Pith. sign in

REVIEW 3 major objections 6 minor 52 references

Shadow defense against gradient inversion attack in federated learning

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Federated-learning clients can block gradient inversion attacks with targeted image noise guided by a shadow model, cutting reconstruction quality sharply without hurting task accuracy.

desk verdict A novel image-space defense with a broad empirical sweep, undercut by an internal math/prose contradiction and an unverified vulnerability-localization mechanism; deserves peer review but needs major revision. read the letter →

arxiv 2506.15711 v1 pith:QNEEAED6 submitted 2025-05-30 cs.LG cs.AIcs.CRcs.CV

Le Jiang , Liyan Ma , Guang Yang This is my paper
classification cs.LGcs.AIcs.CRcs.CV
keywords federatedlearninggradientinversionattackprivacydefenseshadowmodelmedicalimagesnoiseinjectionGrad-CAM++
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated-learning clients normally send gradients that a curious server can invert into recognizable patient images. This paper argues that the right defense is to attack the vulnerability where it lives: find the image regions that a gradient-inversion attacker could actually reconstruct, and add noise exactly there instead of perturbing gradients blindly. To do that, each client runs a shadow model—a GAN pretrained on public data and fine-tuned on its own images to mimic an almost-optimal attacker—and uses the pixel-wise reconstruction error as a sensitivity map. Noise is then concentrated on sensitive areas while a Grad-CAM++ foreground mask softens the perturbation on task-critical anatomy, with noise amplitude growing as training progresses because attacks become stronger. On two medical datasets the method cuts whole-image reconstruction quality substantially while keeping F1 nearly unchanged, and it beats gradient-perturbation defenses across the board.

What carries the argument

The load-bearing object is the shadow model: a StyleGAN3 generator pretrained on public data, whose per-sample latent codes are first fitted to the client's images and whose generator weights are then fine-tuned on a per-sample gradient-inversion loss so that its reconstruction imitates a strong attacker. From the pixel-wise MSE map between the true image and the shadow reconstruction, the method builds a noise map through an inverse softmax, histogram equalization, momentum averaging across rounds, and a sign-scaled subtraction of the Grad-CAM++ foreground mask, with overall amplitude scaled up by training epoch. The map tells the client where an attacker could reconstruct the image, and applying that noise to the images before real local training breaks the gradient-to-image mapping that GIAs rely on.

What would settle it

Compare the per-pixel reconstruction-error map produced by an actual undefended GIA on the same images and model against the noise map this method generates: if the noise does not concentrate where the attacker reconstructs best, or if a defense-aware attacker who also fine-tunes a shadow model on the noisy gradients recovers images with near-FedAvg PSNR, the targeted-noise premise fails.

Watch

Extended reading notes

Core claim

The central claim is that targeted image-space noise guided by a shadow model provides a strictly better privacy-utility tradeoff than gradient-domain defenses. Operationally, against model-based GIA on ChestXRay the paper reports whole-image PSNR falling from 15.09 (undefended FedAvg) to 11.36 and SSIM from 0.486 to 0.286 while F1 drops only from 0.978 to 0.967; on EyePACS PSNR falls from 12.71 to 9.93 and F1 from 0.870 to 0.861. The same framework holds against optimization-based GIA, CI-Net, and a segmentation task, and it protects the foreground regions that Grad-CAM++ identifies as task-critical even though noise there is deliberately weakened. The conclusion the authors draw is that leakage risk cannot be read off gradient magnitudes alone; the spatial pattern of what an attacker can reconstruct is what must be protected.

Load-bearing premise

The defense works only if the shadow model's reconstruction-error map marks the exact pixel regions where a real gradient-inversion attacker would succeed, so that adding noise there harms the attack more than it harms the task.

Editorial extensions

If this is right

  • Against model-based GIA, whole-image PSNR drops by 3.73 dB and SSIM by 0.20 on ChestXRay, and by 2.78 dB and 0.166 on EyePACS, while F1 stays within one percentage point of undefended training.
  • The defense transfers to optimization-based GIA, to CI-Net, and to an MRI segmentation task, indicating the sensitivity-map idea is not tied to one attack family or image modality.
  • Noise amplitude that increases with training epoch matches the empirical trend that GIA grows stronger as batch-normalization statistics become accurate, so the defense stays ahead of the attack through the whole federated-learning process.
  • Because the noise is added to images rather than gradients, the method doubles as an interpretable audit tool: the maps show which anatomical regions are most leak-prone, aligning with data-minimization and transparency requirements in privacy regulation.
  • The shadow model is updated for only the first twenty global rounds, keeping the added time modest (about 720 seconds versus 566 for FedAvg on EyePACS), so the privacy gain does not require heavy per-round computation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct next step the paper does not run is an adaptive attacker who knows the noise-adding procedure and fits its own shadow model to the noisy gradients; if such an attacker recovers images almost as well as from undefended gradients, the targeted-noise advantage would shrink.
  • Because the method relies on batch-normalization statistics for attack strength, it would naturally be re-derived for architectures without BN; the paper itself notes that both GIA families fail on Vision Transformers, leaving transformer-specific inversion as an open problem the defense could be adapted to later.
  • The VGGFace2 result suggests that on natural images the Grad-CAM++ foreground is too broad or the noise too damaging; borrowing per-identity saliency maps or face-region priors could extend the method beyond medical images.
  • One testable extension is to use the same shadow-model sensitivity map to allocate a fixed privacy budget across pixels, connecting the method to differential privacy with spatially varying noise.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes ShadowDef, a federated-learning defense against gradient inversion attacks (GIAs). A StyleGAN3-based shadow model is pre-trained on public data and fine-tuned per client during FL training; its per-pixel reconstruction error against the true local image is converted into a noise map that is added to the local images before the real gradient update. Grad-CAM++ is used to reduce noise in task-relevant foreground regions, and the noise scale is scheduled to increase over training. The authors report large degradations in reconstruction quality metrics (e.g., ChestXRay whole-image PSNR 15.09 to 11.36, SSIM 0.486 to 0.286) with less than 1% F1 loss, comparing favorably with DP, gradient sparsification, clipping, Soteria, OUTPOST, and Censor on two medical datasets. Ablations, computational cost, segmentation, ViT, and additional GIA variants are covered in the main text and supplementary material.

Significance. If the central mechanism were established, the paper would contribute a genuinely different defense paradigm: instead of perturbing gradients indiscriminately, it uses an interpretable shadow model to localize privacy-sensitive image regions and injects targeted image-space noise, achieving a favorable privacy-utility tradeoff. The paper has real strengths: the code is released, the experimental scope is broad (two medical datasets, model-based and optimization-based GIA, CI-Net, MKOR, segmentation, ViT, and face images), and the reported LPIPS/SSIM gains are substantial. However, the key claim that the shadow-model error map identifies where a real GIA attacker would succeed is currently untested, and the noise-generation equations contradict the accompanying prose about which regions receive stronger noise. These are load-bearing gaps for the paper's central claim, so the result is promising but not yet established.

major comments (3)
  1. [Sec. 4.3, Eqs. (10)-(13)] The noise-generation equations and the prose are inconsistent. Eq. (10) defines N1 = softmax(M/T), where M is the pixel-wise MSE between the original image and the shadow reconstruction, and softmax is monotonically increasing in M. Eq. (12) applies histogram equalization G and another softmax; since histogram equalization is a nondecreasing transformation of N1, N2 is also monotonically increasing in M. Thus the largest noise is applied where the shadow model reconstructs worst. However, the text immediately below Eq. (13) states that "regions with smaller reconstruction errors receive stronger noises, appearing darker in the noise map N2." These claims cannot both be true. This matters directly for the paper's mechanism: the narrative is that the error map identifies where a real attacker would succeed, so noise should target those vulnerable regions. If the implementation follows the equations, the defense instead adds maximal noise where the proxy attacker fails, typically high-frequency edges and texture, and the reported privacy gains could be explained by generic high-frequency perturbation rather than by correct localization of privacy leakage. The paper must resolve this contradiction and validate the localization premise, for example by comparing the spatial correlation between M and the per-pixel reconstruction error of the actual evaluated GIA.
  2. [Sec. 4.2-4.3, Eq. (6)] The shadow model is fitted to the very images being defended. In Sec. 4.2, latent codes z_j are optimized by minimizing ||x - x_s|| on the true images, and in Eq. (6) the shadow fine-tuning loss includes L_MSE, the mean squared error between reconstructed and actual images. Consequently, the noise map M is computed from a model that has effectively seen the true image content, and the defense evaluation then measures how badly the attacker reconstructs that same true image. The reported PSNR/SSIM/LPIPS gains may therefore partly measure GAN fitting error rather than a demonstrated reduction of attack vulnerability. This is not merely a hypothetical concern: a shadow model that memorizes the defended image will produce an error map that is correlated with that image's high-frequency details, and adding noise there will trivially poison pixel-space similarity metrics. To support the paper's claim, the authors should test the defense against a defense-aware attacker, or at minimum evaluate whether the advantage persists when the shadow model is fine-tuned without L_MSE on the evaluated samples, or on a held-out client's images that were not used for noise-map fitting.
  3. [Sec. 5.2.1 and Sec. 6] The evaluation uses only non-adaptive attackers. Both the model-based GIA (GIAS) and the optimization-based GIA are run as black-box reconstruction procedures against the protected gradients, with no attempt to model, invert, or remove the defense's noise. Since the defense is conceptually a form of input perturbation, the natural and standard stress test for a GIA defense is an adaptive attacker who knows the defense algorithm and can, for example, train a denoiser on the public data or add a noise-robustness term to the inversion objective. The paper's own Section 6 claim of "state-of-the-art privacy protection" is therefore not yet supported against a determined adversary. The authors should run at least one adaptive attack experiment, even a simple one that pre-processes gradients or reconstructed images with a known-noise model, to show that the reported large PSNR/SSIM drops are not an artifact of attacking a perturbed objective with an unmodified optimizer.
minor comments (6)
  1. [Table 2 caption] The caption of Table 2 says "Comparison of our method with SOTA defense methods against model-based GIA," but the table and surrounding text report results for optimization-based GIA; the caption should be corrected.
  2. [Sec. 5.1] The temperature T of the softmax in Eq. (10) is never given a value in the hyperparameter list, although it controls the sharpness of the relative noise map; please specify it and the number of histogram-equalization bins if different from the grayscale range.
  3. [Sec. 4.3] The terminal round r_shadow is defined in the text but its default value is not listed with the other hyperparameters; the value 20 is mentioned later in Sec. 5.1, but this should be stated explicitly at the definition site.
  4. [Sec. 5.2.2, Table 3] The sentence describing the effect of removing histogram equalization reports numerical degradations "by 0.011, 0.77, 0.08, and 0.038" that do not match the differences between the w/o Equ row and the Ours row in Table 3; please check these numbers and state which metric each value refers to.
  5. [Abstract and Sec. 6] The phrase "consistently over 1.5% times in LPIPS and SSIM" is unclear and should be rewritten; also, the claim "minimal task performance degradation" is not supported by the VGGFace2 results in the supplementary material, where F1 drops from 0.916 to 0.791, so the scope of the claim should be qualified to medical-image tasks.
  6. [Throughout] There are numerous typographical and grammatical errors (e.g., "proventive", "ealier", "neccessary", "generalizale") that should be corrected during copyediting.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense noise is data-dependent through a fitted shadow model, but the privacy evaluation is against external GIA reconstructions, not against the shadow model's own output; the Eqs. (10)-(13) vs. prose inconsistency is a correctness issue, not a circular reduction.

full rationale

The paper's derivation chain is self-contained and testable. The shadow model is pretrained on public data (Section 4.2) and then fine-tuned per sample with L_shadow = D + R_TV + R_BN + R_L2 + L_MSE (Eq. 6), where L_MSE compares reconstructed and actual images. The noise map is computed from the pixel-wise error M = ||x_i - x_i^rec||^2 (Section 4.3) and applied to the local image before the true local update, after which defensive efficacy is measured by how dissimilar an independent GIA reconstruction is from the original image (Tables 1-2). None of these steps is equivalent by construction to its inputs: the attacker's reconstruction is not the shadow model's reconstruction, and the noise map is not fitted to minimize the reported PSNR/SSIM/LPIPS metrics against the actual attack. Using the client's own data to compute a defense is not circular, since privacy in FL concerns the server not receiving the data; the client is entitled to use x to choose perturbations. The paper's internal contradiction (Eqs. (10)-(13) make N2 monotonically increasing in M, while the text below Eq. (13) claims 'regions with smaller reconstruction errors receive stronger noises') and the untested premise that M correlates with real GIA success are genuine correctness/validation concerns, but they are not circular reductions of the kind defined in the review scope. I find no load-bearing self-citation (the HarmoFL reference in the Supplementary is by different authors and used only for segmentation setup) and no renamed known result; the central claim is supported by comparisons against external baselines and attack methods. Accordingly, the circularity score is 0.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several hand-set hyperparameters (noise scale gamma_N = 0.19, CAM thresholds, momentum coefficients), on the transferability of GIA loss terms to shadow-model fine-tuning, and on three domain assumptions: Grad-CAM++ marks task-critical regions, BN statistics are the main leakage channel whose accuracy grows during training, and the attacker is honest-but-curious and non-adaptive. No new physical or architectural entities are introduced; the shadow model is a standard StyleGAN3 and the noise maps are algorithmic artifacts.

free parameters (7)
  • gamma_N (absolute noise scale) = 0.19
    Controls the global magnitude of injected noise in Eq. (17)-(18); hand-set and central to the privacy-utility tradeoff.
  • Softmax temperature T
    Sharpens the initial noise map in Eq. (11); no value is reported in the paper, which is a reproducibility gap.
  • gamma_CAM_max and gamma_CAM_min = 0.1 and 0.5 (section 5.1)
    Bound the Grad-CAM++ foreground suppression in Eq. (16); with these values the min/max clamp is ill-defined.
  • T_CAM (foreground percentile) = 30%
    Top percentile of Grad-CAM++ values selected as the task-critical mask in Eqs. (8)-(9).
  • Momentum coefficients gamma_shadow_ema and gamma_noise_ema = 0.5 and 0.9
    Control history updates of the shadow model (Eq. 7) and noise map (Eq. 14); hand-set.
  • Shadow fine-tuning schedule = 20 fine-tuning epochs, updates every 20 global rounds, latent early-stop at 5, per-client LR 1e-3/2e-3/1e-4
    Training-schedule choices balancing defense strength and computational cost; reported in Section 5.1.
  • Weights of the five shadow-loss terms in Eq. (6)
    The loss L_shadow = D + R_TV + R_BN + R_L2 + L_MSE is written without weighting coefficients; unstated weighting affects the noise map.
assumptions (5)
  • domain assumption Per-sample fine-tuning of a StyleGAN3 model pretrained on a public dataset can reconstruct target-domain medical images closely enough that its reconstruction-error map localizes GIA leakage.
    Invoked in Sections 4.2-4.3; the whole noise placement depends on this transfer.
  • domain assumption Grad-CAM++ top-30% activation regions are the task-critical foreground, and suppressing noise there preserves task accuracy.
    Eqs. (8)-(9) and (15)-(16); no evaluation against alternative foreground definitions.
  • domain assumption GIA strength increases during training because BN statistics become more accurate, motivating monotonically increasing noise.
    Section 3.2 and Eq. (18), borrowed from Hatamizadeh et al. 2023.
  • domain assumption Attackers are honest-but-curious and non-adaptive, with no knowledge of the noise-injection scheme.
    Section 3.2 footnote and Section 4.1; the paper cites GGL on defense imitation but does not evaluate a defense-aware attacker.
  • domain assumption The attack loss terms (D, R_TV, R_BN, R_L2) transferred to shadow fine-tuning in Eq. (6) are a faithful proxy for a real attacker's optimization objective.
    Eq. (6); the shadow model is assumed to imitate an almost optimal adversary (Section 4.3).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Shadow defense against gradient inversion attack in federated learning." pith.science (2026). https://pith.science/paper/QNEEAED6

@misc{pith2026250615711,
  author       = {Pith},
  title        = {Pith review of: Shadow defense against gradient inversion attack in federated learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QNEEAED6}},
  note         = {Machine review of arXiv:2506.15711}
}
read the original abstract

Federated learning (FL) has emerged as a transformative framework for privacy-preserving distributed training, allowing clients to collaboratively train a global model without sharing their local data. This is especially crucial in sensitive fields like healthcare, where protecting patient data is paramount. However, privacy leakage remains a critical challenge, as the communication of model updates can be exploited by potential adversaries. Gradient inversion attacks (GIAs), for instance, allow adversaries to approximate the gradients used for training and reconstruct training images, thus stealing patient privacy. Existing defense mechanisms obscure gradients, yet lack a nuanced understanding of which gradients or types of image information are most vulnerable to such attacks. These indiscriminate calibrated perturbations result in either excessive privacy protection degrading model accuracy, or insufficient one failing to safeguard sensitive information. Therefore, we introduce a framework that addresses these challenges by leveraging a shadow model with interpretability for identifying sensitive areas. This enables a more targeted and sample-specific noise injection. Specially, our defensive strategy achieves discrepancies of 3.73 in PSNR and 0.2 in SSIM compared to the circumstance without defense on the ChestXRay dataset, and 2.78 in PSNR and 0.166 in the EyePACS dataset. Moreover, it minimizes adverse effects on model performance, with less than 1\% F1 reduction compared to SOTA methods. Our extensive experiments, conducted across diverse types of medical images, validate the generalization of the proposed framework. The stable defense improvements for FedAvg are consistently over 1.5\% times in LPIPS and SSIM. It also offers a universal defense against various GIA types, especially for these sensitive areas in images.

Figures

Figures reproduced from arXiv: 2506.15711 by the authors.

Figure 1
Figure 1. (a) Basic pipeline of gradient inversion attack and drawbacks of defense methods. The curious server reconstructs dummy images ˆx and labels ˆy to mimic training data from clients based on their uploaded gradients g of the global model f0. The gradient inversion loss D is calculated between g and dummy gradients ˆg. Model-based GIA additionally uses GAN to recover these images. Four challenges are in existing GIA de… view at source ↗
Figure 2
Figure 2. The overall framework of our method. In the first pretraining stage, the shadow model and latent codes are updated to accelerate the FL local training by fitting low-frequency components (Bu et al. (2023)). In the second stage, local training is first performed to generate victim gradients g. The top branch produces foreground map LCAM to imply task-dominant areas. For the lower branch, model weights of the image ge… view at source ↗
Figure 3
Figure 3. The updating process of reconstructed images at the pre-training stage for latent codes. In the first three rows, three columns represent original images, reconstructive error maps, frequency spectrum of reconstructive error maps, in sequence. In practical applications, it is difficult for adversaries to esti￾mate precise style information for each image (Li et al. (2022b); Jeon et al. (2021)). Consequently, an earl… view at source ↗
Figures from the paper (27 more)
Figure 4
Figure 4. Figure 4: Evolution of foreground map during training. Core con￾cerns of task models are moved from random regions to fore￾ground ones gradually. For the ChestXRay dataset (Chowdhury et al. (2020); Rahman et al. (2021)), most foreground regions locate inside or around the border…
Figure 5
Figure 5. Figure 5: Visualization of various types of noise and images. X, Xrec, X N are original images, reconstructed images, and noisy images, respectively. M is the error map between X and Xrec. N 1 is the initial relative noise. N 2 is generated by histogram equalization based on N 1…
Figure 6
Figure 6. Figure 6: Comparison of F1 curve during FL training for differ￾ence methods. F1 values of the global model are calculated based on an independent test set. ‘Fix’, ‘Increase’, ‘Decrease’ corresponds to fixing, decreasing and increasing the amplitude of final noise N during FL tra…
Figure 7
Figure 7. Figure 7: Comparison of RDLV curve for difference methods on all clients under model-based GIA. RDLV represents privacy reveal degree compared with a template image (Hatamizadeh et al. (2023)). If RDLV is less than 0, privacy leakage is negligible [PITH_FULL_IMAGE:figures/full_…
Figure 8
Figure 8. Figure 8: Effect of noise adjustment strategy on GIA. ‘FedAvg’ represents the method without defense. ‘Fix’, ‘Decrease’, ‘In￾crease’ corresponds to fixing, decreasing and increasing the ab￾solute noise amplitude our method during FL training, respec￾tively. Dynamic adjustment of…
Figure 9
Figure 9. Figure 9: Reconstructed images of the ChestXRay dataset from optimization-based GIA. ‘Rec Img’, ‘Rec Diff’, ‘FFT diff’ represent reconstructed images, reconstructive error maps, frequency spectrum of reconstructive error maps, respectively. The numbers indicate PSNR between the …
Figure 10
Figure 10. Figure 10: Reconstructed images of the EyePACS dataset from optimization-based GIA ‘Rec Img’, ‘Rec Diff’, ‘FFT diff’ represent reconstructed images, reconstructive error maps, frequency spectrum of reconstructive error maps, respectively. The numbers indicate PSNR between the or…
Figure 1
Figure 1. Figure 1: Comparison of FFT phase for ’Rec Diff’ in Fig.9 and Fig.10 of the main text [PITH_FULL_IMAGE:figures/full_fig_p018_1.png]
Figure 2
Figure 2. Figure 2: Comparison of gradient distribution for difference methods across model layers. For each subfigure, the x-axis corresponds to gradient values while the y-axis corresponds to frequency of gradient values. The first to the last rows correspond to the shallowest to the de…
Figure 3
Figure 3. Figure 3: Comparison of RDLV curve for difference methods on all clients under optimization-based GIA [PITH_FULL_IMAGE:figures/full_fig_p020_3.png]
Figure 4
Figure 4. Figure 4: Vulnerable images in the ChestXRay dataset. ception, effectively defending against such attacks for all but client 9’s dataset. For optimization-based GIA, early training stages also present challenges for effective attacks. However, by later stages, except for DP and …
Figure 5
Figure 5. Figure 5: Vulnerable images in the EyePACS dataset [PITH_FULL_IMAGE:figures/full_fig_p022_5.png]
Figure 6
Figure 6. Figure 6: Reconstructed images from model-based GIA at 1st global round on the ChestXRay dataset. 1 2 3 4 5 6 7 8 9Client FedAvg DP GS GC Soteria Outpost Ours [PITH_FULL_IMAGE:figures/full_fig_p023_6.png]
Figure 7
Figure 7. Figure 7: Reconstructed images from model-based GIA at 50th global round on the ChestXRay dataset [PITH_FULL_IMAGE:figures/full_fig_p023_7.png]
Figure 8
Figure 8. Figure 8: Reconstructed images from model-based GIA at 100th global round on the ChestXRay dataset. worse on defensive metrics. To find out the reason, we show reconstructed images based on ViT. Due to a lack of batch nor￾malization layer, GIA methods do not work even in FedAvg …
Figure 9
Figure 9. Figure 9: Reconstructed images from optimization-based GIA at 1st global round on the ChestXRay dataset [PITH_FULL_IMAGE:figures/full_fig_p025_9.png]
Figure 10
Figure 10. Figure 10: Reconstructed images from optimization-based GIA at 100th global round on the ChestXRay dataset [PITH_FULL_IMAGE:figures/full_fig_p026_10.png]
Figure 11
Figure 11. Figure 11: Reconstructed images from model-based GIA at 1st global round on the EyePACS dataset. 6. GIA defense on non-medical images To test our framework in non-image datasets, we test it on the VGGFace2 dataset Cao et al. (2018). We choose 10 identi￾ties (classes) with most n…
Figure 12
Figure 12. Figure 12: Reconstructed images from model-based GIA at 50th global round on the EyePACS dataset [PITH_FULL_IMAGE:figures/full_fig_p028_12.png]
Figure 13
Figure 13. Figure 13: Reconstructed images from model-based GIA at 100th global round on the EyePACS dataset [PITH_FULL_IMAGE:figures/full_fig_p029_13.png]
Figure 14
Figure 14. Figure 14: Reconstructed images from optimization-based GIA at 1st global round on the EyePACS dataset [PITH_FULL_IMAGE:figures/full_fig_p030_14.png]
Figure 15
Figure 15. Figure 15: Reconstructed images from optimization-based GIA at 100th global round on the EyePACS dataset. 1 2 3 4 5 6Client FedAvg Ours FedAvg Ours Model-based GIA Optimization-based GIA [PITH_FULL_IMAGE:figures/full_fig_p031_15.png]
Figure 16
Figure 16. Figure 16: Reconstructed images of the prostate dataset [PITH_FULL_IMAGE:figures/full_fig_p031_16.png]
Figure 17
Figure 17. Figure 17: Reconstructed images based on ViT. Client FedAvg Ours 1 2 3 4 5 6 7 8 9 [PITH_FULL_IMAGE:figures/full_fig_p032_17.png]
Figure 18
Figure 18. Figure 18: Reconstructed images from CI-Net on the ChestXRay dataset. Client FedAvg 1 2 3 4 5 6 7 8 9 [PITH_FULL_IMAGE:figures/full_fig_p032_18.png]
Figure 19
Figure 19. Figure 19: Reconstructed images from MKOR on the ChestXRay dataset [PITH_FULL_IMAGE:figures/full_fig_p032_19.png]
Figure 20
Figure 20. Figure 20: Reconstructed images based on the VGGFace2 dataset [PITH_FULL_IMAGE:figures/full_fig_p033_20.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 45 canonical work pages

  1. [1]

    , author Chu, A

    author Abadi, M. , author Chu, A. , author Goodfellow, I. , author McMahan, H.B. , author Mironov, I. , author Talwar, K. , author Zhang, L. , year 2016 . title Deep learning with differential privacy , in: booktitle Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pp. pages 308--318

    work page 2016

  2. [2]

    , author Ivanov, V

    author Bonawitz, K. , author Ivanov, V. , author Kreuter, B. , author Marcedone, A. , author McMahan, H.B. , author Patel, S. , author Ramage, D. , author Segal, A. , author Seth, K. , year 2017 . title Practical secure aggregation for privacy-preserving machine learning , in: booktitle proceedings of the 2017 ACM SIGSAC Conference on Computer and Communi...

    work page 2017

  3. [3]

    , author Huang, D

    author Bu, Q. , author Huang, D. , author Cui, H. , year 2023 . title Towards building more robust models with frequency bias , in: booktitle Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. pages 4402--4411

    work page 2023

  4. [4]

    , author Shen, L

    author Cao, Q. , author Shen, L. , author Xie, W. , author Parkhi, O.M. , author Zisserman, A. , year 2018 . title Vggface2: A dataset for recognising faces across pose and age , in: booktitle 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018) , organization IEEE . pp. pages 67--74

    work page 2018

  5. [5]

    , author Li, W

    author Cardoso, M.J. , author Li, W. , author Brown, R. , author Ma, N. , author Kerfoot, E. , author Wang, Y. , author Murrey, B. , author Myronenko, A. , author Zhao, C. , author Yang, D. , et al., year 2022 . title Monai: An open-source framework for deep learning in healthcare . journal arXiv preprint arXiv:2211.02701

    arXiv 2022

  6. [6]

    , author Zhu, T

    author Chang, W. , author Zhu, T. , year 2024 . title Gradient-based defense methods for data leakage in vertical federated learning . journal Computers & Security volume 139 , pages 103744

    work page 2024

  7. [7]

    , author Sarkar, A

    author Chattopadhay, A. , author Sarkar, A. , author Howlader, P. , author Balasubramanian, V.N. , year 2018 . title Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks , in: booktitle 2018 IEEE winter conference on applications of computer vision (WACV) , organization IEEE . pp. pages 839--847

    2018

  8. [8]

    , author Rahman, T

    author Chowdhury, M.E. , author Rahman, T. , author Khandakar, A. , author Mazhar, R. , author Kadir, M.A. , author Mahbub, Z.B. , author Islam, K.R. , author Khan, M.S. , author Iqbal, A. , author Al Emadi, N. , et al., year 2020 . title Can ai help in screening viral and covid-19 pneumonia? journal Ieee Access volume 8 , pages 132665--132676

    work page 2020

Show all 52 references
  1. [9]

    , author Chen, B

    author Fang, H. , author Chen, B. , author Wang, X. , author Wang, Z. , author Xia, S.T. , year 2023 . title Gifd: A generative gradient inversion method with feature domain optimization , in: booktitle Proceedings of the IEEE/CVF International Conference on Computer Vision , ...

    2023

  2. [10]

    , author Jain, T

    author Garg, P. , author Jain, T. , year 2017 . title A comparative study on histogram equalization and cumulative histogram equalization . journal International Journal of New Technology and Research volume 3 , pages 263242

    2017

  3. [11]

    , year 2016

    author GDPR, G.D.P.R. , year 2016 . title General data protection regulation . journal Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free mo...

    2016

  4. [12]

    , author Mou, Y

    author Geng, J. , author Mou, Y. , author Li, Q. , author Li, F. , author Beyan, O. , author Decker, S. , author Rong, C. , year 2023 . title Improved gradient inversion attacks and defenses in federated learning . journal IEEE Transactions on Big Data

    2023

  5. [13]

    , author Klein, T

    author Geyer, R.C. , author Klein, T. , author Nabi, M. , year 2017 . title Differentially private federated learning: A client level perspective . journal arXiv preprint arXiv:1712.07557

    2017 arXiv

  6. [14]

    , author Yin, H

    author Hatamizadeh, A. , author Yin, H. , author Molchanov, P. , author Myronenko, A. , author Li, W. , author Dogra, P. , author Feng, A. , author Flores, M.G. , author Kautz, J. , author Xu, D. , et al., year 2023 . title Do gradient inversion attacks make federated learning...

    2023

  7. [15]

    , author Gupta, S

    author Huang, Y. , author Gupta, S. , author Song, Z. , author Li, K. , author Arora, S. , year 2021 . title Evaluating gradient inversion attacks and defenses in federated learning . journal Advances in neural information processing systems volume 34 , pages 7232--7241

    2021

  8. [16]

    , author Prakash, K.B

    author Imambi, S. , author Prakash, K.B. , author Kanagachidambaresan, G. , year 2021 . title Pytorch . journal Programming with TensorFlow: solution for edge computing applications , pages 87--104

    2021

  9. [17]

    , author Lee, K

    author Jeon, J. , author Lee, K. , author Oh, S. , author Ok, J. , et al., year 2021 . title Gradient inversion with generative image prior . journal Advances in neural information processing systems volume 34 , pages 29898--29908

    2021

  10. [18]

    , author Kale, S

    author Karimireddy, S.P. , author Kale, S. , author Mohri, M. , author Reddi, S. , author Stich, S. , author Suresh, A.T. , year 2020 . title Scaffold: Stochastic controlled averaging for federated learning , in: booktitle International conference on machine learning , organiz...

    2020

  11. [19]

    , author Aittala, M

    author Karras, T. , author Aittala, M. , author Laine, S. , author H \"a rk \"o nen, E. , author Hellsten, J. , author Lehtinen, J. , author Aila, T. , year 2021 . title Alias-free generative adversarial networks . journal Advances in neural information processing systems volu...

    2021

  12. [20]

    , author Bengio, Y

    author LeCun, Y. , author Bengio, Y. , author Hinton, G. , year 2015 . title Deep learning . journal nature volume 521 , pages 436--444

    2015

  13. [21]

    , author Wang, L

    author Li, Z. , author Wang, L. , author Chen, G. , author Zhang, Z. , author Shafiq, M. , author Gu, Z. , year 2022 a. title E2egi: End-to-end gradient inversion in federated learning . journal IEEE Journal of Biomedical and Health Informatics volume 27 , pages 756--767

    2022

  14. [22]

    , author Zhang, J

    author Li, Z. , author Zhang, J. , author Liu, L. , author Liu, J. , year 2022 b. title Auditing privacy defenses in federated learning via generative gradient leakage , in: booktitle Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. pages...

    2022

  15. [23]

    , author Li, Y

    author Liang, H. , author Li, Y. , author Zhang, C. , author Liu, X. , author Zhu, L. , year 2023 . title Egia: An external gradient inversion attack in federated learning . journal IEEE Transactions on Information Forensics and Security

    2023

  16. [24]

    , author Moore, E

    author McMahan, B. , author Moore, E. , author Ramage, D. , author Hampson, S. , author y Arcas, B.A. , year 2017 . title Communication-efficient learning of deep networks from decentralized data , in: booktitle Artificial intelligence and statistics , organization PMLR . pp. ...

    2017

  17. [25]

    , author Ramage, D

    author McMahan, H.B. , author Ramage, D. , author Talwar, K. , author Zhang, L. , year 2018 . title Learning differentially private recurrent language models , in: booktitle International Conference on Learning Representations

    2018

  18. [26]

    , author Khandakar, A

    author Rahman, T. , author Khandakar, A. , author Qiblawey, Y. , author Tahir, A. , author Kiranyaz, S. , author Kashem, S.B.A. , author Islam, M.T. , author Al Maadeed, S. , author Zughaier, S.M. , author Khan, M.S. , et al., year 2021 . title Exploring the effect of image en...

    2021

  19. [27]

    , author Li, A

    author Sun, J. , author Li, A. , author Wang, B. , author Yang, H. , author Li, H. , author Chen, Y. , year 2021 . title Soteria: Provable defense against privacy leakage in federated learning from representation perspective , in: booktitle Proceedings of the IEEE/CVF conferen...

    2021

  20. [28]

    , author Vermeer, K.A

    author de Vente, C. , author Vermeer, K.A. , author Jaccard, N. , author Wang, H. , author Sun, H. , author Khader, F. , author Truhn, D. , author Aimyshev, T. , author Zhanibekuly, Y. , author Le, T.D. , author Galdran, A. , author Gonz\'alez Ballester, M.A. , author Carneiro...

    2023 arXiv

  21. [29]

    , author Hugh, E

    author Wang, F. , author Hugh, E. , author Li, B. , year 2024 a. title More than enough is too much: Adaptive defenses against gradient leakage in production federated learning . journal IEEE/ACM Transactions on Networking

    2024

  22. [30]

    , author Velipasalar, S

    author Wang, F. , author Velipasalar, S. , author Gursoy, M.C. , year 2024 b. title Maximum knowledge orthogonality reconstruction with gradients in federated learning , in: booktitle Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pp. pages ...

    2024

  23. [31]

    , author Wang, H

    author Wang, Z. , author Wang, H. , author Jin, S. , author Zhang, W. , author Hu, J. , author Wang, Y. , author Sun, P. , author Yuan, W. , author Liu, K. , author Ren, K. , year 2023 . title Privacy-preserving adversarial facial features , in: booktitle Proceedings of the IE...

    2023

  24. [32]

    , author Liu, L

    author Wei, W. , author Liu, L. , author Wu, Y. , author Su, G. , author Iyengar, A. , year 2021 . title Gradient-leakage resilient federated learning , in: booktitle 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS) , organization IEEE . pp. pag...

    2021

  25. [33]

    , author Chen, X

    author Wu, R. , author Chen, X. , author Guo, C. , author Weinberger, K.Q. , year 2023 . title Learning to invert: Simple adaptive attacks for gradient inversion in federated learning , in: booktitle Uncertainty in Artificial Intelligence , organization PMLR . pp. pages 2293--2303

    2023

  26. [34]

    , author Hong, C

    author Xu, J. , author Hong, C. , author Huang, J. , author Chen, L.Y. , author Decouchant, J. , year 2022 . title Agic: Approximate gradient inversion attack on federated learning , in: booktitle 2022 41st International Symposium on Reliable Distributed Systems (SRDS) , organ...

    2022

  27. [35]

    , author Mallya, A

    author Yin, H. , author Mallya, A. , author Vahdat, A. , author Alvarez, J.M. , author Kautz, J. , author Molchanov, P. , year 2021 . title See through gradients: Image batch recovery via gradinversion , in: booktitle Proceedings of the IEEE/CVF conference on computer vision a...

    2021

  28. [36]

    , author Yang, C

    author Yue, G. , author Yang, C. , author Zhao, Z. , author An, Z. , author Yang, Y. , year 2023 . title Ergpnet: lesion segmentation network for covid-19 chest x-ray images based on embedded residual convolution and global perception . journal Frontiers in Physiology volume 1...

    2023

  29. [37]

    , author Ekanut, S

    author Zhang, C. , author Ekanut, S. , author Zhen, L. , author Li, Z. , year 2022 . title Augmented multi-party computation against gradient leakage in federated learning . journal IEEE Transactions on Big Data

    2022

  30. [38]

    , author Xiaoman, Z

    author Zhang, C. , author Xiaoman, Z. , author Sotthiwat, E. , author Xu, Y. , author Liu, P. , author Zhen, L. , author Liu, Y. , year 2023 . title Generative gradient inversion via over-parameterized networks in federated learning , in: booktitle Proceedings of the IEEE/CVF ...

    2023

  31. [39]

    , author Cheng, S

    author Zhang, K. , author Cheng, S. , author Shen, G. , author Ribeiro, B. , author An, S. , author Chen, P.Y. , author Zhang, X. , author Li, N. , year 2025 . title Censor: Defense against gradient inversion via orthogonal subspace bayesian sampling . journal arXiv preprint a...

    2025 arXiv

  32. [40]

    , author Mopuri, K.R

    author Zhao, B. , author Mopuri, K.R. , author Bilen, H. , year 2020 . title idlg: Improved deep leakage from gradients . journal arXiv preprint arXiv:2001.02610

    2020 arXiv

  33. [41]

    , author Blaschko, M.B

    author Zhu, J. , author Blaschko, M.B. , . title R-gap: Recursive gradient attack on privacy , in: booktitle International Conference on Learning Representations

  34. [42]

    , author Yao, R

    author Zhu, J. , author Yao, R. , author Blaschko, M. , year 2023 . title Surrogate model extension (sme): A fast and accurate weight update attack on federated learning , in: booktitle ICML'23: Proceedings of the 40th International Conference on Machine Learning , organizatio...

    2023

  35. [43]

    , author Liu, Z

    author Zhu, L. , author Liu, Z. , author Han, S. , year 2019 . title Deep leakage from gradients . journal Advances in neural information processing systems volume 32

    2019

  36. [44]

    , author Makowski, M.R

    author Adams, L.C. , author Makowski, M.R. , author Engel, G. , author Rattunde, M. , author Busch, F. , author Asbach, P. , author Niehues, S.M. , author Vinayahalingam, S. , author van Ginneken, B. , author Litjens, G. , et al., year 2022 . title Prostate158-an expert-annota...

    2022

  37. [45]

    , author Wang, Y

    author Han, K. , author Wang, Y. , author Chen, H. , author Chen, X. , author Guo, J. , author Liu, Z. , author Tang, Y. , author Xiao, A. , author Xu, C. , author Xu, Y. , et al., year 2022 . title A survey on vision transformer . journal IEEE transactions on pattern analysis...

    2022

  38. [46]

    , author Wang, Z

    author Jiang, M. , author Wang, Z. , author Dou, Q. , year 2022 . title Harmofl: Harmonizing local and global drifts in federated learning on heterogeneous medical images , in: booktitle Proceedings of the AAAI Conference on Artificial Intelligence , pp. pages 1087--1095

    2022

  39. [47]

    , author Mart \' , R

    author Lema \^ tre, G. , author Mart \' , R. , author Freixenet, J. , author Vilanova, J.C. , author Walker, P.M. , author Meriaudeau, F. , year 2015 . title Computer-aided detection and diagnosis for prostate cancer based on mono and multi-parametric mri: a review . journal C...

    2015

  40. [48]

    , author Toth, R

    author Litjens, G. , author Toth, R. , author Van De Ven, W. , author Hoeks, C. , author Kerkstra, S. , author Van Ginneken, B. , author Vincent, G. , author Guillard, G. , author Birbeck, N. , author Zhang, J. , et al., year 2014 . title Evaluation of prostate segmentation al...

    2014

  41. [49]

    , author Anant, M

    author Nicholas, B. , author Anant, M. , author Henkjan, H. , author John, F. , author Justin, K. , et al., year 2015 . title Nci-proc. ieee-isbi conf. 2013 challenge: Automated segmentation of prostate structures . journal The Cancer Imaging Archive volume 5

    2015

  42. [50]

    , author Velipasalar, S

    author Wang, F. , author Velipasalar, S. , author Gursoy, M.C. , year 2024 . title Maximum knowledge orthogonality reconstruction with gradients in federated learning , in: booktitle Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pp. pages 3...

    2024

  43. [51]

    , author Sharma, A

    author Zhao, J.C. , author Sharma, A. , author Elkordy, A.R. , author Ezzeldin, Y.H. , author Avestimehr, S. , author Bagchi, S. , year 2024 . title Loki: Large-scale data reconstruction attack against federated learning through model manipulation , in: booktitle 2024 IEEE Sym...

    2024

  44. [52]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.