Multi-Round SPEAR++: Exact Data Reconstruction from Model Updates across communication rounds in Federated Learning

Federated learning trains a model over multiple communication rounds by sharing model updates instead of the clients' training data. For models with a fully connected first layer followed by ReLU, SPEAR++ can exactly reconstruct training inputs from a model update observed in a single communication round. However, whether an honest-but-curious attacker can exploit the same client's model updates across rounds to exactly reconstruct more inputs remains unexplored. In this paper, we formulate these multiple model updates as a single reconstruction problem and derive Multi-Round SPEAR++ from this formulation. Our formulation normalizes and concatenates first-layer weight updates from observed rounds that use the same inputs, yielding a reconstruction problem structurally similar to that of SPEAR++. Multi-Round SPEAR++ then adapts the ${\ell }_1$-based reconstruction procedure used by SPEAR++ to the resulting formulation. On CIFAR-10 with $128$ inputs per client, 1000 neurons per hidden layer, and one local update per round, Multi-Round SPEAR++ reconstructs all inputs for approximately $82$ % of evaluated clients using $10$ rounds, whereas SPEAR++ using the first round almost never does. To further analyze these results, we theoretically characterize the strict local minimizers of the ${\ell }_1$-minimization problem used by both methods and use this characterization to empirically analyze reconstruction failures. These results show that evaluating reconstruction risk using only a model update observed in a single communication round can underestimate the risk.