  In contrast to prevalent Federated Learning (FL) privacy inference techniques
such as generative adversarial networks attacks, membership inference attacks,
property inference attacks, and model inversion attacks, we devise an
innovative privacy threat: the Data Distribution Decompose Attack on FL, termed
Decaf. This attack enables an honest-but-curious FL server to meticulously
profile the proportion of each class owned by the victim FL user, divulging
sensitive information like local market item distribution and business
competitiveness. The crux of Decaf lies in the profound observation that the
magnitude of local model gradient changes closely mirrors the underlying data
distribution, including the proportion of each class. Decaf addresses two
crucial challenges: accurately identify the missing/null class(es) given by any
victim user as a premise and then quantify the precise relationship between
gradient changes and each remaining non-null class. Notably, Decaf operates
stealthily, rendering it entirely passive and undetectable to victim users
regarding the infringement of their data distribution privacy. Experimental
validation on five benchmark datasets (MNIST, FASHION-MNIST, CIFAR-10,
FER-2013, and SkinCancer) employing diverse model architectures, including
customized convolutional networks, standardized VGG16, and ResNet18,
demonstrates Decaf's efficacy. Results indicate its ability to accurately
decompose local user data distribution, regardless of whether it is IID or
non-IID distributed. Specifically, the dissimilarity measured using
$L_{\infty}$ distance between the distribution decomposed by Decaf and ground
truth is consistently below 5\% when no null classes exist. Moreover, Decaf
achieves 100\% accuracy in determining any victim user's null classes,
validated through formal proof.
