z ¬} 0 0 .. .
𝑩
where 𝒀 acts as the observation matrix composed entirely of known adversarial states and weights, 𝑨 is the block-diagonal mixing matrix, and 𝑩 represents the latent honest states. Because 𝑨 possesses a strictly block-diagonal structure, the global system 𝒀 = 𝑨𝑩 decoupled 6 The convergence target of Push-Sum is determined by the initialization of the auxiliary scalar 𝑎 (0) . In existing literature [2, 33], the auxiliary scalar is typically initialized as 𝑖 (0) (0) 𝑎𝑖 = 1 for all 𝑖 ∈ V , leading to a standard arithmetic average. Adopting a non-uniform initialization for 𝑎𝑖 will enable the network to reach a weighted consensus. (0) (𝑡 ) 7 if 𝑎 is fixed to a non-encrypted value (e.g., 1 ), the evolution of 𝑎 becomes a deterministic trajectory governed solely by the graph topology. This provides an additional 𝑖 𝑖
algebraic constraint that can be utilized to prune the solution space or filter out legitimate candidates in the HSSP-based reconstruction attack, which is detailed in Section 6 and Appendix I.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
completely into a series of independent round-wise sub-problems (6). As discussed in the proposition, while the hidden internal weights (𝑡 + 12 )
(𝑡 +1) 𝑾ℎ𝑐(𝑡 +1) and 𝑾ℎℎ prevent the explicit derivation of individual updates Δ𝒙𝑖(𝑡 ) for 𝑡 ≥ 1, recovering the intermediate states 𝑿ℎ constitutes a severe breach, as they encapsulate the cumulative private data of the honest nodes.
D
still □
Proof of Theorem 1
Proof. We establish the reduction by constructing an integer-domain representation of the DFL observation system. Starting from the isolated sub-problem derived in Proposition 1, we have 𝒀 = 𝑾𝑐ℎ 𝑿ℎ . First, we address the rational nature of the mixing weights. By multiplying both sides by the common denominator 𝛽, we obtain: ˜ ℎ, 𝛽𝒀 = (𝛽𝑾𝑐ℎ )𝑿ℎ = 𝑾𝑿 ˜ ∈ Z𝑀 ×𝑁 is now an integer matrix. where 𝑾 Second, under the exact integer-domain representation, define 𝑿˜ ℎ = 10𝛾 𝑿ℎ ∈ Z𝑁 ×𝑢 . ˜ ℎ by 10𝛾 yields Multiplying both sides of 𝛽𝒀 = 𝑾𝑿 ˜ 𝑿˜ ℎ ∈ Z𝑀 ×𝑢 . 𝒀˜ = 10𝛾 𝛽𝒀 = 𝑾
(13)
Third, we reduce this integer relation entry-wise modulo a prime 𝑄, yielding ˜ 𝑿˜ ℎ 𝒀˜ ≡ 𝑾
(mod 𝑄).
(14)
Here, 𝑄 is a large prime which satisfy the requirements of the corresponding lattice attack. (14) has exactly the matrix structure of the ˜ constitute the hidden coefficient vectors, while the rows of 𝑿˜ ℎ correspond to the multidimensional mHSSP/mHLCP, which the columns of 𝑾 secrets. Finally, (14) aligns identically with the formal definition of multi-dimensional lattice challenges: • If the DFL protocol employs uniform mixing weights (e.g., Secure Summation where 𝑊𝑖 𝑗 ∈ {0, 1}), the scaled coefficients lie within C ⊆ {0, 1}. (14) is thus the exact formulation of an mHSSP instance, where the adversary seeks an unknown binary selection matrix. • If the protocol employs heterogeneous mixing weights (e.g., weighted averaging), the scaled integer weights are constrained within C ⊆ {0, . . . , 𝑐}. In this case, (14) corresponds perfectly to an mHLCP instance, generalizing the subset-sum structure to arbitrary bounded integer coefficients. ˜ , the coefficient-recovery stage of the privacy reconstruction Since recovering 𝑿ℎ requires first identifying the hidden integer matrix 𝑾 ˜ is recovered, the original weight matrix is obtained problem can be reduced to solving the corresponding mHSSP/mHLCP instance. Once 𝑾 ˜ , after which the honest states can be recovered from the original linear system 𝒀 = 𝑾𝑐ℎ 𝑿ℎ whenever 𝑾𝑐ℎ admits unique as 𝑾𝑐ℎ = 𝛽 −1𝑾 inversion. This completes the proof. □
E
Other HSSP Attacks
Coron and Gini [10, 11] introduced two alternative methods that reduce the complexity of the second phase from exponential to polynomial time, effectively shifting the overall computational bottleneck to the 𝑂 (𝑁 9 ) and 𝑂 (𝑁 7 (𝑁 + log 𝑐) 2 ) complexity of the first phase. The first method is a multivariate approach, which reformulates the recovery of binary vectors into a system of multivariate quadratic equations. The second method is a statistical approach, which leverages the geometric structure of parallelepipeds and the Nguyen-Regev algorithm [42] to infer the hidden binary matrix through distributional analysis. Since the specific choice of the attack algorithm does not alter the fundamental principles of our proposed privacy analysis, we refer the reader to [10, 11] for further technical details.
F
Case Study
To the best of our knowledge, relatively few works study privacy in DFL from a reconstruction perspective. Interestingly, several recent studies can be viewed as special cases of our framework under more restrictive assumptions. This connection situates our work within the existing literature and highlights the generality of our approach.
F.1
Case Study: The Reconstruction Attack by Mrini et al. [40]
The reconstruction attack proposed in [40] represents a specific instance of our framework where no SA is employed, and 𝑾 is assumed to be time-invariant and fully known. The core strategy of this attack is to exploit temporal correlations to jointly utilize observations across multiple iterations.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
By recursively expanding the aggregation and update rules in (1) and (3), the model state of corrupted nodes at iteration 𝑡 + 1 can be expressed as (𝑡 + 12 )
𝑿𝑐(𝑡 +1) = 𝑾𝑐𝑐 𝑿𝑐
(𝑡 + 12 )
= 𝑾𝑐𝑐 𝑿𝑐
(𝑡 + 21 )
= 𝑾𝑐𝑐 𝑿𝑐
(𝑡 + 21 )
+ 𝑾𝑐ℎ 𝑿ℎ
+ 𝑾𝑐ℎ (𝑿ℎ(𝑡 ) + Δ𝑿ℎ(𝑡 ) ) (𝑡 − 12 )
+ 𝑾𝑐ℎ (𝑾ℎ𝑐 𝑿𝑐
(𝑡 − 12 )
+ 𝑾ℎℎ 𝑿ℎ
) + 𝑾𝑐ℎ Δ𝑿ℎ(𝑡 )
··· (𝑡 + 21 )
= 𝑾𝑐𝑐 𝑿𝑐
+ 𝑾𝑐ℎ
𝑡 −1 ∑︁
(𝑡 −1−𝑖+ 12 )
𝑖 𝑾ℎℎ 𝑾ℎ𝑐 𝑿𝑐
𝑖=0
+ 𝑾𝑐ℎ
𝑡 ∑︁
𝑖 𝑡 (𝑾ℎℎ Δ𝑿ℎ(𝑡 −𝑖 ) ) + 𝑾𝑐ℎ 𝑾ℎℎ 𝑿ℎ(0) .
𝑖=0
To simplify the solution space, the authors introduce a quasi-static update assumption, where the local update (gradient) at each node 𝑖 is treated as a constant vector corrupted by a zero-mean random noise Δ𝒙𝑖(𝑡 ) = Δ𝒙𝑖 + 𝑵 (𝑡 ) . Under this assumption, the system can be approximated by the linear form 𝒀 ≈ 𝑨𝑩, where 𝒀 = [𝒀 (1)⊤, . . . , 𝒀 (𝑡max )⊤ ] ⊤ , which 𝒀 (𝑡 ) = Í𝑡 −1 𝑖 (𝑡 −1−𝑖+ 12 ) (𝑡 + 1 ) 𝑡 𝑿 (0) , 𝑨 = [𝑾 ⊤ , . . . , (𝑾 Í𝑡 max −1 𝑾 𝑖 ) ⊤ ] ⊤ is the cumulative weight matrix, 𝑾ℎℎ 𝑾ℎ𝑐 𝑿𝑐 𝑿𝑐(𝑡 +1) − 𝑾𝑐𝑐 𝑿𝑐 2 − 𝑾𝑐ℎ 𝑖=0 − 𝑾𝑐ℎ 𝑾ℎℎ 𝑐ℎ 𝑖=0 𝑐ℎ ℎℎ ℎ and 𝑩 = Δ𝑿ℎ is the target constant update. The adversaries then solve for the updates using the Moore-Penrose pseudo-inverse Δ𝑿ℎ ≈ 𝑨† 𝒀 . While this approach is empirically effective in certain settings, it possesses a limitation: the assumption that local updates remain approximately constant across iterations is often violated in realistic scenarios. This mismatch inevitably introduces reconstruction noise and limits the attack’s precision.
F.2
Case Study: Vulnerability of Secure Summation in Asynchronous DFL [14]
Dekker et al. [14] demonstrate that the secure summation in DFL is not inherently robust against reconstruction attacks, specifically in asynchronous settings. The vulnerability arises from the dynamic participation of nodes where, in each iteration, only a subset of active nodes participates in the summation, while inactive nodes effectively have zero updates (Δ𝒙𝑖(𝑡 ) = 0). This creates opportunities for adversaries to observe stationary 𝒙𝑖(𝑡 ) from the perspectives of different corrupted nodes across multiple rounds, thereby providing fixed reference points to isolate honest nodes’ private states. Furthermore, because the protocol performs a simple summation rather than a weighted average, the elements of the mixing matrix 𝑾 (𝑡 ) are binary, i.e., 𝑊𝑖 (𝑡𝑗 ) ∈ {0, 1}. Under the assumption of full neighbor awareness (Case 1), by colluding observations from multiple corrupted nodes and exploiting 𝒙𝑖(𝑡 ) that remain stationary over multiple rounds, the adversaries can formulate a system of linear equations. This allows for the direct recovery of part local updates by solving the resulting linear system.
G
Experimental Setup
Graph Generation. The main experiments use fixed-edge Erdős-Rényi graphs generated with NetworkX [21]. We construct connected undirected graphs and strongly connected directed graphs, each parameterized by the number of nodes 𝑛 and edges 𝑒. A fraction 𝜂 of the total nodes are randomly designated as corrupted nodes. For undirected topologies, the weight matrix 𝑾 is designed to be doubly stochastic, while for directed topologies, it is column-stochastic. To map the weights into the integer domain, we scale the matrix by a factor 𝛽, yielding ˜ = 𝛽𝑾 . 𝑾 (1)
Synthetic Data. For synthetic data evaluations, each node 𝑖 is assigned a model state 𝒙𝑖 2 ∈ Z𝑢 with dimensionality 𝑢 = 100, where the integer elements are sampled uniformly from the range [0, 100]. To simulate the finite field operations required for lattice attacks, we quantize all floating-point model parameters into integers and perform operations modulo 𝑄, where 𝑄 is a 50-bit pseudo-prime. Real Dataset and Model Architectures. We evaluate our framework across image, tabular, and text modalities. • Image Data: We use the CIFAR-10 dataset [1]. The classification model is a Convolutional Neural Network consisting of three convolutional layers (32, 64, and 128 channels with 3 × 3 kernels) followed by two fully connected layers with 512 and 10 hidden units, respectively. • Tabular Data: We use the Purchase dataset [49], which consists of 600 binary features per sample. The model is a multi-layer perceptron with two fully connected layers (256 hidden units). For visualization, the 600-dimensional tabular features are reshaped into a 24 × 25 grid.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
• Text Data: We use the Sentiment140 dataset [19] for sentiment analysis, employing a logistic regression model for sentiment classification. Unless otherwise stated, each node performs SGD with a batch size of 1 in the main experiments. This setting allows us to isolate the privacy leakage introduced by SA, which constitutes the primary stage of our attack: by neutralizing the aggregation barrier, the proposed method recovers the individual gradients of honest nodes and makes them available to existing downstream reconstruction techniques. For single-layer architectures, such as logistic regression, the corresponding input can be reconstructed exactly by taking the ratio between the weight and bias gradients associated with a given label. For deep neural networks, we apply the GIA framework of [16] to reconstruct raw images and tabular features from the recovered gradients. Although downstream gradient inversion is not the primary focus of this work, we further evaluate the transferability of our attack to more practical reconstruction settings. In Appendix J, we consider larger batchsizes and invoke several stronger GIA implementations through the Breaching[17] framework. These experiments examine whether the isolated client updates recovered by our method remain exploitable under different downstream inversion algorithms. For text-based tasks, the recovered embeddings can additionally be mapped back to natural-language sequences using vec2text [39], providing another downstream instantiation of data reconstruction. Overall, our methodology circumvents the protection provided by SA against direct access to individual client updates, thereby enabling existing gradient- and embedding-based reconstruction techniques to be applied in decentralized learning settings.
H
The Scale of the Core Sub-graphs
As illustrated in Figure 6, even when the original graph is large (e.g., consisting of 100 or 200 nodes), its inherent sparsity ensures that the topological pruning process effectively decomposes the global system into multiple independent and manageable core subgraphs. The sizes of these resulting subgraphs are predominantly concentrated within the range of 0 to 10. At this scale, HSSP-based attacks remain exceptionally efficient. Consequently, we focus our experimental evaluations on core subgraphs with a representative size of 𝑛 = 10.
(a) 𝑛 = 100, 𝑒 = 150
(b) 𝑛 = 100, 𝑒 = 200
(c) 𝑛 = 200, 𝑒 = 300
(d) 𝑛 = 200, 𝑒 = 400
Figure 6: Proportional distribution of varying core subgraph sizes following simplification in large-scale undirected networks. We additionally considered different connected graph families to examine the dependence on network topology: ER graphs, regular ring lattices, small-world graphs with rewiring probability 𝑝 = 0.1, and scale-free graphs. As shown in Figure 7, the core-subgraph sizes remain predominantly concentrated between 0 and 10 across all considered graph families. This indicates that the tendency of the simplification procedure to reduce a large network to a relatively small core is not specific to the ER topology used in our main experiments. Nevertheless, the detailed distributions vary across graph families. The ring and small-world curves are smoother and place more probability mass on smaller core sizes than the ER and scale-free curves. This suggests that their more regular local connectivity allows the simplification procedure to eliminate nodes more consistently.
I
Attack Performance on Directed Graph
Table 5 presents the experimental results for directed topologies. An observation is that the absence of the row-stochastic property makes directed graphs significantly more challenging for the adversary. Without this global summation information, it becomes difficult to distinguish between valid and invalid vector combinations, leading to a much larger set of feasible solutions compared to the undirected case. However, this ambiguity can be mitigated by utilizing the auxiliary scalars 𝑎𝑖(0) as a secondary filter. Once the candidate weight matrices are reconstructed and the corresponding model updates are derived, the adversary can validate these results against the known evolution of such scalars. This step effectively prunes a vast majority of combinations, thereby substantially increasing the probability of identifying the unique GT solution.
J
Transferability to different GIAs
We further examine whether the individual client updates recovered by our attack remain exploitable under different GIA methods and larger batchsizes. To this end, we use the unified API provided by the Breaching framework [17] to evaluate several representative GIA implementations, including [16, 59, 67]. This evaluation is intended to assess the transferability of our structural recovery attack to different downstream reconstruction methods, rather than to provide a comprehensive comparison among GIAs. We consider batchsizes
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Figure 7: Proportional distribution of varying core subgraph sizes following simplification in different graphs.
1 2 3 4 5
All Weights Found Found Vec. |F | (Case 1) |F | (Case 1 after validated by 𝑎𝑖(0) ) Step1 Time (s) Step2 Time (s) TRUE 1728 161051 77 0.168152 0.299058 TRUE 650 1331 1 0.001548 0.054637 TRUE 936 13924 8 0.001124 0.094580 TRUE 91 125 1 0.001270 0.004141 TRUE 75 256 4 0.000873 0.002860 Table 5: Performance of the NS attack in resolving the mHLCP (𝑛 = 10, 𝑒 = 30, 𝜂 = 0.7) in directed graph.
Zhu et al. [67]
Geiping et al. [16]
Yin et al. [59]
|B𝑖 |
True
Recovered
True
Recovered
True
Recovered
1 2 4 8
0.3826 / 0.0852 / 16.76 0.3983 / 0.0721 / 17.67 0.4165 / 0.0636 / 17.50 0.3206 / 0.1001 / 15.99
0.3746 / 0.0910 / 16.62 0.4149 / 0.0694 / 17.89 0.3832 / 0.0745 / 17.07 0.3064 / 0.0978 / 15.64
0.4712 / 0.1361 / 18.09 0.4961 / 0.1165 / 19.53 0.4640 / 0.1284 / 18.25 0.3639 / 0.1634 / 16.35
0.4680 / 0.1326 / 18.11 0.5000 / 0.1170 / 19.57 0.4651 / 0.1272 / 18.27 0.3740 / 0.1633 / 16.52
0.3699 / 0.0983 / 16.64 0.4721 / 0.0589 / 18.91 0.5146 / 0.0625 / 18.87 0.4366 / 0.0946 / 17.49
0.3750 / 0.1013 / 16.63 0.4998 / 0.0545 / 19.27 0.5058 / 0.0612 / 18.74 0.4350 / 0.0928 / 17.69
Table 6: Paired downstream GIA performance using the ground-truth gradient 𝒈 and the corresponding gradient 𝒈ˆ recovered by the HSSP-based attack. Each entry is mean SSIM / LPIPS / PSNR (dB) over the training images from honest nodes.
|B𝑖 | ∈ {1, 2, 4, 8}. For each setting, we compare downstream reconstruction from two inputs: the unprotected ground-truth client update 𝒈 and the corresponding update 𝒈ˆ recovered by circumventing SA. We restrict the evaluation to trials in which the HSSP-based attack ˆ In addition to successfully recovers the correct client update, thereby isolating the effect of replacing 𝒈 with its reconstructed counterpart 𝒈. PSNR and SSIM, we report the learned perceptual image patch similarity (LPIPS) metric [63] with the AlexNet backbone, for which a lower value indicates greater perceptual similarity between the reconstructed and ground-truth images. Table 6 shows that the reconstructions obtained from the recovered updates closely match those obtained directly from the groundtruth updates across the evaluated GIA methods and batch sizes. In particular, the HSSP-based recovery stage introduces little additional degradation into the downstream reconstruction process. These results indicate that downstream reconstruction performance is primarily determined by the capability of the selected GIA and the batchsize, rather than by inaccuracies introduced during update recovery. Stronger GIAs may improve the absolute reconstruction quality, but do not alter the central conclusion of this work: once the protection provided by SA is circumvented and individual client updates are exposed, existing gradient-inversion techniques can be directly applied in decentralized learning settings.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
All Weights Found Found Vec. |F | (Case 1) |F | (Case 2) |F | (Case 3) Step1 Time (s)8 Step2 Time (s) 1 TRUE 1152 30 571 1455876 0.103096 0.172203 2 TRUE 544 20 40 956736 0.000942 0.044706 3 TRUE 776 100 750 11588400 0.001284 0.079257 4 TRUE 104 3 28 22392 0.048423 0.009377 5 TRUE 360 3 12 977076 0.001345 0.023219 6 TRUE 608 5 10 260304 0.000922 0.055605 7 TRUE 640 15 60 2774016 0.000874 0.058244 8 TRUE 506 1 4 153876 0.000877 0.039568 9 FALSE 0 10 TRUE 352 28 168 475440 0.000893 0.022448 Table 7: Performance of the NS attack in resolving the mHLCP (𝑛 = 10, 𝑒 = 20, 𝜂 = 0.6) in undirected graphs. The metrics include success status, number of recovered candidate vectors, remaining vector combinations after topological filtering (Cases 1 - 3), and execution times for the two attack phases in NS attack.
K
Extended Numerical Results
(a) 𝑛 = 20, 𝑒 = 40
(b) 𝑛 = 20, 𝑒 = 60
(c) 𝑛 = 20, 𝑒 = 80
(d) 𝑛 = 20, 𝑒 = 100
Figure 8: Relationship between the ratio of corrupted nodes and the ratio of honest nodes categorized by recoverability in directed graphs.
All Weights Found Found Vec. |F | (Case 1) |F | (Case 2) |F | (Case 3) Step1 Time (s) Step2 Time (s) 1 TRUE 47 2 4 204 0.133022 0.002395 2 TRUE 15 1 1 33 0.009878 0.000770 3 TRUE 14 1 3 27 0.000837 0.000625 4 TRUE 15 1 3 36 0.000772 0.000670 5 TRUE 61 1 2 456 0.003051 0.002427 6 TRUE 88 1 2 270 0.000936 0.003373 7 TRUE 196 9 26 3480 0.001093 0.009402 8 TRUE 35 1 2 129 0.000945 0.001764 9 FALSE 0 10 TRUE 44 1 3 174 0.007832 0.001907 Table 8: Performance of the NS attack in resolving the mHLCP (𝑛 = 10, 𝑒 = 20, 𝜂 = 0.7) in undirected graphs.
L
Complete Results of Input Reconstruction
8 All timings are measured on a personal computer.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Config Recall (%) Avg. Found Vec. 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.6 90.0% 11.6 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.7 96.0% 5.3 𝑛 = 10, 𝑒 = 20, 𝜂 = 0.8 100.0% 3.2 𝑛 = 20, 𝑒 = 40, 𝜂 = 0.6 79.0% 111.8 𝑛 = 20, 𝑒 = 40, 𝜂 = 0.7 98.0% 23.6 𝑛 = 20, 𝑒 = 40, 𝜂 = 0.8 100.0% 8.1 𝑛 = 30, 𝑒 = 60, 𝜂 = 0.6 79.0% 1295.9 𝑛 = 30, 𝑒 = 60, 𝜂 = 0.7 93.0% 117.0 𝑛 = 30, 𝑒 = 60, 𝜂 = 0.8 100.0% 20.2 𝑛 = 40, 𝑒 = 80, 𝜂 = 0.6 44.0% 9183.0 𝑛 = 40, 𝑒 = 80, 𝜂 = 0.7 75.0% 489.1 𝑛 = 40, 𝑒 = 80, 𝜂 = 0.8 97.0% 56.0 Table 9: mHSSP attack performance with different configurations in undirected graphs.
All Weights Found Found Vec. |F | (Case 1) |F | (Case 2) |F | (Case 3) Step1 Time (s) Step2 Time (s) 1 TRUE 16 2 120 0.126755 0.001178 2 TRUE 6 2 6 0.000871 0.000360 3 TRUE 12 3 60 0.000684 0.000648 4 TRUE 12 30 72 0.000608 0.000525 5 TRUE 9 16 30 0.000549 0.000447 6 TRUE 12 2 24 0.000623 0.000504 7 TRUE 12 2 12 0.000537 0.000503 8 TRUE 10 8 42 0.000642 0.000498 9 TRUE 12 6 96 0.001185 0.000557 10 TRUE 5 2 6 0.000644 0.000302 Table 10: Performance of the NS attack in resolving the mHSSP (𝑛 = 10, 𝑒 = 20, 𝜂 = 0.6) in undirected graphs.
All Weights Found Found Vec. |F | (Case 1) |F | (Case 2) |F | (Case 3) Step1 Time (s) Step2 Time (s) 1 TRUE 6 2 6 0.111992 0.000508 2 TRUE 4 2 3 0.005444 0.000416 3 TRUE 4 2 3 0.000890 0.000266 4 FALSE 0 5 TRUE 5 2 3 0.000849 0.000312 6 TRUE 6 2 3 0.000995 0.000272 7 TRUE 4 1 3 0.000704 0.000307 8 TRUE 6 2 3 0.000780 0.000443 9 TRUE 4 1 3 0.000918 0.000276 10 TRUE 4 1 3 0.000622 0.000219 Table 11: Performance of the NS attack in resolving the mHSSP (𝑛 = 10, 𝑒 = 20, 𝜂 = 0.7) in undirected graph.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Figure 9: Statistical reconstruction performance on the Purchase dataset. (a) MSE between the HSSP-reconstructed gradients and the GT gradients. (b) Distribution of MSE scores for training data (binary) reconstructed from the sampled candidate gradients.
Figure 10: Statistical reconstruction performance on the Sentiment140 dataset. (a) MSE between the HSSP-reconstructed gradients and the GT gradients. (b) Distribution of cosine similarity and Rouge-L scores for training data reconstructed from the sampled candidate gradients.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Figure 11: Recall by exact Step 1 and noisy Step 1. (a) LDP and (b) CDP.
Figure 12: Reconstructed images from 30 candidate weight matrices in Case 1. The 24th entry corresponds to the true solution.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Figure 13: Reconstructed images from 30 candidate weight matrices in Case 2.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Figure 14: Reconstructed images from 30 candidate weight matrices in Case 3.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Figure 15: Reconstructed tabular data from 30 candidate weight matrices in Case 1. The 24th entry corresponds to the true solution.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Figure 16: Reconstructed tabular data from 30 candidate weight matrices in Case 2.
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Figure 17: Reconstructed tabular data from 30 candidate weight matrices in Case 3.
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Node 2
Cosine Similarity -
3 6 9
-
2 3 6 9 2 3 6 9 2 3 6 9 2
0.983 0.889 1.000 1.000 0.985 0.981 1.000 1.000 0.879 1.000 1.000 1.000 -0.096
3 6 9 2 3 6 9 2 3 6 9 2 3 6 9 2 3 6 9 2 3 6 9 2 3 6 9 2 3
0.991 1.000 1.000 0.750 0.956 1.000 0.920 0.750 0.974 1.000 0.845 0.750 0.956 1.000 0.919 0.750 0.956 1.000 0.891 0.750 0.956 1.000 0.917 0.750 0.956 1.000 0.912 0.750 0.974
Ground Truth
1
2
3
4
5
6
7
8
9
10
11
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
Recovered Text Rouge-L Crunch berries! im tired. Who wants to do something tomorrow? @LAmale really? They’re a band... good music! Where are all the banana slugs? @Jack_thm aww why not?! Heck they do the job! I can’t find those anywhere nemore either!! ur ipod ones hurt!!! Crunch berries! Who can do Tired? 0.500 What band are they on? Lamalame is a really good music band. 0.400 Where are all the banana slugs? 1.000 mmmm Why can’t anyone find them They hurt 0.323 Crunch berries! Who wants to do something tomorrow? 0.889 Really, they’re a good band! Music? 0.800 Where are all the banana slugs? 1.000 mmmm Why can’t anyone find them They hurt 0.323 Who wants to do a cranberry crunch tomorrow? 0.556 @Lameah... They’re a really good band! music 0.625 Where are all the banana slugs? 1.000 mmmm Why can’t you find them 0.276 They’re a really good band, and they’re a good music. They’re 0.000 a really good band, and they’re a good music. They’re a really good band, and they’re a good music. They’re a really good band, and they’re a good music. They’re a really good band, and they’re a good music. They’re a really good band, and they’re a really good music. They’re a really good band, and they’re a really good music @Lamamele They’re a good band, really good music! 0.706 Where are all the banana slugs? 1.000 mmmm Why can’t anyone find them They hurt 0.323 mmmm Why can’t anyone find them They hurt 0.000 @Lamem They’re a good band! 0.571 Where are all the banana slugs? 1.000 @Lammahey they’re a good band! 0.071 mmmm Why can’t you find them 0.000 @Lameah They’re a good band! 0.571 Where are all the banana slugs? 1.000 @Lamael They’re a good music band, they really are! 0.063 mmmm Why can’t anyone find them They hurt 0.000 @Lamem They’re a good band! 0.571 Where are all the banana slugs? 1.000 @Lammael They’re a good music band! 0.069 mmmm Why can’t anyone find them They hurt 0.000 @Lamem They’re a good band! 0.571 Where are all the banana slugs? 1.000 @Lmaem They’re a good one! 0.143 mmmm Why can’t anyone find them They hurt 0.000 @Lamem They’re a good band! 0.571 Where are all the banana slugs? 1.000 @Lammahey they’re a good music band! 0.069 mmmm Why can’t you find them 0.000 @Lamem They’re a good band! 0.571 Where are all the banana slugs? 1.000 @lmaem They’re a good music band! 0.069 mmmm Why can’t anyone find them They hurt 0.000 @Lameah They’re a good band! 0.571
BERTScore -0.270 0.201 1.000 -0.437 -0.152 -0.540 1.000 -0.437 0.280 -0.475 1.000 -0.498 -0.237
0.257 1.000 -0.437 -0.347 0.255 1.000 -0.031 -0.382 0.370 1.000 -0.082 -0.347 0.255 1.000 -0.002 -0.347 0.255 1.000 -0.001 -0.347 0.255 1.000 -0.048 -0.386 0.255 1.000 0.059 -0.347 0.370
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
6 9 2
1.000 0.814 0.298
3 6 9 2
0.974 1.000 1.000 0.627
3 6 9 2
0.974 1.000 1.000 -0.035
3 6 9 2
0.974 1.000 1.000 0.416
3 6 9 2
0.991 1.000 1.000 0.743
3 6 9 2 3 6 9 2
0.991 1.000 1.000 0.934 0.991 1.000 1.000 0.992
3 6 9 2 3 6 9 2 3 6
0.991 1.000 1.000 0.976 0.889 1.000 1.000 0.985 0.981 1.000
12
13
14
15
16
17
18
19
20
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Where are all the banana slugs? @Lammathey’re actually a good music band! They’re a good music band, that’s why you find them on Lmaem! @Lameah They’re a good band! Where are all the banana slugs? mmmm Why can’t you find them âAn âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âAâ âBâ âAâ âBâ âAâ âAâ . @Lameah They’re a good band! Where are all the banana slugs? mmmm Why can’t anyone find them They hurt They aren’t just LMA’s, they’re really good LMA’s!! You found them on IMDb, so why aren’t they a LMA’s? Yes, they are a LMA’s, they’re really good LMA’s!! IMDb is a LMA’s, they’re a LMA’s, they’re a good LMA’s!! @Lameah They’re a good band! Where are all the banana slugs? mmmm Why can’t anyone find them They hurt In addition to a variety of foods, there are a number of other foods that can be used to make up a healthy diet. For example, if you eat a lot of fatty foods, you may want to include a variety of vegetables in your diet. For example, if you eat a lot of fatty foods, you may want to include a variety of fruits and vegetables in your diet. For example, if you eat a lot of fatty foods, you may want to include a variety of fruits and vegetables in your diet. @Lamamele They’re a good band, really good music! Where are all the banana slugs? mmmm Why can’t you find them What is the definition of a cranberry pie? cranberry pie is a cranberry pie that is made from a combination of cranberries, peaches, pears, and other fruits and vegetables. cranberry pie is a cranberry pie that is made from a combination of cranberries, peaches, pears, and other fruits and vegetables. cranberry pie is a cranberry pie that is made from a combination of cranberries, peaches, pears, and other fruits and vegetables. @Lamamele They’re a good band, really good music! Where are all the banana slugs? mmmm Why can’t you find them Crunchy berries tomorrow. Who wants to do tomorrow? @Lamamele They’re a good band, really good music! Where are all the banana slugs? mmmm Why can’t anyone find them They hurt Crunch berries tomorrow! Tired. Who wants to do something tomorrow? @Lamamele They’re a good band, really good music! Where are all the banana slugs? mmmm Why can’t anyone find them They hurt Crumble Berry! Who can eat cranberries tomorrow? What band are they on? Lamalame is a really good music band. Where are all the banana slugs? mmmm Why can’t anyone find them They hurt Ripe berries! Who wants to do something tomorrow? Really, they’re a good band! Music? Where are all the banana slugs?
1.000 0.000 0.000
1.000 -0.115 0.055
0.571 1.000 0.276 0.000
0.370 1.000 -0.498 -0.577
0.571 1.000 0.323 0.000
0.370 1.000 -0.437 -0.082
0.571 1.000 0.323 0.038
0.370 1.000 -0.437 -0.046
0.706 1.000 0.276 0.000
0.257 1.000 -0.499 -0.172
0.706 1.000 0.276 0.667 0.706 1.000 0.323 0.900
0.257 1.000 -0.499 0.432 0.257 1.000 -0.437 0.709
0.706 1.000 0.323 0.353 0.400 1.000 0.323 0.778 0.800 1.000
0.257 1.000 -0.437 -0.292 0.201 1.000 -0.437 -0.161 -0.540 1.000
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
9 2 3 6 9 2
1.000 0.995 1.000 1.000 1.000 0.956
Node 2
Cosine Similarity -
3 6 9
-
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
mmmm Why can’t anyone find them They hurt 0.323 -0.437 Crunch berries! Tired! Who wants to do something tomorrow? 0.947 0.654 @Lame... They’re a really good band! music 0.625 -0.475 21 Where are all the banana slugs? 1.000 1.000 mmmm Why can’t you find them 0.276 -0.499 Crunch berries tomorrow! im tired. Who wants to do something 0.952 0.740 tomorrow? 22 3 1.000 @Lame... They’re a really good band! music 0.625 -0.475 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t anyone find them They hurt 0.323 -0.437 2 0.991 1.000 0.900 Crunch berries! im tired. Who wants to do something tomorrow? 23 3 1.000 @Lame... They’re a really good band! music 0.625 -0.475 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t you find them 0.276 -0.499 Crunch berries! Tired. Who wants to do something tomorrow? 0.947 0.812 2 1.000 3 1.000 @Lame... They’re a really good band! music 0.625 -0.475 24 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t you find them 0.276 -0.499 2 0.994 Crunch berries Who wants to do something tomorrow? 0.889 -0.218 3 0.981 Really, they’re a good band! Music? 0.800 -0.540 25 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t you find them 0.276 -0.499 2 0.995 Crunch berries! Who wants to do something tomorrow? 0.889 0.019 3 0.981 Really, they’re a good band! Music? 0.800 -0.540 26 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t anyone find them They hurt 0.323 -0.437 2 0.992 Crunch berries! Who wants to do something tomorrow? 0.889 -0.152 3 0.981 Really, they’re a good band! Music? 0.800 -0.540 27 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t anyone find them They hurt 0.323 -0.437 2 0.985 Crunch berries! Who wants to do something tomorrow? 0.889 0.072 3 0.889 What band are they on? Lamalame is a really good music band. 0.400 0.201 28 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t you find them 0.276 -0.499 2 0.984 Crunch berries! Who Tired? 0.429 -0.338 What band are they on? Lamalame is a really good music band. 0.400 0.201 3 0.889 29 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t you find them 0.276 -0.499 2 0.981 Crunch berries! Who wants to do something tomorrow? 0.889 0.706 3 0.889 What band are they on? Lamalame is a really good music band. 0.400 0.201 30 6 1.000 Where are all the banana slugs? 1.000 1.000 9 1.000 mmmm Why can’t anyone find them They hurt 0.323 -0.437 Table 12: Reconstructed texts from 30 candidate weight matrices in Case 1. The 24th entry corresponds to the true solution.
Ground Truth
Recovered Text Rouge-L Crunch berries! im tired. Who wants to do something tomorrow? @LAmale really? They’re a band... good music! Where are all the banana slugs? @Jack_thm aww why not?! Heck they do the job! I can’t find those anywhere nemore either!! ur ipod ones hurt!!!
BERTScore -
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
2
0.257
3
0.084
6
0.023
9 2 3
0.882 0.913 0.670
6 9
1.000 0.744
2 3
0.963 0.670
6 9
1.000 0.744
2 3
0.960 0.670
6
0.889
9 2
1.000 0.036
1
2
3
4
5
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
âAs a rule, if a person is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is a person who is able to get to know you.ââ In the past, if you had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member. âAs a result, if youâre able to get a job, youâll be able to get a job, but if youâre unable to get a job, youâll be unable to get a job. âAs a result, if youâre unable to get a job, youâll be unable to get a job. âAs a result, if youâre unable to get a job, you may need to Where are all the banana slugs? Lamma Who can Touch them âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? I dont think they can hurt your ipod, i found ones that do the job!! Crunch berries! Who can eat these âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? I dont think they can hurt your ipod, i found ones that do the job!! Crunch them! Who can do âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs in the Banana Slab? Banana slugs in the Banana Slab. Photo courtesy of the Banana Slab Museum. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Where is all the world’s population concentrated? mmmm Why can’t anyone find them They hurt âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â
0.039
-0.264
0.022
-0.369
0.000
-0.238
0.071 0.133 0.000
-0.157 -0.452 -0.402
1.000 0.216
1.000 0.174
0.375 0.000
-0.351 -0.402
1.000 0.216
1.000 0.174
0.400 0.000
-0.409 -0.402
0.174
0.350
0.323 0.000
-0.437 -0.318
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
3
0.070
6
0.014
9 2
0.882 -0.033
3
0.069
6
0.012
9 2 3
0.882 0.962 0.670
6 9
1.000 0.744
2 3
0.915 0.670
6 9 2
1.000 0.744 0.044
6
7
8
9
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
The following is a list of the most common types of cancers found in the United States. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAs a general rule, âAâ is ââââ. Where are all the banana slugs? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â The following is a list of the most common types of cancers found in the United States. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. The most common type of cancer in the United States is melanoma. In addition to the above, there are a number of other things you can do to improve the quality of your health care. For example, if you have a history of heart disease, you may need to take a course of antibiotics. For example, if you have a history of heart disease, you may need to take a course of antibiotics. For example, if you have a history of heart disease, you may need to take a course of antibiotics. For example, if you have had a history of heart disease, you may need to take a course Where are all the banana slugs? Smack Berry! Who can Fruit âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? I dont think they can hurt your ipod, i found ones that do the job!! Lamma! Who can ripe âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? I dont think they can hurt your ipod, i find one that works too!! âAs a rule of thumb, if youâre in a âno-holds-barredâ state, youâll need to be in a âno-holds-barredâ state. âAs a rule of thumb, if youâre in a âno-holds-barredâ state, youâll need to be in a âno-holds-barredâ state.âââ.
0.021
-0.307
0.000
-0.320
0.071 0.000
-0.157 -0.318
0.021
-0.307
0.038
-0.243
0.071 0.267 0.000
-0.157 -0.410 -0.402
1.000 0.216
1.000 0.174
0.143 0.000
-0.431 -0.402
1.000 0.222 0.033
1.000 0.123 -0.166
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
3
0.057
6
0.008
9 2
0.882 -0.033
3
0.055
6
0.067
9
0.361
2 3
0.929 0.670
6 9 2 3
1.000 0.971 0.916 0.670
6 9
1.000 0.744
2
0.365
10
11
12
13
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
0.020 âAs a result, a person with a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a different kind of history of the same name. âââââââââââââââââââââââââââââââââââââ 0.000 âââââ Where are all the banana slugs? 0.071 âAs a result, âAs a result, âas a result, âas a result, âas a result, 0.000 âas a result, âas a result, âas a result, âas a result, âas a result, âas a result, âas a result, âas a result, â. â. â âAs a result, a person with a history of a history of a history 0.020 of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a different kind of history of the same name. 0.000 In addition to a number of other things, if you have a history of diabetes, you may have a history of heart disease, a history of heart failure, a history of heart failure, a history of heart failure, a history of heart disease, a history of heart failure, a history of heart disease, a history of heart failure, a history of heart disease, a history of heart disease, a history of heart disease, a history of heart disease, a history of heart disease, and a history of heart attack. The most common reason for a syringe to have a syringe is 0.028 because of the syringeâs ability to âsnapâ into the syringe. The syringeâs ability to âsnapâ into the syringe is because of the syringeâs ability to âsnapâ into the syringe. The syringeâs ability to âsna Slumber band! Who’s All banana 0.125 âAlso known as âAlso known as âAlso known as âAlso known 0.000 as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? 1.000 mmmm Why can’t they find good music? 0.267 Lamma! Who can Fruit 0.143 âAlso known as âAlso known as âAlso known as âAlso known 0.000 as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? 1.000 I dont think they can hurt your ipod, i found ones that do the 0.216 job!! âââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ. 0.000 This is a list of.
-0.361
-0.585 -0.157 -0.275
-0.361
-0.321
-0.411
-0.363 -0.402
1.000 -0.426 -0.399 -0.402
1.000 0.174 -0.574
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
3
0.053
6
0.008
9 2
0.882 -0.034
3
0.063
6
-0.007
9 2 3
0.882 0.834 0.670
6 9
1.000 0.744
2 3
0.932 0.670
6
0.889
9 2 3 6 9 2
1.000 0.946 0.874 1.000 1.000 -0.004
14
15
16
17
18
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
âAs a result, a person with a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a different kind of history of the same name. âââââââââââââââââââââââââââââââââââââ âââââ Where are all the banana slugs? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â âAnother way to look at it is to look at it as if it were a teddy bear. âAnother way to look at it is to look at it as if it were a teddy bear. âAnother way to look at it is to look at it as if it were a teddy bear. âAnother way to look at it is to look at it as if it were a teddy bear. âAnother way to look at it âââââââââââââââââââââââââââââââââââââ âââââ Where are all the banana slugs? Who can find them Pain âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? I dont think they can hurt your ipod, i found ones that do the job!! Mmm! Who can ripe Fruit âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs in the Banana Slab? Banana slugs in the Banana Slab. Photo courtesy of the Banana Slab Museum. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Where is all the world’s population concentrated? mmmm Why can’t anyone find them They hurt Crunch berries! Who can do I What band is L.A. Lame? Good music, really? Where are all the banana slugs? mmmm Why can’t anyone find them They hurt âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â
0.020
-0.361
0.000
-0.585
0.071 0.000
-0.157 -0.318
0.023
-0.251
0.000
-0.585
0.071 0.133 0.000
-0.157 0.018 -0.402
1.000 0.216
1.000 0.174
0.133 0.000
-0.386 -0.402
0.174
0.350
0.323 0.500 0.353 1.000 0.323 0.000
-0.437 -0.325 0.313 1.000 -0.437 -0.318
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
3
0.059
6
-0.002
9 2
0.882 0.106
3
-0.331
6
0.054
9
0.060
2 3
0.935 0.670
6 9 2 3
1.000 0.992 0.929 0.670
6 9 2 3
1.000 0.959 0.962 0.670
6
0.889
9 2 3
1.000 0.976 0.820
6
1.000
19
20
21
22
23
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
âAs a result, a person with a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a different kind of history of the same name. âââââââââââââââââââââââââââââââââââââ âââââ Where are all the banana slugs? âAs a rule of thumb, if youâre able to get a job, youâll be able to get a job in a few weeks.â. âAs a rule of thumb, if youâre able to get a job, youâll be able to get a job in a few weeks.â. âAs a rule of thumb, youâll be able to get a job in a few weeks.â. â The most common reason for a syringe to have a syringe is because of the syringeâs ability to âsnapâ into the syringe. The syringeâs ability to âsnapâ into the syringe is because of the syringeâs ability to âsnapâ into the syringe. The syringeâs ability to âsna âAs a rule of thumb, if you have a ânoâ or ânoâ in your ânoâ or ânoâ in your ânoâ or ânoâ in your ânoâ or ânoâ in your ânoâ or ânoâ in your ânoâ or ânoâ in your ânoâ category âââââââââââââââââââââââââââââââââââââ âââââ Slumber Band! Who’s Fruit âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? Why can’t anyone find them They hurt Lamma! Who can ripe bananas? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs? mmmm Why can’t you find ones Lips! Who can Crisp berries? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Where are all the banana slugs in the Banana Slab? Banana slugs in the Banana Slab. Photo courtesy of the Banana Slab Museum. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Introduction to Banana Slugs. Where is all the world’s population concentrated? mmmm Why can’t anyone find them They hurt Crunch berries! Who can do something tomorrow? What’s the name of Lebanese band? Really good music. Lebanese band Lamala is a very good music group, with a diverse lineup of artists, including: . Where are all the banana slugs?
0.020
-0.361
0.000
-0.585
0.071 0.026
-0.157 -0.084
0.034
-0.364
0.000
-0.507
0.000
-0.655
0.133 0.000
-0.406 -0.402
1.000 0.333 0.133 0.000
1.000 0.054 -0.349 -0.402
1.000 0.345 0.133 0.000
1.000 -0.532 -0.336 -0.402
0.174
0.350
0.323 0.706 0.235
-0.437 -0.205 -0.295
1.000
1.000
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
9 2 3 24
25
6 9 2 3 6 9 2 3
26
6 9 2 27
3
6 9 2 28 3 6 9 2 29
30
3 6 9 2 3 6 9
1.000 0.887 0.670
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
mmmm Why can’t anyone find them They hurt Where are all the slime band? All bananas? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â 0.986 Where are all the banana slugs? 1.000 mmmm Why can’t anyone find them They hurt 0.750 mmmm Why can’t anyone find them They hurt 0.956 @Lamem They’re a good band! 1.000 Where are all the banana slugs? 0.919 @Lamamel They’re a good band! 0.897 Lamm! Who can They hurt 0.670 âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â 1.000 Where are all the banana slugs? 0.992 Why can’t anyone find them They hurt 0.139 In the past, if you had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member. âAs a result, âAs a result, âas a result, âas a result, âas a result, -0.028 âas a result, âas a result, âas a result, âas a result, âas a result, âas a result, âas a result, âas a result, â. â. â 0.976 Where are all the banana slugs? 0.038 âââââââââââââââââââââââââââââââââââââ âââââ 0.991 Crunch berries! im tired. Who wants to do something tomorrow? 1.000 @Lame... They’re a really good band! music 1.000 Where are all the banana slugs? 1.000 mmmm Why can’t anyone find them They hurt 0.992 Crunch berries! tired tomorrow. Who wants to do something tomorrow? 0.991 @Lamamele They’re a good band, really good music! 1.000 Where are all the banana slugs? 1.000 mmmm Why can’t you find them 0.938 Lamma! Who can eat ripe berries tomorrow? 0.874 What band is L.A. Lame? Good music, really? 1.000 Where are all the banana slugs? 1.000 mmmm Why can’t anyone find them They hurt Table 13: Reconstructed texts from 30 candidate weight matrices in Case 2.
Node 2
Cosine Similarity -
3 6
-
Ground Truth
0.323 0.000 0.000
-0.437 -0.377 -0.402
1.000 0.323 0.000 0.571 1.000 0.071 0.133 0.000
1.000 -0.437 -0.347 0.255 1.000 -0.004 -0.405 -0.402
1.000 0.333 0.021
1.000 0.054 -0.257
0.043
-0.382
1.000 0.000
1.000 -0.655
1.000
0.900
0.625 1.000 0.323 0.900
-0.475 1.000 -0.437 0.668
0.706 1.000 0.276 0.235 0.353 1.000 0.323
0.257 1.000 -0.499 -0.261 0.313 1.000 -0.437
Recovered Text Rouge-L Crunch berries! im tired. Who wants to do something tomorrow? @LAmale really? They’re a band... good music! Where are all the banana slugs? -
BERTScore -
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
1
2
3
9
-
2 3 6 9 2 3 6
0.606 0.901 0.907 0.946 0.945 0.989 0.011
9 2 3 6 9 2 3
0.889 0.897 0.659 1.000 0.973 0.869 0.670
6 9 2 3 6 9
0.941 0.717 0.916 0.386 0.955 0.744
2 3 6 9 2 3 6 9 2
0.934 0.787 0.759 0.922 0.915 0.802 0.888 0.940 0.049
3 6 9
0.905 0.946 0.441
2 3 6
0.922 0.980 0.952
4
5
6
7
8
9
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
@Jack_thm aww why not?! Heck they do the job! I can’t find those anywhere nemore either!! ur ipod ones hurt!!! YES! I can do a pair of ipod touch earpieces dont Lamma! Slim bananas are all over the band Lamma Where are all the good ones? Who can do the job! Ramma Slap berries Who They’re a really good band! African music âââââââââââââââââââââââââââââââââââââ âââââ Where are all those banana slugs? Mmm They’re awsome! Who can find mmmm Why can’t you find ones Where are all the banana slugs? mmmm They do the job! Who can find one? i’m nothin’ Where are all the banana slugs? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â Amlama Where are all those slime bananas? They’re good! Where are all the banana slugs? Lamm! Who can do Fruit Who can find the ipod crans ones?? Where are all the banana slugs? I dont think they can hurt your ipod, i found ones that do the job!! Crunchy Who can do Crunch! Who can do those mmmm Why can’t anyone find them They hurt Crunchy berries! Who can do Lamma! Who can Touch mmmm Who can do them? iPod Lamma Who can Push bananas? Mmm! Who can find âAs a result, a person with a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a history of a different kind of history of the same name. Lamma! Who can rock music tomorrow? Fruit Where are all those banana slugs? I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if Lamma! Who can rock music music? @Lameem They’re a really good band! music Where are all those banana slugs?
-
-
0.095 0.125 0.615 0.222 0.286 0.625 0.000
-0.367 -0.744 -0.642 0.110 -0.468 -0.518 -0.585
0.071 0.118 0.000 1.000 0.412 0.000 0.000
-0.154 -0.379 -0.713 1.000 0.102 0.056 -0.402
0.500 0.071 0.267 0.000 1.000 0.216
-0.449 -0.157 -0.377 -0.101 1.000 0.174
0.286 0.000 0.000 0.074 0.143 0.000 0.182 0.154 0.000
-0.488 -0.718 -0.702 -0.520 -0.400 -0.629 -0.730 -0.601 -0.216
0.133 0.833 0.068
-0.585 0.890 -0.307
0.125 0.625 0.833
-0.359 -0.496 0.890
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
10
11
12
13
9
-0.234
2 3 6 9 2 3 6 9 2 3 6 9
0.922 0.874 1.000 0.959 0.984 0.882 1.000 0.929 0.939 0.948 0.933 0.344
2 3 6 9 2 3
0.889 0.763 1.000 0.965 0.745 0.573
6
0.671
9
0.744
2 3
0.914 -0.294
6 9
0.965 0.744
2
0.842
14
15
16
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
In the past, a number of people have been diagnosed with cancer, but only a few of them have been diagnosed with cancer. In the past, a number of people have been diagnosed with cancer, but only a few of them have been diagnosed with cancer. In the past, a number of people have been diagnosed with cancer, but only a few have been diagnosed with cancer. In the past, a number of people have been diagnosed with cancer, but only a few have been diagnosed with cancer. Mmm! Who can ripe Fruit What band is L.A. Lame? Good music, really? Where are all the banana slugs? mmmm Why can’t you find ones Crunch berries Who wants to do something tomorrow? Lamm! Who can do Fruit Where are all the banana slugs? Crunchy Who can Push these Who can do At L.A.M., are they really a band? Good music! Where are they all? Where is the band Salamande? All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music, Salamande. All good music. Mmm Who can find them Pain mmmm it hurts! Who can do them? Where are all the banana slugs? mmmm Who can find one! Pain yea Who can do Where are all the slugs in Banana Lagoon? All the slugs in Banana Lagoon. Photo courtesy of the University of California, Davis. In the past few decades, the slug population in Banana Lagoon has been steadily growing, with a large number of slugs on the surface and a small number of slugs on the ground. The slug population is dominated by slugs in the family Procyonidae, which means good food. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. I dont think they can hurt your ipod, i found ones that do the job!! Lame banana band! Where are all the slugs The most common reason for a syringe to have a syringe is because the syringe is used to hold the syringe in place. The syringe is used to hold the syringe in place while the syringe is used to hold the syringe in place. The syringe is used to hold the syringe in place while the syringe is used to hold the syringe in place while the syringe is used to Where are all the banana slugs? I dont think they can hurt your ipod, i found ones that do the job!! Where is all the banana slugs?
0.018
-0.286
0.133 0.353 1.000 0.345 0.889 0.000 1.000 0.074 0.308 0.526 0.600 0.027
-0.386 0.313 1.000 -0.532 -0.178 -0.673 1.000 -0.601 0.014 0.361 0.555 -0.326
0.125 0.000 1.000 0.214 0.286 0.051
-0.388 0.005 1.000 -0.467 -0.531 -0.123
0.079
-0.122
0.216
0.174
0.000 0.025
-0.355 -0.353
1.000 0.216
1.000 0.174
0.000
0.062
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
17
3
0.573
6
0.671
9
0.744
2 3 6
0.778 0.969 0.094
9 2 3
0.915 0.903 0.398
6 9 2
1.000 0.958 0.954
3
0.795
6 9
0.943 0.617
2 3
0.606 0.390
6
0.671
9
0.744
18
19
20
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
Where are all the slugs in Banana Lagoon? All the slugs in Banana Lagoon. Photo courtesy of the University of California, Davis. In the past few decades, the slug population in Banana Lagoon has been steadily growing, with a large number of slugs on the surface and a small number of slugs on the ground. The slug population is dominated by slugs in the family Procyonidae, which means good food. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. I dont think they can hurt your ipod, i found ones that do the job!! @Lamem They’re a good band! @LamaelThey’re a really good band! The following is a list of the most common causes of death in the United States from AIDS: AIDS, AIDS-related illnesses, AIDS-related deaths, and AIDS-related deaths. AIDS-related deaths are caused by AIDS, AIDS-related illnesses, and AIDSrelated deaths. AIDS-related deaths are caused by AIDS, AIDSrelated illnesses, and AIDS-related deaths. AIDS-related deaths are caused by AIDS, AIDS-related illnesses, and AIDS-related deaths. AIDS-related deaths are caused by AIDS-related @Lamaem They’re a good band! mmmm Who can Who can find them I dont think they can hurt your ipod, i found ones that do the job!! Where are all the banana slugs? mmmm Who can do them! They hurt Cherry Bananas. Tired? Who wants to do a snack tomorrow? All the slugs are in the cranberry bushes ? YES they’re a really good band, i found lmaemoemoemmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm music Lamama Where are all those good banana slugs? I can’t find a syringe for my ipod. I can’t find a syringe for my ipod. I can’t find a syringe for my ipod. I can’t find a syringe for my ipod. I can’t find a syringe for my ipod. I can’t find a syringe for my ipod. I can’t find a syringe for my ipod. Work yea i can’t find one! hurt The following is a list of all the species of slugs that are found in the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs of the slugs. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. I dont think they can hurt your ipod, i found ones that do the job!!
0.051
-0.123
0.079
-0.122
0.216
0.174
0.000 0.429 0.024
0.075 0.278 -0.312
0.071 0.118 0.087
0.002 -0.417 0.016
1.000 0.138 0.429
1.000 0.033 0.368
0.526
-0.157
0.714 0.116
-0.409 -0.141
0.000 0.026
-0.307 -0.452
0.079
-0.122
0.216
0.174
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
2
-0.024
3
0.079
6
0.178
9
0.052
2
0.256
3
0.404
6 9
0.986 0.027
2 3 6 9 2 3 6
0.634 0.919 0.911 0.969 0.854 0.945 0.671
9
0.744
2 3 6 9 2
0.779 0.915 0.958 0.879 0.866
21
22
23
24
25
26
Wenrui Yu, Changlong Ji, Johannes Bjerva, and Qiongxiu Li
âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â In the past, if you had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member who had a family member. âAs a rule of thumb, if you have a sex license, you must have a sex license. âAs a rule of thumb, you must have a sex license. âAs a rule of thumb, you must have a sex license. âAs a rule of thumb, you must have a sex license. âAs a rule of thumb, you must have a sex license. âAs a rule of thumb, âAssuming that you have a healthy weight and a healthy body mass, you should be able to maintain a healthy weight.â. âAssuming that you have a healthy weight and a healthy body mass, you should be able to maintain a healthy weight.â. âAssuming that you have a healthy body mass, you should be able to maintain a healthy weight.â. âAssuming that you have a healthy body mass, you should be able to maintain I can’t find a painkiller for my ipod touch. I can’t find a painkiller for my ipod touch. I can’t find a painkiller for my ipod touch. I can’t find a painkiller for my ipod touch. I can’t find a painkiller for my ipod touch. I can’t find a painkiller for my ipod touch. I can’t find a painkiller for my ipod touch. The following is a list of the most common names used in the United States for the term âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlanticâ: âAtlantic. Where are all the banana slugs? âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlso known as âAlsoâââââ.â I can do mine tomorrow! someone Where’s all the bananas? Good band! Grubs! Who can find the ripe banana slugs? Why can’t one find them Who can mmmm music @Lameem they’re a really good band! ... The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. The term slug is used to refer to all slugs in the genus Sluga. I dont think they can hurt your ipod, i found ones that do the job!! A good band! Lamalame are really good music! Where are all those slime bananas? Where are all those banana slugs? Lamma Where are all those good banana slugs? Mmmm! Who can find good music They hurt
0.000
-0.318
0.022
-0.369
0.000
-0.211
0.000
-0.384
0.000
-0.123
0.054
-0.368
1.000 0.000
1.000 -0.468
0.250 0.133 0.429 0.286 0.143 0.533 0.079
-0.288 -0.001 -0.427 -0.069 -0.006 0.253 -0.122
0.216
0.174
0.000 0.000 0.833 0.067 0.111
-0.399 -0.099 0.890 -0.506 -0.293
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
27
3 6 9 2 3 6 9 2 3
28
6
9
29
30
2 3 6 9 2 3 6 9
0.925 0.920 0.937 0.913 0.760 1.000 0.926 0.876 -0.123
CCS ’26, November 15–19, 2026, The Hague, Netherlands.
A Lamma Where are all those slugs in the banana band? Lamma Where are all those good slugs? Lamma Oh, why can’t you find them Lamma Who can Touch them mmmm Why can’t you find them Where are all the banana slugs? Mmm Who can find Whoever can do pain I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’m not sure if I’ll be able to find a job that will work for me. I’ll be able to 0.821 Where are all the good-looking slugs in Banana Lagoon? Photo courtesy of the University of California, Los Angeles. All the slugs in Banana Lagoon are in the family Lamnidae, but there are only a small number of slugs in the genus Lamnidae. In recent years, there has been a dramatic resurgence of the slug population in the world’s tropical forests. 0.660 I can’t find a ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear neem ipod ear pain nee 0.916 Lame bananas! Where are all the slugs? 0.906 Lamma Who can find good 1.000 Where are all the banana slugs? 0.939 Lamma Oh, why can’t you find them? 0.795 Where is all the banana slug? 0.882 Where is the band Lalama? All good music! 0.959 Banana slugs! Where are they all? 0.775 crunch! Who can do something i dont wanna do tomorrow! Table 14: Reconstructed texts from 30 candidate weight matrices in Case 3.
0.211 0.615 0.267 0.133 0.000 1.000 0.154 0.143 0.019
-0.629 -0.513 -0.493 -0.452 -0.690 1.000 -0.663 0.063 -0.286
0.176
0.293
0.156
-0.329
0.000 0.154 1.000 0.267 0.000 0.375 0.500 0.125
-0.334 -0.752 1.000 -0.463 0.029 0.263 0.483 -0.031