  Decentralised learning has recently gained traction as an alternative to
federated learning in which both data and coordination are distributed over its
users. To preserve data confidentiality, decentralised learning relies on
differential privacy, multi-party computation, or a combination thereof.
However, running multiple privacy-preserving summations in sequence may allow
adversaries to perform reconstruction attacks. Unfortunately, current
reconstruction countermeasures either cannot trivially be adapted to the
distributed setting, or add excessive amounts of noise.
  In this work, we first show that passive honest-but-curious adversaries can
infer other users' private data after several privacy-preserving summations.
For example, in subgraphs with 18 users, we show that only three passive
honest-but-curious adversaries succeed at reconstructing private data 11.0% of
the time, requiring an average of 8.8 summations per adversary. The success
rate depends only on the adversaries' direct neighbourhood, independent of the
size of the full network. We consider weak adversaries, who do not control the
graph topology and can exploit neither the inner workings of the summation
protocol nor the specifics of users' data.
  We develop a mathematical understanding of how reconstruction relates to
topology and propose the first topology-based decentralised defence against
reconstruction attacks. Specifically, we show that reconstruction requires a
number of adversaries linear in the length of the network's shortest cycle.
Consequently, reconstructing private data from privacy-preserving summations is
impossible in acyclic networks.
  Our work is a stepping stone for a formal theory of topology-based
reconstruction defences. Such a theory would generalise our countermeasure
beyond summation, define confidentiality in terms of entropy, and describe the
effects of differential privacy.
