Quand les gradients révèlent des informations : portée et limites des attaques par reconstruction en apprentissage fédéré

Federated Learning (FL) enables collaborative model training without centralizing data, reducing privacy risks by sharing only model updates. Yet these updates can themselves reveal sensitive information, making FL vulnerable to reconstruction attacks that recover inputs or labels. This thesis investigates such vulnerabilities under realistic protocols considering both classification and regression tasks. It reveals that privacy risks are broader and more severe than previously assumed. Through extensive experimentation, we demonstrate that the widely adopted FedAvg protocol is far from immune. Privacy leakage is not restricted to early rounds or simple models, but instead may peak when models learn most effectively, where updates carry rich information exploitable by adversaries. This challenges the common belief that leakage decreases monotonically as training proceeds, emphasizing the need to assess privacy across the full training trajectory. We further show that the structure of client optimization can be harnessed to improve attacks: parameter trajectories in FedAvg follow geometric regularities that adversaries can exploit to stabilize and enhance reconstructions. Beyond inputs, we establish that regression labels, often sensitive continuous values such as salaries or medical measurements, are also at risk. By connecting regression leakage to the Hidden Subset Sum Problem from cryptography, we show that labels can be reconstructed efficiently, accurately, and in some cases with verifiable guarantees. Overall, this thesis presents a unified and empirically grounded examination of privacy leakage in FL. It reveals that reconstruction risk is a structural property of learning dynamics, not an artifact of simplified settings, and that it extends to both classification and regression tasks. These results will help optimize existing defenses to account for training phases, optimization geometry, and task-specific vulnerabilities, if FL is to fulfill its promise of protecting data privacy in practice.