Pith. sign in

REVIEW 3 major objections 4 minor 47 references

Geminio: Language-Guided Gradient Inversion Attacks in Federated Learning

T0 review · 3 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A malicious federated-learning server can use a text query to steer gradient inversion and recover only the private images that match, even from large batches.

desk verdict Genuinely new language-guided gradient inversion attack; works in experiments, but quantitative metrics measure gradient dominance, not reconstruction, and utility claim is unverified. read the letter →

arxiv 2411.14937 v2 pith:W6EABBBQ submitted 2024-11-22 cs.LG cs.AIcs.CR

Junjie Shan , Ziqi Zhao , Jialin Lu , Rui Zhang , Siu Ming Yiu , Ka-Ho Chow This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords gradientinversionattacksfederatedlearningvision-languagemodelsnaturallanguagequerytargeteddatareconstructionlosslandscapereshapingprivacyCLIP
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a malicious federated-learning server can turn gradient inversion into a targeted search: the attacker types a natural-language query, and the server recovers only the private images that match it, even when the victim trained on a large batch. If true, this erodes a core privacy promise of federated learning—that shared gradients reveal little about individual samples—because the attack runs in any round and does not degrade the utility of the global model. The key move is to poison the global model so that query-matched samples produce amplified losses and therefore dominate the gradients the victim returns, which any existing gradient-inversion optimizer can then exploit.

What carries the argument

The load-bearing object is the reshaped loss landscape. Geminio minimizes a ratio loss in which each auxiliary sample's cross-entropy term is scaled by $1-\alpha(x; Q, B_{aux})$, with $\alpha$ a softmax over VLM query-image similarities computed across the auxiliary batch. Minimizing this ratio forces the model to suppress loss on query-irrelevant samples, and the batch-wise normalization correspondingly raises the relative loss of matched samples; the pretrained VLM (CLIP) supplies both the query similarity scores and, through class-name similarities, the soft labels that make the auxiliary dataset unlabeled.

What would settle it

Take a query-matched image whose classification logits the poisoned model pushes far negative, making its cross-entropy loss high but its final-layer gradient near zero; if the victim-submitted gradient is then dominated by another sample, the proportional-loss premise fails and targeted reconstruction should collapse.

Watch

Extended reading notes

Core claim

The central discovery is that a pretrained vision-language model (VLM) such as CLIP can be repurposed as a supervisor for crafting a malicious global model whose loss surface has a narrow peak on samples semantically similar to the attacker's query. Geminio trains this model on an unlabeled auxiliary dataset, using VLM similarity scores to assign soft labels and to weight each sample's loss by $1-\alpha$ so that query-irrelevant samples are driven to near-zero loss while matched samples keep high loss. Because per-sample gradient magnitude is assumed proportional to per-sample loss, the victim's batch-averaged gradient ends up dominated by matched samples, and existing reconstruction optimizers recover those samples with high fidelity. The attack is task-agnostic, works at any FL round, and leaves the global model's utility unchanged because the server aggregates gradients from non-victim clients.

Load-bearing premise

The attack hinges on the assumption that a sample's gradient magnitude is proportional to its loss value, so making matched samples' losses large makes their gradients dominate the batch average.

Editorial extensions

If this is right

  • Any existing gradient-inversion optimizer (HFGradInv, InvertingGrad, DLG) can be upgraded to a targeted attack by consuming Geminio-poisoned gradients, recovering recognizable images from batches of 64–256.
  • On CIFAR-20, attack recall stays near 65% at a victim batch size of 256, while vanilla inversion becomes ineffective beyond batch size 8.
  • Geminio works under FedAvg when the server assigns a small learning rate, and it also boosts the accuracy of class-label inference, not just image reconstruction.
  • Standard defenses such as gradient pruning, Laplacian noise, and parameter-magnitude inspection fail to stop the attack at settings that preserve model utility.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the same VLM-guided loss-reshaping recipe could generalize to other data modalities such as audio, time series, or tabular records wherever a text-embedding similarity signal exists.
  • A direct test of the mechanism would compare per-sample gradient norms against per-sample losses on the poisoned model; architectures or losses where high loss does not yield high gradient norm would likely break the attack.
  • The results imply that FL servers should be treated as capable of targeted data retrieval, shifting defense research toward detecting unusual per-sample loss distributions or training dynamics rather than parameter magnitudes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces Geminio, an attack in which a malicious FL server crafts a global model, guided by a pretrained vision-language model and unlabeled auxiliary data, so that when a victim client trains on it, the per-sample losses and hence gradients of images matching a natural-language query dominate the batch-averaged gradient. Existing gradient inversion optimizers can then be applied to reconstruct those targeted images from large batches. The paper reports qualitative reconstructions on ImageNet, FER, and CIFAR-20, quantitative attack recall/precision on CIFAR-20, plugin results with DLG, InvertingGrad, and HFGradInv, and robustness experiments under FedAvg, gradient pruning, Laplacian noise, parameter inspection, loss inspection, and homomorphic encryption.

Significance. If correct, Geminio is a significant advance for gradient inversion attacks: it gives the adversary flexible, semantically meaningful control over which private samples are recovered, works as a plugin to existing reconstruction optimizers, does not modify the neural architecture, and reportedly survives several defenses. The paper's strengths include public source code, experiments across multiple datasets, architectures, FL protocols, and defense mechanisms, comparison with a label-poisoning baseline, and ablation of auxiliary data and VLM choices. The main weaknesses are that the headline quantitative metric measures gradient dominance rather than actual image reconstruction, and the central gradient-loss proportionality assumption is asserted without direct verification.

major comments (3)
  1. [Section 4.1 and Appendix E.1] The attack recall and precision metrics define success as a per-sample output-layer gradient having cosine similarity at least 0.90 with the batch-averaged gradient, not as actual image reconstruction. The threshold is chosen after observing that Fishing's 0.95 is 'overly restrictive,' so the headline numbers are partly post hoc. Since the paper's claim is that Geminio enables targeted reconstruction, the reported 64.96% recall and 65.67% precision for batch size 256 do not by themselves establish reconstruction. Please report reconstruction-grounded success for these settings (e.g., LPIPS against ground-truth matched images, or agreement with the query by a detector/captioning model) and/or clearly separate the 'gradient dominance' claim from the 'reconstruction' claim.
  2. [Section 3, paragraph after Eq. (4)] The mechanism assumes that the per-sample gradient norm is proportional to the per-sample loss value. This is not generally true: under cross-entropy with a saturated softmax, a sample can have high loss but small gradients, and per-layer gradient norms depend on activations and local derivatives, not just on the scalar loss. The entire transfer from the crafted model to any reconstruction optimizer rests on this assumption. Please add a direct measurement: on the malicious model, compare per-sample gradient norms of query-matched versus unmatched samples, ideally per layer and across batch sizes, and show that dominance holds; also verify that the reconstructed images are actually the matched samples rather than artifacts of label poisoning.
  3. [Section 4.3 and Appendix E] The claim that Geminio 'has no impact on normal training' and that the server can 'still produce a high-utility ML model' is not supported by any reported utility measurement, such as the final global model's test accuracy compared to benign FL. Because the malicious server sends a randomly initialized or adversarially reshaped model to the victim and uses only non-victim gradients for aggregation, the utility question is nontrivial, especially at early rounds. Please report the global model's test accuracy over FL rounds for Geminio versus benign training.
minor comments (4)
  1. [Appendix E.1] The statement that 'we observe multiple examples where targeted reconstruction succeeds even if the cosine similarity is below 0.90' undermines the chosen threshold; please either justify the threshold theoretically or report how many successful reconstructions fall below it.
  2. [Section 4.3, per-sample loss inspection] The text refers to 'Geminio-adaptive in Figure 5,' but Figure 5 does not appear to display this variant; please add the figure or correct the pointer.
  3. [References] Some references are malformed, for example [18] 'Yuxin Wen Jonas Geiping' and [29] 'Aidmar Wainakh...'; please normalize the bibliography entries.
  4. [Figure 13] The figure reports maximum parameter magnitudes of 2772.89 and 1000 for Fishing and GradFilt without specifying units or which layer; please clarify whether these are absolute maximum weight values and explain how GradFilt produces a parameter of magnitude 1000.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Geminio's training objective (Eq. 4) does not encode the evaluation success metric, and the evaluation uses external ground-truth labels and independent reconstruction algorithms.

full rationale

Geminio's derivation is self-contained against external benchmarks rather than circular. The malicious model is trained by minimizing Eq. 4, which amplifies the per-sample loss of query-matched auxiliary samples and suppresses that of unmatched ones, using CLIP similarity (Eq. 3) and CLIP-generated soft labels (Eq. 5). Nowhere in these equations is the evaluation success metric encoded: attack recall/precision are computed against official CIFAR-20 ground-truth subclass labels, not against the CLIP scores used to craft the model, and the 0.90 cosine threshold is an evaluation criterion adopted from prior work (Fishing), adjusted downward and stated to be conservative rather than fitted to produce a result. The bridge from loss amplification to gradient dominance is the claimed empirical property that per-sample gradient magnitude is proportional to per-sample loss value; this is an unproved and falsifiable causal assumption, not a definitional identity, and it is the paper's main correctness risk rather than a circular step. Reconstruction quality is measured with independent algorithms (HFGradInv, DLG, InvertingGrad) and LPIPS against ground-truth images, and the visual examples show actual recovered images. No model parameter is fitted to victim data or to the reported metrics, and the auxiliary dataset is drawn from validation or public sources. The paper's self-citations (Imperio and related HKU-authored works) appear only as related-work context and are not load-bearing for the central claim. Honest limitations are disclosed (e.g., the threshold is heuristic, reconstruction quality depends on the underlying optimizer, and robust defenses remain future work), but none of these indicates that the claimed result reduces to its inputs by construction.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The attack introduces no new physical or architectural entities; it relies on a pretrained VLM (CLIP) as an external tool, plus several domain assumptions about how loss magnitudes transfer to gradient magnitudes and how well VLM similarities generalize across distributions. The only hand-chosen numerical parameter that affects reported success is the cosine threshold in the evaluation metric.

free parameters (2)
  • Cosine similarity threshold for attack recall/precision = 0.90
    Chosen in Appendix E.1 after finding Fishing's 0.95 overly restrictive; the paper notes successful reconstructions can occur below 0.90, so reported recall/precision depends on this choice.
  • Victim learning rate under FedAvg = 1e-6 (example)
    Section 4.3 states the key enabler for surviving FedAvg is assigning a small learning rate to the victim; this is a server-controlled configuration, not a universal constant.
assumptions (5)
  • domain assumption Per-sample gradient magnitude is proportional to per-sample loss value
    Invoked in Section 3 to justify loss-based reshaping ('we could exploit the property...'); not proven and not strictly true for all network layers.
  • domain assumption CLIP text-image similarity reliably scores alignment between arbitrary attacker queries and images
    Used throughout Section 3.1 to compute alpha(x;Q,Baux); if the VLM misranks relevance, the malicious model amplifies the wrong samples.
  • domain assumption Soft labels from VLM class-name similarities provide sufficient supervision for training the malicious model on unlabeled auxiliary data
    Section 3.2, Eq. 5; the malicious model is trained with these soft labels, so noisy labels could break the loss surface shaping.
  • domain assumption The loss surface learned on auxiliary data transfers to the victim's private data distribution
    The method trains on an auxiliary set (e.g., ImageNet) but expects matched samples in the victim's batch to also have amplified loss; distribution shift could invalidate the attack.
  • domain assumption FL server controls the victim's learning rate and client sampling
    Needed for the FedAvg version and for avoiding history-based defenses (Section 4.3); not true in all FL deployments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Geminio: Language-Guided Gradient Inversion Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/W6EABBBQ

@misc{pith2026241114937,
  author       = {Pith},
  title        = {Pith review of: Geminio: Language-Guided Gradient Inversion Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W6EABBBQ}},
  note         = {Machine review of arXiv:2411.14937}
}
read the original abstract

Foundation models that bridge vision and language have made significant progress. While they have inspired many life-enriching applications, their potential for abuse in creating new threats remains largely unexplored. In this paper, we reveal that vision-language models (VLMs) can be weaponized to enhance gradient inversion attacks (GIAs) in federated learning (FL), where an FL server attempts to reconstruct private data samples from gradients shared by victim clients. Despite recent advances, existing GIAs struggle to reconstruct high-resolution images when the victim has a large local data batch. One promising direction is to focus reconstruction on valuable samples rather than the entire batch, but current methods lack the flexibility to target specific data of interest. To address this gap, we propose Geminio, the first approach to transform GIAs into semantically meaningful, targeted attacks. It enables a brand new privacy attack experience: attackers can describe, in natural language, the data they consider valuable, and Geminio will prioritize reconstruction to focus on those high-value samples. This is achieved by leveraging a pretrained VLM to guide the optimization of a malicious global model that, when shared with and optimized by a victim, retains only gradients of samples that match the attacker-specified query. Geminio can be launched at any FL round and has no impact on normal training (i.e., the FL server can steal clients' data while still producing a high-utility ML model as in benign scenarios). Extensive experiments demonstrate its effectiveness in pinpointing and reconstructing targeted samples, with high success rates across complex datasets and large batch sizes with resilience against defenses.

Figures

Figures reproduced from arXiv: 2411.14937 by the authors.

Figure 1
Figure 1. Geminio enables the attacker (a malicious server in FL) [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Geminio begins with a preparation phase. It receives a query from the attacker and uses a pretrained VLM and an auxiliary, [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Geminio reshapes the loss landscape of the model such [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (17 more)
Figure 4
Figure 4. Figure 4: Geminio can take task-agnostic queries from the attacker to achieve instance-level targeted reconstruction. While vanilla GIAs [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 6
Figure 6. Figure 6: Geminio remains effective even when the batch size used by the victim is large (e.g., 256). In comparison, the baseline method is virtu￾ally useless when the batch size is larger than 8. umn (2nd row), Geminio successfully recovers the first two images in the victim’s …
Figure 7
Figure 7. Figure 7: Geminio complements existing re￾construction optimization methods, turns them into targeted attacks, and improves their recon￾struction quality [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 10
Figure 10. Figure 10: By coordinating the learning rate used by the FL clients, Geminio can be launched under the FedAvg protocol. Even if the [PITH_FULL_IMAGE:figures/full_fig_p007_10.png]
Figure 11
Figure 11. Figure 11: Gradient pruning cannot mitigate Geminio unless the [PITH_FULL_IMAGE:figures/full_fig_p007_11.png]
Figure 13
Figure 13. Figure 13: Fishing and GradFilt can be detected easily by model [PITH_FULL_IMAGE:figures/full_fig_p008_13.png]
Figure 14
Figure 14. Figure 14: Targeted GIAs rely on amplifying the loss value of [PITH_FULL_IMAGE:figures/full_fig_p008_14.png]
Figure 15
Figure 15. Figure 15: Geminio consistently improves five label inference at [PITH_FULL_IMAGE:figures/full_fig_p011_15.png]
Figure 16
Figure 16. Figure 16: Label inference attacks examine the per-class gradi [PITH_FULL_IMAGE:figures/full_fig_p011_16.png]
Figure 17
Figure 17. Figure 17: By controlling one FL client, Geminio can retrieve [PITH_FULL_IMAGE:figures/full_fig_p012_17.png]
Figure 18
Figure 18. Figure 18: The training batch size used by Geminio to poison the [PITH_FULL_IMAGE:figures/full_fig_p012_18.png]
Figure 28
Figure 28. Figure 28: Effectiveness Across FL Rounds for recovery, a larger number of matched samples places greater demands on the underlying reconstruction algorithm (e.g., HFGradInv, the default in our paper). To better under￾stand this, we conducted experiments measuring the recon￾stru…
Figure 29
Figure 29. Figure 29: Query Generality Analysis F.6. Additional Visual Examples Geminio can prioritize reconstruction to recover those sam￾ples that match the attacker-provided queries. The method demonstrates consistent effectiveness across different query types and batch compositions, su…
Figure 30
Figure 30. Figure 30: Geminio is designed to enable targeted attacks, with [PITH_FULL_IMAGE:figures/full_fig_p015_30.png]
Figure 33
Figure 33. Figure 33: HFGradInv outputs without Geminio, showing de￾graded quality and loss of target-specific features [PITH_FULL_IMAGE:figures/full_fig_p015_33.png]
Figure 32
Figure 32. Figure 32: Randomly selected 128 ImageNet images used as pri [PITH_FULL_IMAGE:figures/full_fig_p015_32.png]
Figure 34
Figure 34. Figure 34: Geminio maintains high-quality reconstruction for diverse queries at a large batch size of 128. Each subfigure corresponds to a [PITH_FULL_IMAGE:figures/full_fig_p016_34.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 37 canonical work pages

  1. [1]

    When the curious abandon honesty: Federated learning is not private

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Paper- not. When the curious abandon honesty: Federated learning is not private. In2023 IEEE 8th European Symposium on Se- curity and Privacy (EuroS&P), pages 175–199. IEEE, 2023. 2, 6

    work page 2023

  2. [2]

    Reconstructing individual data points in federated learn- ing hardened with differential privacy and secure aggrega- tion

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Paper- not. Reconstructing individual data points in federated learn- ing hardened with differential privacy and secure aggrega- tion. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 241–257. IEEE, 2023. 3

    work page 2023

  3. [3]

    Imperio: Language- guided backdoor attacks for arbitrary model control

    Ka-Ho Chow, Wenqi Wei, and Lei Yu. Imperio: Language- guided backdoor attacks for arbitrary model control. In In- ternational Joint Conference on Artificial Intelligence, 2024. 3

    work page 2024

  4. [4]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 3, 5, 6, 2

    work page 2009

  5. [5]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representa- tions, 2021. 5

    2021

  6. [6]

    Challenges in representation learning: Fa- cial expression recognition challenge

    Dumitru, Ian Goodfellow, Will Cukierski, and Yoshua Bengio. Challenges in representation learning: Fa- cial expression recognition challenge. https : / / kaggle . com / competitions / challenges - in - representation - learning - facial - expression - recognition - challenge , 2013. Kaggle. 5, 2

    work page 2013

  7. [7]

    Privacy preserving machine learning with homomorphic encryption and federated learn- ing

    Haokun Fang and Quan Qian. Privacy preserving machine learning with homomorphic encryption and federated learn- ing. Future Internet, 13(4):94, 2021. 3

    work page 2021

  8. [8]

    Privacy leakage on dnns: A survey of model inversion attacks and defenses

    Hao Fang, Yixiang Qiu, Hongyao Yu, Wenbo Yu, Ji- awei Kong, Baoli Chong, Bin Chen, Xuan Wang, Shu- Tao Xia, and Ke Xu. Privacy leakage on dnns: A survey of model inversion attacks and defenses. arXiv preprint arXiv:2402.04013, 2024. 1

    arXiv 2024

Show all 47 references
  1. [9]

    Robbing the fed: Directly obtain- ing private data in federated learning with modified models

    Liam H Fowl, Jonas Geiping, Wojciech Czaja, Micah Gold- blum, and Tom Goldstein. Robbing the fed: Directly obtain- ing private data in federated learning with modified models. In International Conference on Learning Representations ,

  2. [10]

    Hiding in plain sight: Disguising data steal- ing attacks in federated learning

    Kostadin Garov, Dimitar I Dimitrov, Nikola Jovanovi ´c, and Martin Vechev. Hiding in plain sight: Disguising data steal- ing attacks in federated learning. In International Confer- ence on Learning Representations (ICLR), 2024. 2, 6, 3

    2024

  3. [11]

    What’s new in the 2023 gartner hype cy- cle for emerging technologies, 2023

    Gartner. What’s new in the 2023 gartner hype cy- cle for emerging technologies, 2023. https : / / www.gartner.com/en/articles/what-s-new- in - the - 2023 - gartner - hype - cycle - for - emerging-technologies. 1

    2023

  4. [12]

    Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural informa- tion processing systems, 33:16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dr ¨oge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural informa- tion processing systems, 33:16937–16947, 2020. 1, 2, 6, 3

    2020

  5. [13]

    Caltech- 256 object category dataset

    Gregory Griffin, Alex Holub, Pietro Perona, et al. Caltech- 256 object category dataset. Technical report, Technical Report 7694, California Institute of Technology Pasadena,

  6. [14]

    Roth, Wenqi Li, Jan Kautz, Daguang Xu, and Pavlo Molchanov

    Ali Hatamizadeh, Hongxu Yin, Holger R. Roth, Wenqi Li, Jan Kautz, Daguang Xu, and Pavlo Molchanov. Gradvit: Gradient inversion of vision transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10021–10030, 2022. 2

    2022

  7. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 5, 3

    2016

  8. [16]

    Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, Quoc V

    Andrew G. Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, Quoc V . Le, and Hartwig Adam. Searching for mobilenetv3. 2019 IEEE/CVF Interna- tional Conference on Computer Vision (ICCV), pages 1314– ...

    2019

  9. [17]

    Evaluating gradient inversion attacks and de- fenses in federated learning

    Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and de- fenses in federated learning. Advances in neural information processing systems, 34:7232–7241, 2021. 1

    2021

  10. [18]

    Breaching - a framework for attacks against privacy in federated learning ( https://github.com/JonasGeiping/ breaching), 2022

    Yuxin Wen Jonas Geiping, Liam Fowl. Breaching - a framework for attacks against privacy in federated learning ( https://github.com/JonasGeiping/ breaching), 2022. 1, 3

    2022

  11. [19]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 5, 2

    2009

  12. [20]

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICML,

  13. [21]

    Feddg: Federated domain generalization on medical image segmentation via episodic learning in continuous fre- quency space

    Quande Liu, Cheng Chen, Jing Qin, Qi Dou, and Pheng-Ann Heng. Feddg: Federated domain generalization on medical image segmentation via episodic learning in continuous fre- quency space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)...

    2021

  14. [22]

    Harmless backdoor-based client-side watermarking in federated learning

    Kaijing Luo and Ka-Ho Chow. Harmless backdoor-based client-side watermarking in federated learning. In IEEE Eu- ropean Symposium on Security and Privacy, 2025. 2

    2025

  15. [23]

    Communication- efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics , pages 1273–1282. PMLR, 2017. 1, 2, 3

    2017

  16. [24]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  17. [25]

    Dealing doubt: Unveiling threat models in gradient inversion attacks under feder- ated learning, a survey and taxonomy

    Yichuan Shi, Olivera Kotevska, Viktor Reshniak, Abhishek Singh, and Ramesh Raskar. Dealing doubt: Unveiling threat models in gradient inversion attacks under feder- ated learning, a survey and taxonomy. arXiv preprint arXiv:2405.10376, 2024. 2

    2024 arXiv

  18. [26]

    Don’t decay the learning rate, increase the batch size

    Samuel L Smith, Pieter-Jan Kindermans, Chris Ying, and Quoc V Le. Don’t decay the learning rate, increase the batch size. In International Conference on Learning Representa- tions, 2018. 1

    2018

  19. [27]

    On the efficiency of privacy attacks in federated learning

    Nawrin Tabassum, Ka-Ho Chow, Xuyu Wang, Wenbin Zhang, and Yanzhao Wu. On the efficiency of privacy attacks in federated learning. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 4226–4235, 2024. 1

    2024

  20. [28]

    Mingxing Tan and Quoc V . Le. Efficientnetv2: Smaller mod- els and faster training. In International Conference on Ma- chine Learning, 2021. 5

    2021

  21. [29]

    User label leakage from gradients in federated learning

    Aidmar Wainakh, Fabrizio Ventola, Till M ¨ußig, Jens Keim, Carlos Garcia Cordero, Ephraim Zimmer, Tim Grube, Kris- tian Kersting, and Max M¨uhlh¨auser. User label leakage from gradients in federated learning. In Privacy Enhancing Tech- nologies Symposium, 2022. 1

    2022

  22. [30]

    Federated learning with differential privacy: Algorithms and performance analysis

    Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. Federated learning with differential privacy: Algorithms and performance analysis. IEEE transactions on information forensics and security, 15:3454–3469, 2020. 3

    2020

  23. [31]

    A framework for evaluating client privacy leakages in federated learning

    Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu. A framework for evaluating client privacy leakages in federated learning. In Computer Security – ESORICS 2020: 25th Eu- ropean Symposium on Research in Computer Security, ES- ORI...

    2020

  24. [32]

    Model cloaking against gradient leakage

    Wenqi Wei, Ka-Ho Chow, Fatih Ilhan, Yanzhao Wu, and Ling Liu. Model cloaking against gradient leakage. In 2023 IEEE International Conference on Data Mining (ICDM) , pages 1403–1408. IEEE, 2023

    2023

  25. [33]

    Securing distributed sgd against gradient leak- age threats

    Wenqi Wei, Ling Liu, Jingya Zhou, Ka-Ho Chow, and Yanzhao Wu. Securing distributed sgd against gradient leak- age threats. IEEE Transactions on Parallel and Distributed Systems, 34(7):2040–2054, 2023. 3

    2023

  26. [34]

    A survey on federated learning: chal- lenges and applications

    Jie Wen, Zhixia Zhang, Yang Lan, Zhihua Cui, Jianghui Cai, and Wensheng Zhang. A survey on federated learning: chal- lenges and applications. International Journal of Machine Learning and Cybernetics, 14(2):513–535, 2023. 1

    2023

  27. [35]

    Fishing for user data in large- batch federated learning via gradient magnification

    Yuxin Wen, Jonas A Geiping, Liam Fowl, Micah Gold- blum, and Tom Goldstein. Fishing for user data in large- batch federated learning via gradient magnification. In In- ternational Conference on Machine Learning, pages 23668– 23684. PMLR, 2022. 1, 3, 6

    2022

  28. [36]

    High- fidelity gradient inversion in distributed learning

    Zipeng Ye, Wenjian Luo, Qi Zhou, and Yubo Tang. High- fidelity gradient inversion in distributed learning. In AAAI Conference on Artificial Intelligence (AAAI), 2024. 2, 3, 5, 8

    2024

  29. [37]

    See through gradients: Im- age batch recovery via gradinversion

    Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Im- age batch recovery via gradinversion. In IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR) ,

  30. [38]

    BatchCrypt: Efficient homomorphic en- cryption for Cross-Silo federated learning

    Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. BatchCrypt: Efficient homomorphic en- cryption for Cross-Silo federated learning. In 2020 USENIX annual technical conference (USENIX ATC 20), pages 493– 506, 2020. 3

    2020

  31. [39]

    Generative gradi- ent inversion via over-parameterized networks in federated learning

    Chi Zhang, Zhang Xiaoman, Ekanut Sotthiwat, Yanyu Xu, Ping Liu, Liangli Zhen, and Yong Liu. Generative gradi- ent inversion via over-parameterized networks in federated learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5126–5135, 2023. 2

    2023

  32. [40]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018. 6

    2018

  33. [41]

    A survey on gradient inversion: Attacks, defenses and future directions

    Rui Zhang, Song Guo, Junxiao Wang, Xin Xie, and Dacheng Tao. A survey on gradient inversion: Attacks, defenses and future directions. In Proceedings of the Thirty-First Inter- national Joint Conference on Artificial Intelligence , pages 5678–5685, 2023. 1

    2023

  34. [42]

    Gradfilt: Class-wise tar- geted data reconstruction from gradients in federated learn- ing

    Rui Zhang, Song Guo, and Ping Li. Gradfilt: Class-wise tar- geted data reconstruction from gradients in federated learn- ing. In Companion Proceedings of the ACM on Web Confer- ence 2024, pages 698–701, 2024. 3, 6

    2024

  35. [43]

    Federated learning for the internet of things: Applications, challenges, and op- portunities

    Tuo Zhang, Lei Gao, Chaoyang He, Mi Zhang, Bhaskar Kr- ishnamachari, and A Salman Avestimehr. Federated learning for the internet of things: Applications, challenges, and op- portunities. IEEE Internet of Things Magazine, 5(1):24–29,

  36. [44]

    Preserving data privacy in fed- erated learning through large gradient pruning.Computers & Security, 125:103039, 2023

    Zhiqiu Zhang, Zhu Tianqing, Wei Ren, Ping Xiong, and Kim-Kwang Raymond Choo. Preserving data privacy in fed- erated learning through large gradient pruning.Computers & Security, 125:103039, 2023. 3

    2023

  37. [45]

    idlg: Improved deep leakage from gradients

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610, 2020. 1

    2001 arXiv

  38. [46]

    Loki: Large-scale data reconstruction attack against feder- ated learning through model manipulation

    Joshua C Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. Loki: Large-scale data reconstruction attack against feder- ated learning through model manipulation. In 2024 IEEE Symposium on Security and Privacy (SP), pages 1287–130...

    2024

  39. [47]

    dinosaur,

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Advances in Neural Information Processing Systems (NeurIPS), 2019. 2, 6, 3 Geminio: Language-Guided Gradient Inversion Attacks in Federated Learning Supplementary Material Outline The source code of Geminio...

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.