  Decentralised learning has recently gained traction as an alternative to
federated learning in which both data and coordination are distributed over its
users. To preserve the confidentiality of users' data, decentralised learning
relies on differential privacy, multi-party computation, or a combination
thereof. However, running multiple privacy-preserving summations in sequence
may allow adversaries to perform reconstruction attacks. Unfortunately, current
reconstruction countermeasures either cannot trivially be adapted to the
distributed setting, or add excessive amounts of noise.
  In this work, we first show that passive honest-but-curious adversaries can
reconstruct other users' private data after several privacy-preserving
summations. For example, in subgraphs with 18 users, we show that only three
passive honest-but-curious adversaries succeed at reconstructing private data
11.0% of the time, requiring an average of 8.8 summations per adversary. The
success rate is independent of the size of the full network. We consider weak
adversaries, who do not control the graph topology and can exploit neither the
workings of the summation protocol nor the specifics of users' data.
  We develop a mathematical understanding of how reconstruction relates to
topology and propose the first topology-based decentralised defence against
reconstruction attacks. Specifically, we show that reconstruction requires a
number of adversaries linear in the length of the network's shortest cycle.
Consequently, reconstructing private data from privacy-preserving summations is
impossible in acyclic networks.
  Our work is a stepping stone for a formal theory of decentralised
reconstruction defences based on topology. Such a theory would generalise our
countermeasure beyond summation, define confidentiality in terms of entropy,
and describe the effects of (topology-aware) differential privacy.
