Explanation of surrogate-attack degradation on class-deficient batches

Explain the sharp degradation exhibited by SME, NL-SME, and PI-SME when the client batch contains fewer classes, particularly in relation to the lower-rank update signal available for gradient inversion.

Background

The paper studies class deficiency by reducing the number of classes represented in CIFAR-100 client batches. It observes that all evaluated surrogate attacks lose reconstruction quality as the number of classes decreases, although PI-SME degrades more slowly than SME and NL-SME. The paper relates this setting to the lower rank of the final-layer update but does not provide a full explanation for the sharp performance decline shared by the surrogate methods, leaving that explanation explicitly unresolved.

References

Choosing $m$ from a principled bound rather than a sweep and explaining the sharp fall all surrogate methods show on class deficient batches remain open as scope for future work.

— A Path Integral Surrogate for Multi-Step Gradient Inversion in Federated Learning  (2610.03597 - Ghosh et al., 2 Oct 2026) in Conclusion, Section 6