Your Federated Learning Gradients Leak More Than You Think: Affine Subspace Constraints Crack Batch Reconstruction

Aggregate gradients from FC layers aren't just linear combinations of inputs — they're affine. This geometric upgrade substantially improves gradient inversion attacks, even when batch size is unknown.

Imagine you're trying to reconstruct a shredded document. Most people try to match strip edges — slow, noisy, brute-force. But what if someone told you the strips came from pages of a specific known size, with fixed margins? Suddenly you're not matching edges blindly — you're constraining the search space geometrically. That's the core mechanism here: gradient inversion attacks already knew that FC-layer gradients live in a linear subspace spanned by the input batch. This paper shows the constraint is tighter — it's an affine subspace, meaning there's a fixed offset (from the bias gradient) that pins down the geometry further. The committed claim: aggregate gradients from a fully connected layer, when correctly scaled by batch size, form an affine combination of inputs, not merely a linear one. This isn't a new attack architecture — it's a tighter mathematical characterization of what gradients already reveal, weaponized to improve existing reconstruction pipelines. The ladder here is honest but limited. The authors compare against optimization-based gradient inversion baselines (the standard approach where you optimize dummy inputs to match observed gradients). Their subspace-based methods show substantial improvement in reconstruction quality "in certain settings" — a qualifier they don't hide from. But the paper doesn't name a single current SOTA attack by its benchmark numbers and beat it head-to-head on a leaderboard. The comparisons are informative but feel curated toward settings where the subspace structure helps most. Architecturally, this sits in the analytic/closed-form family of gradient inversion — as opposed to the dominant optimization-based family (IG, DLG, Inverting Gradients). The method exploits the algebraic structure of fully connected layers specifically: the gradient of a weight matrix in an FC layer equals the outer product of the upstream gradient and the layer input, meaning the column space of the weight gradient spans (or affinely spans) the input batch. This is a constraint you can enforce via projection or intersection across layers, tightening the feasible set for reconstruction. It leans on linear algebra rather than iterative optimization, which is both its strength (exactness in the noiseless case) and its limitation (FC layers only, sensitivity to noise). The integrity picture is mixed. Validation is same-team simulation throughout — no independent replication, no pre-registered benchmarks, no community leaderboard submission. The differential privacy experiments are a welcome stress test, but the authors chose which DP noise levels to report. The batch-size overestimation result is genuinely interesting: showing that moderate overestimation preserves or even improves quality gives the attacker a practical degree of freedom. But the "certain settings" qualifier on the main result suggests the method's advantage is not universal, and the paper is honest enough to say so without being specific enough about where it fails. The milestone question for gradient inversion as a field is: at what batch size and model depth does reconstruction become pixel-perfect on natural images under realistic training conditions (mixed batches, standard DP budgets, modern architectures with LayerNorm and residual connections)? This paper operates on FC layers — the easiest case structurally. The gap to realistic transformer or ConvNet training pipelines with batch sizes in the hundreds is still large. The affine constraint is exact for FC layers but doesn't directly transfer to convolutions or attention. The experiment they didn't run: applying these subspace constraints to convolutional or attention layers, or to architectures with skip connections and normalization layers that break the clean outer-product structure. My read: (a) the math doesn't generalize cleanly, and they know it. The FC-layer result is elegant precisely because the gradient has that outer-product form. Extending to conv layers requires different algebraic machinery, and to attention layers it's an open problem. This isn't compute-limited — it's a theoretical wall they're not yet past.