Pith. sign in

REVIEW 4 major objections 6 minor 46 references

Gradient inversion attacks can reconstruct video frames from federated learning gradients when the network is simple, and feature extractors only help if the classifier is complex enough.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-08-04 19:38 UTC pith:LAAKMDLV

load-bearing objection First look at video gradient inversion: raw-frame attack works, but the feature-extractor defense is confounded by aggressive max-pooling. the 4 major comments →

arxiv 2509.09742 v1 pith:LAAKMDLV submitted 2025-09-11 cs.CV

Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning

Md Fazle Rasul , Alanood Alqobaisi , Bruhadeshwar Bezawada , Indrakshi Ray This is my paper
classification cs.CV
keywords gradient inversionfederated learningvideo leakagedeep leakage from gradientsfeature extractorsuper-resolutionprivacy attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper is the first to test whether gradient inversion attacks, which rebuild private training data from shared model gradients, work on video data in federated learning. The authors show that a standard attack (DLG) can reconstruct downsampled surveillance frames from the gradients of a simple LeNet classifier, and that image super-resolution then sharpens those frames into higher-quality video. They also show that using a pre-trained feature extractor blocks the attack in their video pipeline, but a follow-up on image data reveals why: the feature extractor alone does not protect data; it only helps when the downstream classifier is moderately complex. The paper argues that video leakage is a real threat in simple collaborative setups and that the exact conditions deserve further study.

Core claim

Training a simple LeNet classifier on raw 32x32 video frames with batch size one lets the DLG attack reconstruct the frames from the shared gradients, with baseline SSIM around 0.19–0.29, and applying Real-ESRGAN or TTSR super-resolution raises SSIM to 0.61–0.88. When the same pipeline uses pre-extracted I3D features, max-pooled to (1,10,64), DLG fails even after 20,000 iterations. Controlled experiments on CIFAR-100 resolve the apparent contradiction: gradients of feature vectors are still leakable when the classifier is simple (a standard LeNet), but a moderately complex classifier trained on extracted features resists DLG, iDLG, and R-GAP, even though the same classifier leaks when traine

What carries the argument

The central mechanism is the DLG attack, an optimization that minimizes the Euclidean distance between a dummy input's gradient and the victim's leaked gradient, iteratively recovering the private sample. The paper pairs this with two video-processing pipelines: a frame-wise pipeline (raw frames resized and center-cropped to 32x32, fed to LeNet) and a feature pipeline (I3D features max-pooled to (1,10,64), fed to a modified LeNet). The isolation experiment on CIFAR-100 uses a ResNet20 feature extractor (final layer removed) followed by either a simple or a moderately complex classifier, and applies DLG, iDLG (which extracts the label analytically), and R-GAP (a recursion-based solver) to det

Load-bearing premise

The attacker receives the raw, unaggregated gradient of a single training sample with batch size one; if the federated server aggregates gradients over a batch or adds noise, the demonstrated attack surface largely disappears.

What would settle it

Run DLG on the original I3D features (shape (1,10,2048)) with the same modified LeNet classifier without max-pooling: if reconstruction succeeds, the paper's attribution of protection to the feature extractor is confounded by the pooling step. Alternatively, run DLG on raw 32x32 video frames with a moderately complex classifier and batch size one; if it succeeds, classifier complexity alone does not explain the CIFAR-100 results.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If the paper is right, any federated system that trains a simple classifier on raw video frames with batch size one can have its training footage reconstructed from the shared gradients.
  • Using a pre-trained feature extractor is a meaningful practical defense, but only when paired with a classifier of sufficient complexity; simple heads still leak.
  • Image super-resolution post-processing turns low-fidelity leaked frames into substantially more recognizable video, increasing the real-world harm of the attack.
  • The CIFAR-100 results suggest that the defensive effect is not inherent to features themselves but depends on the architecture that consumes them, guiding future defense design.
  • Video's temporal redundancy means even partially reconstructed frames can be used to infer neighboring frames, compounding the leakage.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's video-feature failure may be partly caused by the aggressive max-pooling from 2048 to 64 dimensions, not just by the feature extractor; a test that keeps the original 2048-dimensional features and re-runs DLG would separate these effects.
  • Real federated deployments typically use batch sizes larger than one or secure aggregation, so the demonstrated attack is best seen as a lower-bound risk; the paper's own comparisons show inversion quality degrades with batch size.
  • The continuous-only nature of video feature matrices matches the paper's observation (via TabLeak) that purely numerical features are harder to invert than categorical ones, suggesting a general principle: structureless continuous features resist gradient inversion.
  • A direct extension would test whether a moderately complex classifier trained on raw frames with batch size one can also block DLG, which would isolate classifier complexity as the dominant factor rather than feature extraction.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents a first study of gradient inversion attacks on video data in federated/collaborative learning. In the first pipeline, UCF-Crime frames are resized to 32x32 and used to train a LeNet model with batch size 1; the authors apply DLG to the shared gradients and reconstruct low-resolution frames. They then use Real-ESRGAN and TTSR to super-resolve the reconstructed frames, reporting SSIM/PSNR values. In the second pipeline, the authors use pre-extracted I3D video features, max-pool them from 2048 to 64 dimensions, and report that DLG fails to recover the feature matrices. Finally, on CIFAR-100, they compare DLG, iDLG, and R-GAP on gradients computed from raw images versus from ResNet20 features, with simple and moderately complex classifiers, and report that a moderately complex classifier on extracted features resists attack while a simple classifier does not. The abstract concludes that video leakage in FL is a viable threat and that feature extractors increase resilience, with leakage occurring when the classifier is not sufficiently complex.

Significance. If the claims are supported, this would be a useful first characterization of video-data leakage in collaborative learning and of the defensive effect of feature extractors. The paper has several strengths: it uses standard datasets and attack algorithms, it evaluates three inversion attacks, it provides a super-resolution enhancement component, and it makes source code available with fixed seeds for reproducibility. The raw-frame DLG result is a plausible and standard attack pattern. However, the support for the headline feature-extractor claim is currently weak: the video-feature experiment is confounded by aggressive max-pooling, and the CIFAR-100 table uses an undefined Y/N criterion. The super-resolution results are also ambiguous as printed. The central claims are defensible in principle but several load-bearing points need additional experimental control or quantitative evidence.

major comments (4)
  1. [Section V-B, Fig. 6-7] The video-feature experiment reduces I3D features from (1,10,2048) to (1,10,64) by max-pooling before running DLG, and the failure of DLG is attributed to the pre-trained feature extractor. No experiment attacks the original 2048-dimensional features, and no control uses the pooled features with a simple classifier. The 32x dimensionality reduction is itself a highly lossy transformation that changes the gradient optimization landscape, so the failure could be caused by the pooling or by the unusual distribution of pooled features rather than by the feature extractor per se. Since this is the only video experiment supporting the claim that feature extractors resist inversion, that claim is not supported as stated.
  2. [Table II, Section V-C] The table reports only Y/N entries for whether feature matrices were retrieved from gradients. No reconstruction-quality metric, convergence threshold, loss curve, or run-to-run criterion is provided. 'Retrieved' is undefined, and for DLG/iDLG a successful reconstruction could mean anything from a visually recognizable image to a low training loss on dummy data. Moreover, the R-GAP row is N in all columns, including the raw-image controls, so it cannot support the feature-extractor conclusion. This table is the main quantitative evidence for the abstract's classifier-complexity claim and needs objective, reproducible success criteria.
  3. [Table I, Section V-A] As printed, the super-resolution results do not clearly support the abstract's claim that SR enables attackers to reconstruct higher-quality videos. The Baseline (High vs. Low) SSIM values are 0.20-0.29. The SR columns show large improvements in 'Enhanced vs. Low' (e.g., Video 3 multi-reference SSIM 0.878) but only marginal improvements in 'Enhanced vs. High' relative to baseline (Video 3: 0.2881 -> 0.2956 for no-reference and 0.3177 for multi-reference). If the authors intend to claim that SR improves fidelity to the original ground-truth video, the relevant comparison is 'Enhanced vs. High,' and the current table does not establish a meaningful improvement. The column structure needs clarification or the claim should be tempered.
  4. [Sections II and V-A] The experiments instantiate the strongest possible adversary: gradients of a single training sample with batch size 1, no secure aggregation, and a model trained frame-by-frame. This is a legitimate threat model, but the paper's broad conclusion that 'video data leakage in FL is a viable threat' should be explicitly conditioned on these deployment assumptions. Many real FL systems aggregate updates over batches/users or use secure aggregation, both of which are cited in the paper's related work. Please add a limitation paragraph that separates the threat-model-dependent finding from the general FL setting.
minor comments (6)
  1. [Section V, Setup] The text says CIFAR-100 consists of '10 classes and 6000 images per class.' CIFAR-100 has 100 classes and 600 images per class. Please correct.
  2. [Figure 6 caption] The caption refers to 'Video Reconstruction Steps via Conditional GAN,' but Section V-B and the surrounding text describe DLG on extracted I3D features. This appears to be a copy/paste error and should be fixed.
  3. [Section IV-C] The text says 'We propose a systematic procedure ... in Section VI,' but Section VI is the Discussion and does not contain the promised procedure. This forward reference is misleading.
  4. [Section IV-D] R-GAP is described and then cited as [43], but [43] is a survey on gradient inversion; the original recursive attack is [45]. Please correct the citation.
  5. [Section I] The introduction states that 'Zhu et al. [46] investigated shallow leakage of video data.' Reference [46] is the DLG paper on image data, not on video. This attribution appears inaccurate.
  6. [Table I] The column layout for 'Enhanced vs. High' and 'Enhanced vs. Low' is confusing because the baseline and SR groups are not visually separated. Consider restructuring the table so that each SR method has one column for comparison against ground truth and one column for comparison against the pre-SR DLG output.

Circularity Check

0 steps flagged

No circular derivation: the paper reports direct attack measurements against external ground-truth data, with no fitted-parameter-as-prediction and no load-bearing self-citation chain.

full rationale

The paper's central claims are empirical attack outcomes, not derivations from premises that already contain the conclusions. DLG recovery in Table I is measured directly against original UCF-Crime frames via PSNR/SSIM, and the CIFAR-100 comparison in Table II records whether feature matrices could be retrieved from gradients, a binary result evaluated against ground-truth feature vectors. No parameter is fitted to a subset of the reported data and then renamed a prediction; the attack success/failure is the measurement itself, not a value forced by construction. The I3D feature-extractor experiment uses max-pooling from (1,10,2048) to (1,10,64), which could confound the attribution of DLG failure to the feature extractor; however, this is an experimental-isolation weakness, not a circular reduction, because the paper does not define 'feature extractor defense' in terms of DLG failure and does not rely on any identity between input and output. The paper explicitly defers mechanism ('our crucial next step is to investigate the causes'), confirming that the resilience observation is presented as an empirical finding rather than a derived consequence. Super-resolution gains may partly reflect the use of same-video reference frames and temporal redundancy, but again this is a potential measurement artifact, not a definitional equivalence. There are no load-bearing self-citations, no uniqueness theorem imported from the authors' prior work, and no ansatz smuggled in by citation. The single stated limitation about investigating causes is a missing-support flag, not a circular step. Therefore the circularity score is 0.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 1 invented entities

The empirical claims rest on a favorable threat model (per-sample, un-aggregated, batch-size-1 gradients), on treating video as independent frames, on an unexplained 2048-to-64 max-pooling of I3D features, and on attacker access to same-video reference frames for super-resolution. No new entities are postulated.

free parameters (5)
  • DLG convergence threshold = 1e-5
    Hand-chosen loss threshold for declaring a successful frame reconstruction (Section V-A); standard DLG practice.
  • Frame-attack optimization budget = 300 iterations, up to 10 restarts, L-BFGS
    Attack budget on which the 'video leakage is viable' result depends (Section V-A).
  • Feature-attack optimization budget = 20,000 iterations, noise sigma 0.001, LR halving on stagnation
    Configuration under which the feature-matrix attack failed; the negative result is contingent on this budget (Section V-B).
  • I3D feature downsampling = (1,10,2048) -> (1,10,64) via max pooling
    Hand-chosen preprocessing that reduces the attack surface and confounds the claim that feature extractors resist inversion (Section V-B).
  • Super-resolution output scale = 32x32 -> 128x128
    All PSNR/SSIM comparisons are standardized at 128x128; the modest fidelity gains are measured at this scale (Section V-A).
axioms (5)
  • domain assumption The attacker observes raw, un-aggregated gradients of a single training sample (batch size 1).
    Defined in Section II and instantiated as 'A batch size of 1 was used' in Section V-A. Real FL typically aggregates larger batches and may use secure aggregation, which removes this attack surface.
  • domain assumption A video may be treated as independent frames for training and attack.
    Section IV-B declares the frame-wise pipeline makes video 'functionally equivalent to a static image dataset'; temporal structure is exploited only in the later super-resolution stage.
  • ad hoc to paper Max-pooling I3D features from 2048 to 64 dimensions preserves the conditions needed to evaluate DLG on feature pipelines.
    Section V-B performs this downsampling without justification; if the DLG failure is caused by the lossy reduction, the feature-extractor resilience conclusion is confounded.
  • domain assumption The attacker may hold one or more reference frames from the same target video for TTSR super-resolution.
    Section IV-B defines zero/one/multiple reference scenarios; the reported enhancements depend on same-video reference availability.
  • standard math L-BFGS converges to a gradient-matching optimum within the stated budget.
    The DLG objective (Eq. 1) is minimized heuristically; success is empirical and depends on optimizer, iterations, and restarts as reported in Section IV-D.
invented entities (1)
  • None no independent evidence
    purpose: No new entities are introduced.
    The paper postulates no new particle, mediator, force, conserved quantity, dimension, or ledger entry. All attack and super-resolution components reuse public algorithms and models (DLG, iDLG, R-GAP, Real-ESRGAN, TTSR).

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning." pith.science (2026). https://pith.science/paper/LAAKMDLV

@misc{pith2026250909742,
  author       = {Pith},
  title        = {Pith review of: Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LAAKMDLV}},
  note         = {Machine review of arXiv:2509.09742}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated learning (FL) allows multiple entities to train a shared model collaboratively. Its core, privacy-preserving principle is that participants only exchange model updates, such as gradients, and never their raw, sensitive data. This approach is fundamental for applications in domains where privacy and confidentiality are important. However, the security of this very mechanism is threatened by gradient inversion attacks, which can reverse-engineer private training data directly from the shared gradients, defeating the purpose of FL. While the impact of these attacks is known for image, text, and tabular data, their effect on video data remains an unexamined area of research. This paper presents the first analysis of video data leakage in FL using gradient inversion attacks. We evaluate two common video classification approaches: one employing pre-trained feature extractors and another that processes raw video frames with simple transformations. Our initial results indicate that the use of feature extractors offers greater resilience against gradient inversion attacks. We also demonstrate that image super-resolution techniques can enhance the frames extracted through gradient inversion attacks, enabling attackers to reconstruct higher-quality videos. Our experiments validate this across scenarios where the attacker has access to zero, one, or more reference frames from the target environment. We find that although feature extractors make attacks more challenging, leakage is still possible if the classifier lacks sufficient complexity. We, therefore, conclude that video data leakage in FL is a viable threat, and the conditions under which it occurs warrant further investigation.

Figures

Figures reproduced from arXiv: 2509.09742 by Alanood Alqobaisi, Bruhadeshwar Bezawada, Indrakshi Ray, Md Fazle Rasul.

Figure 1
Figure 1. Figure 1: Video Processing Pipeline B. Gradient Inversion on Raw Frames with Simple Transfor￾mation We first explored video reconstruction in the absence of neural network feature extractors, simulating cases where videos undergo only nominal transformations like rotation, re￾sizing, cropping, normalizing, etc. Using the DLG attack [46], detailed in section IV-D, we extracted the video frames from the shared gradien… view at source ↗
Figure 2
Figure 2. Figure 2: Video Reconstruction Pipeline Without Neural Network Pre-processing. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: LeNet used in the DLG attack [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Architectures of the simple classifier (left) and the moderately complex classifier (right) used in our experiments. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Frames obtained through DLG and enhanced using super-resolution. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Gradient Leakage Attack: Proposed Video Reconstruction Steps via Conditional GAN. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Modified LeNet-style classifier. C. Influence of Feature Extractors Finally, to evaluate the effect of the feature extractor on gradient inversion attacks, we selected three established algo￾rithms: DLG, iDLG, and R-GAP. We chose the CIFAR-100 dataset [19] for this experiment, given its documented suscep￾tibility to image reconstruction by these attacks. A ResNet20 model, trained on 50% of the CIFAR-100 da… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

46 extracted references · 16 linked inside Pith

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318, 2016

    2016

  2. [2]

    Collaborative learning of anomalies with privacy (clap) for unsupervised video anomaly detection: A new baseline

    Anas Al-Lahham, Muhammad Zaigham Zaheer, Nurbek Tastan, and Karthik Nandakumar. Collaborative learning of anomalies with privacy (clap) for unsupervised video anomaly detection: A new baseline. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12416–12425, 2024

    2024

  3. [3]

    Bayesian framework for gradient leakage.arXiv preprint arXiv:2111.04706, 2021

    Mislav Balunovi ´c, Dimitar I Dimitrov, Robin Staab, and Martin Vechev. Bayesian framework for gradient leakage.arXiv preprint arXiv:2111.04706, 2021

    Pith/arXiv arXiv 2021

  4. [4]

    Practical secure aggregation for federated learning on user- held data.arXiv preprint arXiv:1611.04482, 2016

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for federated learning on user- held data.arXiv preprint arXiv:1611.04482, 2016

    Pith/arXiv arXiv 2016

  5. [5]

    Understanding training-data leakage from gradients in neural networks for image classification.arXiv preprint arXiv:2111.10178, 2021

    Cangxiong Chen and Neill DF Campbell. Understanding training-data leakage from gradients in neural networks for image classification.arXiv preprint arXiv:2111.10178, 2021

    Pith/arXiv arXiv 2021

  6. [6]

    Improved gradient leakage attack against compressed gradi- ents in federated learning.Neurocomputing, 608:128349, 2024

    Xuyang Ding, Zhengqi Liu, Xintong You, Xiong Li, and Athhanasios V Vasilakos. Improved gradient leakage attack against compressed gradi- ents in federated learning.Neurocomputing, 608:128349, 2024

    2024

  7. [7]

    Sok: On gradient leakage in federated learning.arXiv preprint arXiv:2404.05403, 2024

    Jiacheng Du, Jiahui Hu, Zhibo Wang, Peng Sun, Neil Zhenqiang Gong, Kui Ren, and Chun Chen. Sok: On gradient leakage in federated learning.arXiv preprint arXiv:2404.05403, 2024

    Pith/arXiv arXiv 2024

  8. [8]

    What is a good psnr value for image? https: //poletoparis.com/what-is-a-good-psnr-value-for-image/, 2022

    Chandni Fowler. What is a good psnr value for image? https: //poletoparis.com/what-is-a-good-psnr-value-for-image/, 2022. Ac- cessed: Apr. 11, 2025

    2022

  9. [9]

    Inverting gradients-how easy is it to break privacy in fed- erated learning?Advances in Neural Information Processing Systems, 33:16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dr ¨oge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in fed- erated learning?Advances in Neural Information Processing Systems, 33:16937–16947, 2020

    2020

  10. [10]

    A new federated learning framework against gradient inversion attacks

    Pengxin Guo, Shuang Zeng, Wenhao Chen, Xiaodan Zhang, Weihong Ren, Yuyin Zhou, and Liangqiong Qu. A new federated learning framework against gradient inversion attacks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 16969– 16977, 2025

    2025

  11. [11]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In2016 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016

    2016

  12. [12]

    Evaluating gradient inversion attacks and defenses in federated learning

    Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and defenses in federated learning. Advances in Neural Information Processing Systems, 34:7232–7241, 2021

    2021

  13. [13]

    Instahide: Instance-hiding schemes for private distributed learning

    Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora. Instahide: Instance-hiding schemes for private distributed learning. InInternational Conference on Machine Learning (ICML), pages 4507–4518. PMLR, 2020

    2020

  14. [14]

    Plotneuralnet

    Haris Iqbal. Plotneuralnet. https://github.com/HarisIqbal88/ PlotNeuralNet, 2018

    2018

  15. [15]

    Gradient inversion with generative image prior

    Jinwoo Jeon, jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradient inversion with generative image prior. InAdvances in Neural Information Processing Systems, volume 34, pages 29898– 29908, 2021

    2021

  16. [16]

    Cafe: Catastrophic data leakage in vertical federated learning.Advances in Neural Information Processing Systems, 34:994–1006, 2021

    Xiao Jin, Pin-Yu Chen, Chia-Yi Hsu, Chia-Mu Yu, and Tianyi Chen. Cafe: Catastrophic data leakage in vertical federated learning.Advances in Neural Information Processing Systems, 34:994–1006, 2021

    2021

  17. [17]

    Fastsecagg: Scalable secure aggregation for privacy- preserving federated learning.arXiv preprint arXiv:2009.11248, 2020

    Swanand Kadhe, Nived Rajaraman, O Ozan Koyluoglu, and Kannan Ramchandran. Fastsecagg: Scalable secure aggregation for privacy- preserving federated learning.arXiv preprint arXiv:2009.11248, 2020

    Pith/arXiv arXiv 2009

  18. [18]

    Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    Pith/arXiv arXiv 2014

  19. [19]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, University of Toronto, Toronto, Ontario, 2009

    2009

  20. [20]

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks.Commun. ACM, 60(6):84–90, May 2017

    2017

  21. [21]

    Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix

    Maximilian Lam, Gu-Yeon Wei, David Brooks, Vijay Janapa Reddi, and Michael Mitzenmacher. Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix. In International Conference on Machine Learning (ICML), pages 5959–

  22. [22]

    Gradient-based learning applied to document recognition

    Yann LeCun, L ´eon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. InProceed- ings of the IEEE, volume 86, pages 2278–2324, 1998

    1998

  23. [23]

    Deep leakage from gradients in multiple-label medical image classification

    Zheng Li, Mykola Hubchak, and Yingying Zhu. Deep leakage from gradients in multiple-label medical image classification. In2021 IEEE 9th International Conference on Healthcare Informatics (ICHI), pages 447–448. IEEE, 2021

    2021

  24. [24]

    Pytorch: An imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Brad- bury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, and Luca Antiga. Pytorch: An imperative style, high-performance deep learning library. InAdvances in Neural Information Processing Systems, pages 8024–8035. Curran Associates, Inc., 2019. 11

    2019

  25. [25]

    Privacy-preserving deep learning via additively homo- morphic encryption.IEEE Transactions on Information Forensics and Security, 13(5):1333–1345, 2018

    Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy-preserving deep learning via additively homo- morphic encryption.IEEE Transactions on Information Forensics and Security, 13(5):1333–1345, 2018

    2018

  26. [26]

    On the convergence of adam and beyond.arXiv preprint arXiv:1904.09237, 2019

    Sashank J Reddi, Satyen Kale, and Sanjiv Kumar. On the convergence of adam and beyond.arXiv preprint arXiv:1904.09237, 2019

    Pith/arXiv arXiv 1904

  27. [27]

    Dropout is not all you need to prevent gradient leakage

    Daniel Scheliga, Patrick M ¨ader, and Marco Seeland. Dropout is not all you need to prevent gradient leakage. InProceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 9733–9741, 2023

    2023

  28. [28]

    Real-world anomaly detection in surveillance videos

    Waqas Sultani, Chen Chen, and Mubarak Shah. Real-world anomaly detection in surveillance videos. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 6479–6488, 2018

    2018

  29. [29]

    On the convergence proof of amsgrad and a new version.IEEE Access, 7:61706–61716, 2019

    Phuong Thi Tran and Le Trieu Phong. On the convergence proof of amsgrad and a new version.IEEE Access, 7:61706–61716, 2019

    2019

  30. [30]

    Tableak: Tabular data leakage in federated learning.arXiv preprint arXiv:2210.01785, 2022

    Mark Vero, Mislav Balunovi ´c, Dimitar I Dimitrov, and Martin Vechev. Tableak: Tabular data leakage in federated learning.arXiv preprint arXiv:2210.01785, 2022

    Pith/arXiv arXiv 2022

  31. [31]

    Beyond boundaries: A comprehensive survey of transferable attacks on ai systems.arXiv preprint arXiv:2311.11796, 2023

    Guangjing Wang, Ce Zhou, Yuanda Wang, Bocheng Chen, Hanqing Guo, and Qiben Yan. Beyond boundaries: A comprehensive survey of transferable attacks on ai systems.arXiv preprint arXiv:2311.11796, 2023

    Pith/arXiv arXiv 2023

  32. [32]

    Real-esrgan: Training real-world blind super-resolution with pure synthetic data

    Xintao Wang, Liangbin Xie, Chao Dong, and Ying Shan. Real-esrgan: Training real-world blind super-resolution with pure synthetic data. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops, pages 1905–1914, 2021

    1905

  33. [33]

    Sapag: A self- adaptive privacy attack from gradients.arXiv preprint arXiv:2009.06228, 2020

    Yijue Wang, Jieren Deng, Dan Guo, Chenghong Wang, Xianrui Meng, Hang Liu, Caiwen Ding, and Sanguthevar Rajasekaran. Sapag: A self- adaptive privacy attack from gradients.arXiv preprint arXiv:2009.06228, 2020

    Pith/arXiv arXiv 2009

  34. [34]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4):600–612, 2004

    2004

  35. [35]

    A framework for evaluating client privacy leakages in federated learning

    Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gur- soy, Stacey Truex, and Yanzhao Wu. A framework for evaluating client privacy leakages in federated learning. In25th European Symposium on Research in Computer Security (ESORICS) 2020, pages 545–566. Springer, 2020

    2020

  36. [36]

    Deep learning for video classification and captioning

    Zuxuan Wu, Ting Yao, Yanwei Fu, and Yu-Gang Jiang. Deep learning for video classification and captioning. InFrontiers of Multimedia Research, pages 3–29. arXiv, 2017

    2017

  37. [37]

    Revisiting gradient pruning: A dual realization for defending against gradient attacks

    Lulu Xue, Shengshan Hu, Ruizhi Zhao, Leo Yu Zhang, Shengqing Hu, Lichao Sun, and Dezhong Yao. Revisiting gradient pruning: A dual realization for defending against gradient attacks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 6404– 6412, 2024

    2024

  38. [38]

    Lightsecagg: Rethinking secure aggregation in federated learning.CoRR, abs/2109.14236, 2021

    Chien-Sheng Yang, Jinhyun So, Chaoyang He, Songze Li, Qian Yu, and Salman Avestimehr. Lightsecagg: Rethinking secure aggregation in federated learning.CoRR, abs/2109.14236, 2021

    Pith/arXiv arXiv 2021

  39. [39]

    Learning texture transformer network for image super-resolution

    Fuzhi Yang, Huan Yang, Jianlong Fu, Hongtao Lu, and Baining Guo. Learning texture transformer network for image super-resolution. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5791–5800, 2020

    2020

  40. [40]

    See through gradients: Image batch recovery via gradinversion

    Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16337–16346, 2021

    2021

  41. [41]

    mixup: Beyond empirical risk minimization.arXiv preprint arXiv:1710.09412, 2017

    Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez- Paz. mixup: Beyond empirical risk minimization.arXiv preprint arXiv:1710.09412, 2017

    Pith/arXiv arXiv 2017

  42. [42]

    Censor: Defense against gradient inversion via orthogonal subspace bayesian sampling

    Kaiyuan Zhang, Siyuan Cheng, Guangyu Shen, Bruno Ribeiro, Sheng- wei An, Pin-Yu Chen, Xiangyu Zhang, and Ninghui Li. Censor: Defense against gradient inversion via orthogonal subspace bayesian sampling. arXiv preprint arXiv:2501.15718, 2025

    Pith/arXiv arXiv 2025

  43. [43]

    A survey on gradient inversion: Attacks, defenses and future directions

    Rui Zhang, Song Guo, Junxiao Wang, Xin Xie, and Dacheng Tao. A survey on gradient inversion: Attacks, defenses and future directions. arXiv preprint arXiv:2206.07284, 2022

    Pith/arXiv arXiv 2022

  44. [44]

    idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610, 2020

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610, 2020

    Pith/arXiv arXiv 2001

  45. [45]

    R-gap: Recursive gradient attack on privacy.arXiv preprint arXiv:2010.07733, 2020

    Junyi Zhu and Matthew Blaschko. R-gap: Recursive gradient attack on privacy.arXiv preprint arXiv:2010.07733, 2020

    Pith/arXiv arXiv 2010

  46. [46]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Advances in Neural Information Processing Systems, volume 32, 2019

    2019

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.