Pith. sign in

REVIEW 5 major objections 4 minor 51 references

DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences

T0 review · 5 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Federated unlearning leaks the very data it is supposed to erase: two gradients, taken before and after deletion, are enough to rebuild the forgotten images.

desk verdict A cleanly presented two-stage gradient-inversion attack, but the paper is structurally incomplete and the experiments don't match the realistic FedAvg setting. read the letter →

arxiv 2507.09602 v1 pith:LK2MUL5I submitted 2025-07-13 cs.LG cs.AI

Bocheng Ju , Junchao Fan , Jiaqi Liu , Xiaolin Chang This is my paper · ORCID
classification cs.LGcs.AI
keywords federatedlearningunlearninggradientinversiondatareconstructionattackprivacyleakagedifferencehonest-but-curiousserverpublicprior
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that federated unlearning, a mechanism meant to erase a client's data from a shared model, creates a new privacy leak: the server can compare the client's gradient before deletion with the gradient after retraining, and the difference between them encodes the erased samples. It proposes DRAGD, a two-stage attack that first reconstructs the kept data from the post-unlearning gradient and then, with those reconstructions fixed, recovers the forgotten data from the pre-unlearning gradient. The enhanced version DRAGDP initializes the search with public images, which sharply improves fidelity on structured data such as faces. If the claim is right, the unlearning operation itself is the attack surface, not just the ordinary gradient sharing during training.

What carries the argument

The load-bearing object is the gradient discrepancy, the difference between the pre-unlearning gradient $\nabla \theta^*$ and the post-unlearning gradient $\nabla \theta^u$. DRAGD feeds synthetic noise through the retrained model, minimizes the squared Euclidean distance between the resulting gradient and the real post-unlearning gradient to recover the remaining data, and then freezes those recovered images while minimizing the gradient mismatch of the forgotten batch against the pre-unlearning model. DRAGDP uses the same two-stage optimization but replaces the random initialization of the forgotten batch with public prior images.

What would settle it

Run the same DRAGD pipeline against a server that only observes the aggregated update of several clients (say, ten, with one of them unlearning) instead of the target client's isolated gradient; if high-fidelity images are still recovered from the aggregate, the attack generalizes beyond the paper's setup, and if not, the reported reconstruction quality depends on the isolated-gradient assumption.

Watch

Extended reading notes

Core claim

The central claim is that the gradient pair available during federated unlearning—the update computed on the full dataset before removal and the update computed on the remaining data after retraining—carries enough information to reconstruct the supposedly erased samples. The paper shows this by reconstructing the remaining data first, then treating that reconstruction as a fixed anchor while optimizing a synthetic version of the forgotten data against the pre-unlearning gradient. In experiments on MNIST, CIFAR-10, and LFW, DRAGD recovers images with lower mean squared error and higher SSIM than the DLG and IG gradient-inversion baselines, and DRAGDP improves further when public data provide a good starting point. The message is that gradient differences act as a privacy fingerprint of the removed data.

Load-bearing premise

The attack assumes the server receives the exact, unaggregated gradient of the target client both before and after unlearning; with secure aggregation or multi-client updates, those raw per-client gradients are not visible.

Editorial extensions

If this is right

  • A server that merely follows the federated protocol can reconstruct a client's erased images without any access to client hardware or raw data.
  • The attack transfers across model families: it works on LeNet, ConvNet64, and ResNet18, with more complex models exposing at least as much gradient information.
  • Public-data priors turn hard reconstructions, such as facial images, into feasible ones, so the risk is highest exactly where the data is most sensitive.
  • Secure aggregation, gradient clipping, or multi-client mixing should block the attack, because the two-stage procedure relies on an isolated per-client gradient; the paper's own threat model assumes that isolation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension, not tested in the paper, is to replace the Euclidean gradient-matching objective with a cosine-similarity loss and a generative prior; the paper's own baseline [25] suggests this raises fidelity for larger batches.
  • Because DRAGDP succeeds when a public prior overlaps with the target domain, the same attack may work on medical or biometric data whenever a public corpus with similar structure exists.
  • The paper proposes FedANI as a defense but reports no defense experiments in the main evaluation; treating FedANI as validated would require a separate study.
  • A defender could concentrate on breaking the first stage: if reconstruction of the remaining data is degraded, the frozen anchor for the second stage disappears, and the whole attack loses its grip.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes DRAGD (Data Reconstruction Attack based on Gradient Difference) and an enhanced variant DRAGDP, which aim to reconstruct client data erased during federated unlearning. The attack uses a pair of gradients: the pre-unlearning gradient computed on the full local dataset and the post-unlearning gradient computed on the remaining data, and optimizes synthetic inputs to match these gradients, with the remaining-data reconstruction fixed as an anchor. DRAGDP replaces the random initialization of the forgotten data with public prior images. The manuscript also claims a defense called FedANI, which is described only as injecting noise into sensitive gradient components. Experiments are reported on MNIST, CIFAR-10, and LFW with LeNet, ResNet18, and ConvNet64 models, comparing against DLG, IG, and CPL baselines, and reporting MSE, PSNR, and SSIM.

Significance. The paper addresses an important and timely problem: privacy risks introduced by federated unlearning, specifically whether gradient discrepancies before and after deletion enable data reconstruction. If the proposed attack were shown to work under the actual information exchanged in federated learning (e.g., FedAvg model deltas) and were properly compared with existing defenses, it would be a meaningful contribution to the security and privacy literature. However, the current manuscript does not provide such evidence. The experimental protocol does not match the stated federated learning setting, the claimed defense FedANI is never defined or evaluated, and the quantitative results lack error bars or repeated trials. The near-perfect reconstruction of the anchor 'Part' set further weakens the external validity of the reported attack performance. As presented, the claims are not substantiated by the experimental or theoretical content of the paper.

major comments (5)
  1. [Section VI.A, VI.B, Algorithm 1, Eq. (2)-(3)] The experiments do not evaluate the attack on the information actually exchanged in FedAvg. Section VI.A states that FedAvg is used and that gradients are computed 'using the FedAvg algorithm,' but the attack in Algorithm 1 and Eq. (2)-(3) inverts raw per-client batch gradients (e.g., a single forward/backward pass over 16 or 4 images). In FedAvg, clients perform multiple local SGD steps and communicate a model delta, which is not the gradient of a single loss over the local data. The paper never tests DRAGD/DRAGDP against such multi-step model updates, so the central claim that DRAGD exposes a critical vulnerability in federated unlearning systems is not supported by the provided experiments.
  2. [Abstract, Section VI.A, Section VII] FedANI is presented in the abstract and conclusion as a practical defense and Section VI.A announces that its performance will be assessed, but the paper contains no definition, algorithm, or experimental result for FedANI. The only mention is a parameter setting in Section VI.A ('In FedANI, the gradient noise coefficient is set to 1...'). This missing evaluation is a load-bearing omission for the claimed contribution, which explicitly includes FedANI as a defense.
  3. [Tables I-IV] All quantitative results are reported as single numbers with no error bars, confidence intervals, or number of independent trials. The text acknowledges 'occasional reconstruction failures' in DRAGD (Section VI.B), but the frequency or impact of these failures is never quantified. Given the stochasticity of gradient-inversion optimization, the claims that DRAGD and DRAGDP 'significantly outperform' existing methods are not statistically supported.
  4. [Table I and Section V, Eq. (3)] The 'Part' reconstruction on MNIST achieves MSE 5.18e-5 and SSIM 1.000, essentially a perfect reconstruction of the remaining data. DRAGD and DRAGDP fix this Part as an anchor during the second-stage attack (Algorithm 1, Eq. (3)). The paper does not analyze how sensitive the attack is to imperfect Part reconstruction, which would be the realistic case under noise, clipping, or multi-step model updates. Without such sensitivity analysis, the reported attack performance may be an artifact of an unrealistically accurate anchor.
  5. [Section III.B] The threat model assumes the adversarial server can access exact per-client raw gradients before and after unlearning and can isolate the target client's updates. In a realistic federated system with multi-client aggregation or secure aggregation—which the paper itself lists as a defense in Section II.C—the server would not observe these raw per-client gradients. The paper does not discuss how DRAGD would operate under such constraints, so the claimed real-world applicability of the attack is not established.
minor comments (4)
  1. [Throughout] The manuscript contains numerous typos and garbled text, e.g., 'VER recent years' at the start of Section I, 'gl obal' in the Abstract, and inconsistent notation in Eq. (2), Eq. (3), and Algorithm 1 (e.g., the subscripts on the gradient symbols are incorrect or ambiguous). A thorough copyedit is needed.
  2. [Section VI.B] Figure numbering is inconsistent with the text: the MNIST results are introduced as 'Fig.3' but the figure is labelled Fig.2, and the LFW results are introduced as 'Fig.4' but the figure is labelled Fig.3. The CIFAR-10 figures are similarly mis-referenced.
  3. [Section VI.A.3] The baseline descriptions are inaccurate. For example, 'IG' is described as focusing on data points with the greatest influence on the global model, but the cited Inverting Gradients method (Geiping et al. [25]) is a gradient-matching attack, not an influence-based method. This misdescription undermines the credibility of the comparison.
  4. [References] The reference list contains errors: reference [37] duplicates reference [32] (both are SecureML), and several entries have incomplete venue or formatting information.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DRAGD is a standard gradient-inversion fit against pre/post-unlearning gradients, with no load-bearing self-citation.

full rationale

The derivation chain is self-contained as an inverse problem. DRAGD first reconstructs the remaining data D_r by matching the post-unlearning gradient (Eq. 2), then reconstructs the forgotten data D_f by matching the pre-unlearning gradient over D_f ∪ D_r while fixing the reconstructed D_r (Eq. 3). Each stage optimizes an image tensor to minimize a gradient-matching objective, and the reported success metrics (MSE, PSNR, SSIM) are pixel/structure similarities to the ground-truth images, not the same gradient-matching loss. Thus the attack is not defined as its own success measure. DRAGDP replaces random initialization of D_f with a public-data initialization, which is an initialization choice rather than a fitted parameter relabeled as a prediction. The paper's assumptions—that the server observes exact per-client gradients before and after unlearning and that the remaining-data reconstruction is near-perfect—are strong and may limit real-world applicability, but they are experimental/threat-model assumptions, not circular reductions. The references to DLG, IG, and other prior attacks are external baselines, and there is no self-citation chain invoked to justify the central claim. Accordingly, no specific circular step can be exhibited from the paper's equations or text.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central method is an optimization procedure over two gradient-matching objectives; the only free inputs are attack hyperparameters and the strong gradient-visibility assumptions. The paper offers no derivation of why the pre/post-unlearning gradient pair should improve reconstruction, aside from an intuition that the before/after snapshots carry a fingerprint of the removed data.

free parameters (4)
  • eta_r = 0.05 for MNIST/LFW, 0.01 for CIFAR-10
    Learning rate for reconstructing remaining data; chosen per dataset with no search protocol described.
  • eta_f = 0.05 for MNIST/LFW, 0.01 for CIFAR-10
    Learning rate for reconstructing forgotten data; chosen per dataset with no search protocol described.
  • T = 300
    Number of attack optimization rounds; fixed for all experiments without justification.
  • FedANI noise parameters = coefficient 1, variance coefficient 15, ratio 0.005
    Parameters of the claimed defense; the defense itself is not defined in the paper, so these cannot be interpreted.
assumptions (4)
  • domain assumption The server observes exact per-client local gradients before and after unlearning
    Adversary model in Section III.B; without this, the two gradient-matching stages cannot be run.
  • domain assumption The unlearning protocol sends retrained local gradients to the server
    Section IV Step II; the attack relies on comparing gradients from the retrained model.
  • domain assumption Gradient matching can recover images (DLG/IG results)
    The method inherits the validity of prior gradient inversion attacks; cited but not re-derived.
  • domain assumption Public data with structure similar to target data is available for DRAGDP
    Section V; DRAGDP uses pub as initialization.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences." pith.science (2026). https://pith.science/paper/LK2MUL5I

@misc{pith2026250709602,
  author       = {Pith},
  title        = {Pith review of: DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differences},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LK2MUL5I}},
  note         = {Machine review of arXiv:2507.09602}
}
read the original abstract

Federated learning enables collaborative machine learning while preserving data privacy. However, the rise of federated unlearning, designed to allow clients to erase their data from the global model, introduces new privacy concerns. Specifically, the gradient exchanges during the unlearning process can leak sensitive information about deleted data. In this paper, we introduce DRAGD, a novel attack that exploits gradient discrepancies before and after unlearning to reconstruct forgotten data. We also present DRAGDP, an enhanced version of DRAGD that leverages publicly available prior data to improve reconstruction accuracy, particularly for complex datasets like facial images. Extensive experiments across multiple datasets demonstrate that DRAGD and DRAGDP significantly outperform existing methods in data reconstruction.Our work highlights a critical privacy vulnerability in federated unlearning and offers a practical solution, advancing the security of federated unlearning systems in real-world applications.

Figures

Figures reproduced from arXiv: 2507.09602 by the authors.

Figure 1
Figure 1. Fig.1 [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Fig.2 [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Fig.3 [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Fig.4 [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 10
Figure 10. Figure 10: Fig.10 [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]
Figure 9
Figure 9. Figure 9: Fig.9 [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 46 canonical work pages

  1. [1]

    Dataset: We evaluate DRAGD, DRAGDP,and FedANI using three datasets in our experiments including: MNIST, CIFAR-10, and LFW. MNIST. It comprises 70, 000 handwritten digits presented as 28 × 28 images. It has been normalized, placing the digits at the center of the image. The dataset encompasses samples of handwritten digits spanning from 0 to 9, with each p...

    work page

  2. [2]

    MSE is a metric used to measure the average squared differences between corresponding pixels of two images

    Evaluation Metrics: We adopt the following three metrics to evaluate the performance of DRAGD, DRAGDP,and FedANI: Mean Squared Error (MSE). MSE is a metric used to measure the average squared differences between corresponding pixels of two images. It quantifies the error between the ori ginal and reconstructed images, with lower MSE values indicating high...

    work page

  3. [3]

    Exploiting subtle differences in gradients before and after data removal, the DLG attack reconstructs sensitive data points by comparing gradients from the gl obal model

    Baseline: In the context of gradient-based attacks targeting data reconstruction in federated unlearning process, we employ the following three baselines: DLG[23]. Exploiting subtle differences in gradients before and after data removal, the DLG attack reconstructs sensitive data points by comparing gradients from the gl obal model. Through iterative opti...

    work page

  4. [4]

    Part" subset, corresponding to the retained gradients, while the gradients of the remaining 12 images were forgotten. As the reconstruction progresses, it is observed that the

    Parameter Setting : Our methods and baseline are implemented in Python 3.9 and utilize the PyTorch library. All experiments are performed on a workstation equipped with one NVIDIA GeForce RTX 4090 GPU. We adopt the following parameter settings for the attacks and defense in the federated unlearning environment: We use the LeNet model for the MNIST and LFW...

    work page

  5. [5]

    Federated conformal predictors for distributed uncertainty quantification,

    C. Lu, Y. Yu, S. P. Karimireddy, M. Jordan, and R. Raskar, "Federated conformal predictors for distributed uncertainty quantification," in International Conference on Machine Learning, 2023: PMLR, pp. 22942- 22964

    work page 2023

  6. [6]

    Multimodal federated learning via contrastive representation ensemble,

    Q. Yu, Y. Liu, Y. Wang, K. Xu, and J. Liu, "Multimodal federated learning via contrastive representation ensemble," arXiv preprint arXiv:2302.08888, 2023

    arXiv 2023

  7. [7]

    General data protection regulation (GDPR),

    F. D. Protection, "General data protection regulation (GDPR)," Intersoft Consulting, Accessed in October, vol. 24, no. 1, 2018

    work page 2018

  8. [8]

    Understanding the scope and impact of the california consumer privacy act of 2018,

    E. L. Harding, J. J. Vanto, R. Clark, L. Hannah Ji, and S. C. Ainsworth, "Understanding the scope and impact of the california consumer privacy act of 2018," Journal of Data Protection & Privacy, vol. 2, no. 3, pp. 234- 253, 2019

    work page 2018

Show all 51 references
  1. [9]

    Wu et al

    take the first step by proposing FedEraser, the first federated unlearning methodology that can eliminate the influence of a client’s data on the global FL model while significantly reducing the time used for constructing the unlearned FL model. Wu et al

  2. [10]

    Secure and efficient federated learning with provable performance guarantees via stochastic quantization,

    X. Lyu et al., "Secure and efficient federated learning with provable performance guarantees via stochastic quantization," IEEE Transactions on Information Forensics and Security, 2024

    2024

  3. [11]

    Toward secure and verifiable hybrid federated learning,

    R. Du, X. Li, D. He, and K. -K. R. Choo, "Toward secure and verifiable hybrid federated learning," IEEE Transactions on Information Forensics and Security, vol. 19, pp. 2935-2950, 2024

    2024

  4. [12]

    Reliable and interpretable personalized federated learning,

    Z. Qin, L. Yang, Q. Wang, Y. Han, and Q. Hu, "Reliable and interpretable personalized federated learning," in Proceedings of the I EEE/CVF conference on computer vision and pattern recognition, 2023, pp. 20422- 20431

    2023

  5. [13]

    Revisiting weighted aggregation in federated learning with neural networks,

    Z. Li, T. Lin, X. Shang, and C. Wu, "Revisiting weighted aggregation in federated learning with neural networks," in International Conference on Machine Learning, 2023: PMLR, pp. 19767-19788

    2023

  6. [14]

    Fedrecovery: Differentially private machine unlearning for federated learning frameworks,

    L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, “Fedrecovery: Differentially private machine unlearning for federated learning frameworks,” IEEE Transactions on Information Forensics and Security, 2023

    2023

  7. [15]

    Guaranteeing data privacy in federated unlearning with dynamic user participation,

    Z. Liu, Y. Jiang, W. Jiang, J. Guo, J. Zhao, and K.-Y. Lam, "Guaranteeing data privacy in federated unlearning with dynamic user participation," IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  8. [16]

    Privacy-preserving federated unlearning with certified client removal,

    Z. Liu et al., "Privacy-preserving federated unlearning with certified client removal," IEEE Transactions on Information Forensics and Security, 2025

    2025

  9. [17]

    Federated unlearning and its privacy threats,

    F. Wang, B. Li, and B. Li, "Federated unlearning and its privacy threats," IEEE Network, vol. 38, no. 2, pp. 294-300, 2023

    2023

  10. [18]

    Federaser: Enabling efficient client- level data removal from federated learning models,

    G. Liu, X. Ma, Y. Yang, C. Wang, and J. Liu, “Federaser: Enabling efficient client- level data removal from federated learning models,” in Proceedings of IWQoS, 2021, pp. 1–10

    2021

  11. [19]

    A survey on federated unlearning: Challenges, methods, and future directions,

    Z. Liu et al., "A survey on federated unlearning: Challenges, methods, and future directions," ACM Computing Surveys, vol. 57, no. 1, pp. 1-38, 2024

    2024

  12. [20]

    In addition, Wang et al

    further eliminate a client’s contribution by subtracting the accumulated historical updates from the model and leveraging the knowledge distillation technique to restore the model’s performance without relying on any data from the clients. In addition, Wang et al. [21] observe...

  13. [21]

    Asynchronous federated unlearning,

    N. Su and B. Li, “Asynchronous federated unlearning,” in Proceedings of INFOCOM, 2023, pp. 1–10

    2023

  14. [22]

    Fast federated machine unlearning with nonlinear functional theory,

    T. Che, Y. Zhou, Z. Zhang, L. Lyu, J. Liu, D. Yan, D. Dou, and J. Huan, “Fast federated machine unlearning with nonlinear functional theory,” in Proceedings of ICML, 2023

    2023

  15. [23]

    Verifi: Towards verifiable federated unlearning,

    X. Gao, X. Ma, J. Wang, Y. Sun, B. Li, S. Ji, P. Cheng, and J. Chen, “Verifi: Towards verifiable federated unlearning,” IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  16. [24]

    idlg: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, "idlg: Improved deep leakage from gradients," arXiv preprint arXiv:2001.02610, 2020

    2001 arXiv

  17. [25]

    Inverting gradients-how easy is it to break privacy in federated learning?,

    J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, "Inverting gradients-how easy is it to break privacy in federated learning?," Advances in neural information processing systems, vol. 33, pp. 16937-16947, 2020

    2020

  18. [26]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, "See through gradients: Image batch recovery via gradinversion," in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 16337-16346

    2021

  19. [27]

    [28] who combined GAN priors with gradient-free optimizers to bypass existing defenses

    pioneering the use of GANs to improve reconstruction quality, followed by Li et al. [28] who combined GAN priors with gradient-free optimizers to bypass existing defenses. Fang et al

  20. [28]

    When federated learning meets privacy -preserving computation,

    J. Chen, H. Yan, Z. Liu, M. Zhang, H. Xiong, and S. Yu, "When federated learning meets privacy -preserving computation," ACM Computing Surveys, vol. 56, no. 12, pp. 1-36, 2024

    2024

  21. [29]

    [30] proposed a generative gradient inversion framework that eliminates the need for iterative optimization through auxiliary data and feature separation techniques

    further enhanced this approach by improving GAN latent space representations for better attack performance.Beyond traditional GANs, Yang et al. [30] proposed a generative gradient inversion framework that eliminates the need for iterative optimization through auxiliary data an...

  22. [30]

    Securing secure aggregation: Mitigating multi- round privacy leakage in federated learning,

    J. So, R. E. Ali, B. Güler, J. Jiao, and A. S. Avestimehr, "Securing secure aggregation: Mitigating multi- round privacy leakage in federated learning," in Proceedings of the AAAI Conference on Artificial Intelligence, 2023, vol. 37, no. 8, pp. 9864-9873

    2023

  23. [31]

    Federated unlearning with knowledge distillation,

    C. Wu, S. Zhu, and P. Mitra, “Federated unlearning with knowledge distillation,” CoRR arXiv:2201.09441, 2022

    2022 arXiv

  24. [32]

    Federated unlearning via classdiscriminative pruning,

    J. Wang, S. Guo, X. Xie, and H. Qi, “Federated unlearning via classdiscriminative pruning,” in Proceedings of WWW, 2022, pp. 622–632

    2022

  25. [33]

    The right to be forgotten in federated learning: An efficient realization with rapid retraining,

    Y. Liu, L. Xu, X. Yuan, C. Wang, and B. Li, “The right to be forgotten in federated learning: An efficient realization with rapid retraining,” in Proceedings of INFOCOM, 2022, pp. 1749–1758

    2022

  26. [34]

    honest-but-curious

    and secret sharing [49] , [35]. However, merely relying on MPC isn’t sufficient to resist inference attacks over the output [36], [37]. Another line of research seeks to constrain the amount of leaked sensitive information by intentionally sharing degraded gradients. Different...

  27. [35]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, "Deep leakage from gradients," Advances in neural information processing systems, vol. 32, 2019

    2019

  28. [36]

    Gradient inversion with generative image prior,

    J. Jeon, K. Lee, S. Oh, and J. Ok, "Gradient inversion with generative image prior," Advances in neural information processing systems, vol. 34, pp. 29898-29908, 2021

    2021

  29. [37]

    Auditing privacy defenses in federated learning via generative gradient leakage,

    Z. Li, J. Zhang, L. Liu, and J. Liu, "Auditing privacy defenses in federated learning via generative gradient leakage," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10132-10142

    2022

  30. [38]

    Gifd: A generative gradient inversion method with f eature domain optimization,

    H. Fang, B. Chen, X. Wang, Z. Wang, and S. -T. Xia, "Gifd: A generative gradient inversion method with f eature domain optimization," in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4967-4976

    2023

  31. [39]

    Fast generation -based gradient leakage attacks: An approach to generate training data directly from the gradient,

    H. Yang et al., "Fast generation -based gradient leakage attacks: An approach to generate training data directly from the gradient, " IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  32. [40]

    DGGI: Deep Generative Gradient Inversion with diffusion model,

    L. Wu, Z. Liu, B. Pu, K. Wei, H. Cao, and S. Yao, "DGGI: Deep Generative Gradient Inversion with diffusion model," Information Fusion, vol. 113, p. 102620, 2025

    2025

  33. [41]

    Secureml: A system for scalable privacy - preserving machine learning,

    P. Mohassel and Y. Zhang, "Secureml: A system for scalable privacy - preserving machine learning," in 2017 IEEE symposium on security and privacy (SP), 2017: IEEE, pp. 19-38

    2017

  34. [42]

    QUOTIENT: Two-party secure neural network training and prediction,

    N. Agrawal, A. Shahin Shamsabadi, M. J. Kusner, and A. Gascón, "QUOTIENT: Two-party secure neural network training and prediction," in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1231-1247

    2019

  35. [43]

    Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption,

    S. Hardy et al., "Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption," arXiv preprint arXiv:1711.10677, 2017

    2017 arXiv

  36. [44]

    VerifyNet: Secure and verifiable federated learning,

    G. Xu, H. Li, S. Liu, K. Yang, and X. Lin, "VerifyNet: Secure and verifiable federated learning," IEEE Transactions on Information Forensics and Security, vol. 15, pp. 911-926, 2019

    2019

  37. [45]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, "Exploiting unintended feature leakage in collaborative learning," in 2019 IEEE symposium on security and privacy (SP), 2019: IEEE, pp. 691-706

    2019

  38. [46]

    Secureml: A system for scalable privacy- preserving machine learning,

    P. Mohassel and Y. Zhang, "Secureml: A system for scalable privacy- preserving machine learning," in 2017 IEEE symposium on security and privacy (SP), 2017: IEEE, pp. 19-38

    2017

  39. [47]

    Differentially private federated learning: A client level perspective,

    R. C. Geyer, T. Klein, and M. Nabi, "Differentially private federated learning: A client level perspective," arXiv preprint arXiv:1712.07557, 2017

    2017 arXiv

  40. [48]

    Gradient-leakage resilient federated learning,

    W. Wei, L. Liu, Y. Wu, G. Su, and A. Iyengar, "Gradient-leakage resilient federated learning," in 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS), 2021: IEEE, pp. 797-807

    2021

  41. [49]

    Preserving data privacy in federated learning through large gradient pruning,

    Z. Zhang, Z. Tianqing, W. Ren, P. Xiong, and K.-K. R. Choo, "Preserving data privacy in federated learning through large gradient pruning," Computers & Security, vol. 125, p. 103039, 2023

    2023

  42. [50]

    Soteria: Provable defense against privacy leakage in federated learning from representation perspective,

    J. Sun, A. Li, B. Wang, H. Yang, H. Li, and Y. Chen, "Soteria: Provable defense against privacy leakage in federated learning from representation perspective," in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 9311-9319

    2021

  43. [51]

    A framework for evaluating client privacy leakages in federated learning,

    W. Wei et al. , "A framework for evaluating client privacy leakages in federated learning," in Computer Security–ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18, 2020, Proceedings, Part I 25, 2020: Springer, ...

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.