GCA: Global Centroid Alignment in Federated Learning

Jong-Ik Park; Harry Jiang; Logan Blakely; Georgios Fragkos; Shamina Hossain-McKenzie; Carlee Joe-Wong

cs.LGAug 23, 2026

GCA: Global Centroid Alignment in Federated Learning

Authors: Jong-Ik Park, Harry Jiang, Logan Blakely, Georgios Fragkos, Shamina Hossain-McKenzie, Carlee Joe-Wong

Organizations: Carnegie Mellon University · Sandia National Laboratories

Abstract

Autoencoder (AE)-based federated learning (FL) is attractive for anomaly detection when clients have limited local data. However, conventional FL exchanges AE parameters or gradients, incurring substantial communication overhead and potentially exposing input training data information, since AEs are explicitly optimized to reconstruct their inputs. We introduce Global Centroid Alignment (GCA), a latent-code-mediated FL protocol that coordinates clients without transmitting AE parameters or gradients. In each round, (1) clients first train their local AEs using a reconstruction update and upload a small subset of encoder latent codes to the FL server. (2) The server pools these codes, fits a clustering model, and broadcasts only global latent centroids and their support counts. (3) Each client then updates its encoder by aligning its local latent codes with the nearest centroid using inverse-count weighting to emphasize globally underrepresented patterns. Steps (1)--(3) repeat over communication rounds. Because GCA exchanges only sampled latent codes and centroid statistics, its communication cost depends on latent dimensionality and the numbers of uploaded codes and returned centroids rather than on AE model size. Across five tabular and two vision benchmarks, GCA yields higher reconstruction error under a server-side client data extraction attack in all 21 comparisons and clearly lower cosine similarity in 20 of 21 comparisons with FedAvg, FedProx, and FedNova, showing its ability to protect training data. It even improves test accuracy over FedAvg by up to $5.76\%$ . GCA achieves extraction defense comparable to DP-FedAvg, remains effective when DP-FedAvg does not reduce target resemblance, and lowers per-round communication by up to $99.15\%$ .

Figures & tables

Figure 1: GCA pipeline. (1) Local training: each client trains an autoencoder on local normal data. (2) Generate/Upload Latent upload: clients generate and upload a subset of latent codes. (3) Server aggregation: the server pools latents, performs clustering, and computes global latent centroids and support counts. (4) Broadcast: the server sends centroids and support counts to participating clients. (5) Alignment: clients align their encoders to the global latent centroids using the broadcast statistics, improving cross-client consistency while keeping data and model updates private.

Figure 2: Server-side training-data extraction threat models. Top: Standard FL. The server obtains the victim reconstruction map and performs DeepDream-style input optimization. Bottom: GCA. The server receives uploaded latent codes, trains a fresh surrogate reconstruction map, and applies the same input optimization. Both attacks output the model reconstruction of the optimized input.

Figure 3: IID anomaly-detection test accuracy; higher is better. GCA outperforms Single-Client training on all seven datasets and achieves accuracy comparable to the parameter-sharing FL baselines. Bars show three-seed means and standard deviations. Full results are in Appendix E (Table 6 ).

Figure 4: Normalized target MSE (NTMSE) under the server-side extraction attack; higher is better for extraction defense. Higher NTMSE means that the attack outputs have larger reconstruction error relative to held-out normal records and are therefore less similar to the client’s training data. Bars show three-seed means and standard deviations. Full results are in Appendix E (Table 10 ).

Figure 5: Excess cosine similarity under the server-side extraction attack; lower is better for extraction defense. Lower excess cosine similarity means that the attack outputs are less similar to the client’s training data relative to held-out normal records. Bars show three-seed means and standard deviations. Full results are in Appendix E (Table 10 ).

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Method	Client objective	Communicated object	Server operation	Key setting
Single-Client	Reconstruction	None	None	10 local epochs
Centralized	Reconstruction	Pooled training data	Central training	Epoch-equivalent budget
FedAvg	Reconstruction	AE model update	Sample-size-weighted averaging	10 local epochs
FedProx	Reconstruction plus proximal term	AE model update	Sample-size-weighted averaging	Configured $\mu=10^{-2}$ ; effective coefficient $10^{-4}$
FedNova	Reconstruction	Normalized AE update	Normalized aggregation	$\tau_{i}=10n_{i}^{\mathrm{batch}}$ ; sample-size-weighted normalization
DP-FedAvg	Reconstruction	Clipped and noisy AE update	FedAvg aggregation	clip 1.0; $\sigma=1.0$

Appendix

Table 1: Implementation summary for all compared approaches.

Privacy-Preserving Federated Learning

See all 41 papers

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation
Jul 8, 2026Chongkai Li, Bang Zhang, Wenjian LuoPrivacy-Preserving ML Training Data Extraction Attacks
Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, Institute of Cyberspace Security, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, China
CRAFT: Conflict-Resolved Aggregation for Federated Training
May 20, 2026Ziqi Wang, Qiang Liu, Nils ThuereyFederated Learning Aggregation Gradient Interference
Department of Mathematics, Friedrich-Alexander-Universität Erlangen-Nürnberg, Erlangen, Germany. · School of Computation, Information and Technology, Technical University of Munich, Garching, Germany. · Munich Center for Machine Learning, Munich, Germany.
When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense
Sep 22, 2026Mohamed Shaaban, Ahmed Abdelnaby, Mohamed ElmahallawyFederated Learning Byzantine-Robust Federated Learning
School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

Jul 8, 2026J/K move · Enter open · S save

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Chongkai Li, Bang Zhang, Wenjian Luo

Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, Institute of Cyberspace Security, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, China

Privacy-Preserving ML Training Data Extraction Attacks Federated Learning

Open paper AskPDF arXiv

Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data. However, this memorization-based threat has not been systematically studied under FL environments, where multi-client averaging could overwrite encoded training data. In this paper, we study a white-box TATD attack in which a malicious server selects n target clients from K participating clients and actively writes private training data into the global model during federated training. We propose FedCVESA, a federated variant of Correlation Value Encoding Attack (CVEA), by adding a Pearson-correlation regularizer to the loss function of target clients, so that private training data are gradually encoded into selected model parameters, referred to as carrier parameters. To reduce the overwriting of carrier parameters during server aggregation, we further propose segmented aggregation over dispersed carrier parameters, preserving selected carrier parameters while keeping standard averaging on the remaining parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images from the trained model while maintaining acceptable main-task utility in a controlled proof-of-concept setting. These results demonstrate that FL can become a parameter-level memorization channel for active TATD attack under the studied white-box malicious-server setting.

Abstract

Privacy-Preserving Federated Learning

Explore similar work

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

CRAFT: Conflict-Resolved Aggregation for Federated Training

When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense