Pith. sign in

REVIEW 3 major objections 7 minor 58 references

Boosting Gradient Leakage Attacks: Data Reconstruction in Realistic FL Settings

T0 review · 3 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An honest-but-curious server can reconstruct recognizable client images from shared gradients in realistic federated learning settings, using partial gradient matching and gradient regularization.

desk verdict A genuinely new attack recipe with an evaluation protocol worth adopting, but the reported numbers are best-of-many upper bounds, not single-run outcomes, so the 'high-fidelity' claim is not yet supported. read the letter →

arxiv 2506.08435 v1 pith:YYQWRUP6 submitted 2025-06-10 cs.LG cs.CRcs.CV

Mingyuan Fan , Fuyi Wang , Cen Chen , Jianying Zhou This is my paper
classification cs.LGcs.CRcs.CV
keywords gradientleakageattackfederatedlearningdatareconstructionmatchingpartialregularizationprivacyimageinversion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning shares model gradients instead of raw data, but this paper argues those gradients are a working privacy leak in realistic deployments. Existing gradient leakage attacks reconstruct only noise under small batches and favorable assumptions; the paper says the real problem is that those attacks solve the gradient matching optimization badly, not that the problem has many equally valid solutions. It derives a sufficient condition for convergence and builds FedLeak around two mechanisms—partial gradient matching and gradient regularization—that make the condition hold. Under a protocol matched to industrial practice (batch sizes 16–64, ResNet/DenseNet/MobileNet/ViT, pretrained weights, ImageNet and medical images, no auxiliary client information), FedLeak reconstructs recognizable images where the baselines do not. If the paper is right, the debate over whether FL leaks data shifts to how much degradation defenses must accept.

What carries the argument

The load-bearing machinery is the gradient matching problem, formulated as minimizing a distance between the gradients of a dummy input and the server-observed gradient $\hat g$, together with the derived sufficient condition that the ratio $2\mu/L$ must be large enough to admit a useful step size. The first technique, partial gradient matching, selects the indices $\Lambda$ of the top $R\%$ largest-magnitude gradient elements and matches only those coordinates; the paper argues these are the coordinates whose individual matching contributes most to increasing $\mu$. The second technique, gradient regularization, blends the gradient at the current dummy input with the gradient at a small forward perturbation $x'+\varphi$, a finite-difference approximation of the Hessian-based regularization term that would otherwise be computationally prohibitive. These two mechanisms, applied to the composite distance of Equation 15 (L1 plus cosine distance, total variation, and an activation-sparsity penalty), are what let FedLeak keep $2\mu/L$ high and stable enough for Adam to reach the true input.

What would settle it

Run the magnitude-sensitivity correlation check on a different architecture or dataset—for example, compute the Pearson correlation between gradient-element magnitude and $\sum_j |\partial g'[i]/\partial x'[j]|$ on a Vision Transformer or on a medical image set; if the correlation falls below about 0.3 and FedLeak still reconstructs at high PSNR with $R=50$, then the top-magnitude selection rule is not the mechanism carrying the attack. Conversely, if reconstruction collapses when only the bottom-magnitude coordinates are matched, the selection rule is confirmed as load-bearing.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the gradient matching problem behind gradient leakage attacks is well-posed for realistic networks: for a network with a fully connected first layer and at least one further layer, distinct inputs generate distinct gradients (Theorem 1), so noisy reconstructions are the signature of failed optimization rather than of multiple valid answers. The paper then derives a sufficient convergence condition for matching: with $x'$ the dummy input and $g'$ its gradient, each descent step is guaranteed to approach the true input if $\langle x'_j - x, \nabla_{x'} \mathrm{dist}(g'_j, \hat g)\rangle > \mu \|x - x'_j\|^2$ and $\|\nabla_{x'} \mathrm{dist}(g'_j, \hat g)\|^2 < L \|x - x'_j\|^2$, because then any step size $\eta < 2\mu/L$ shrinks the distance to the true input. FedLeak is the operational version of that condition: it aligns only the top $R\%$ most magnitude-heavy gradient elements, which concentrates the optimization on coordinates whose matching moves the loss landscape, and it regularizes by blending the gradient at the dummy input with the gradient at a small forward perturbation, a first-order stand-in for Hessian regularization. With these two techniques it reports high-fidelity reconstruction at batch sizes 16–64 across CNN and ViT architectures, with and without pretrained weights, and without access to batch normalization statistics or the clients' data distribution. This is the ground on which the paper claims FL's default protocol is insufficient to protect client data.

Load-bearing premise

FedLeak's selection rule assumes that the gradient elements with the largest magnitudes are the ones whose individual matching most improves convergence, and the paper's support for that assumption is a single measured correlation (0.7372 on CIFAR-10 with ResNet10) plus a theorem about an idealized L1 objective, not about the composite loss that is actually optimized.

Editorial extensions

If this is right

  • An honest-but-curious server in a standard FL deployment can reconstruct recognizable client images at batch sizes 16–64 on common CNN architectures, without needing batch normalization statistics, data distributions, or any manipulation of training.
  • Gradient perturbation defenses (DP, Soteria, OUTPOST, Guardian, quantization) must push model accuracy down substantially—often below 50%—before reconstructed images stop carrying meaning, so utility-preserving defense remains unresolved.
  • The largest-magnitude gradient elements carry most of the reconstruction signal: restricting server access to them (e.g., encrypting only the top 80%) could blunt attacks, and noise scaled to gradient magnitude would target the information-bearing coordinates.
  • Increasing local steps to one full epoch weakens but does not stop reconstruction, and secure aggregation that hides individual clients' gradients behind aggregation with at least two or three participants is the most reliable mitigation tested.
  • Larger, wider, and deeper models leak more; ViT and lightweight MobileNet resist somewhat better, meaning architecture choice changes the practical privacy risk.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The top-$R\%$ selection rule suggests a general diagnostic: for any model family, the empirical correlation between gradient-element magnitude and input sensitivity could predict how vulnerable that architecture is to gradient inversion; the paper measures this correlation only for ResNet10 on CIFAR-10.
  • If the magnitude-sensitivity correlation is architecture-dependent, then the attack's reach to future architectures—especially attention-based or state-space models—is an open question, and the paper's weaker ViT numbers hint at this boundary.
  • A practical takeaway the paper hints at but does not itself standardize is a privacy benchmark: reporting batch size, model, initialization, local steps, and defense strength together, with a fixed human-assessed success metric, would make future FL privacy claims comparable.
  • The paper's risk thresholds are defined by PSNR bands, and its human-assessed attack success rate is about 20%; a stronger reading of the result is that semantic leakage is real but partial, so defense research should target preventing recognizable structure rather than exact pixel recovery.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes FEDLEAK, a gradient leakage attack for federated learning that combines partial gradient matching (matching only the top-magnitude gradient elements) with a gradient regularization term approximated by blending gradients at two nearby points. The authors also introduce a 'practical evaluation protocol' and use it to claim that FEDLEAK reconstructs high-fidelity images at batch sizes 16–64, on benchmark and medical datasets, across CNN and ViT architectures, with and without local steps and under several defenses. The main empirical evidence is a series of tables and figures comparing FEDLEAK against iDLG, IG, GI, GGL, and ROGS, with reported PSNR, SSIM, LPIPS, and ASR numbers.

Significance. If the reported results hold, the paper makes a useful empirical contribution: it would demonstrate that honest-but-curious servers can reconstruct recognizable client images under conditions closer to production FL than most prior attack evaluations, and it provides a structured checklist of evaluation factors (batch size, model, dataset, attack stage, initialization, auxiliary information, local step, defenses). The paper also offers a theoretical framing of gradient matching and a novel optimization recipe. The comparison against ROGS/GGL that use data-distribution priors is a strength, as is the breadth of datasets and models tested, the ablation of hyperparameters, and the explicit cost analysis. However, the evaluation protocol as reported (best-matched image across multiple attack rounds) is a serious threat to the quantitative claims, and the theoretical derivation does not directly cover the composite loss actually optimized. With those concerns addressed, the paper's practical relevance would be considerable.

major comments (3)
  1. [Section 5, Evaluation approach; Tables 3–10; Figures 3–5] The manuscript states: 'Attacks are carried out at the 2000×{0,1,2,3,4,5}-th rounds. For each image, we find the most similar reconstructed image to calculate metrics.' As written, this permits two forms of favorable selection: (i) for each ground-truth image, taking the best reconstruction across the six attacked rounds, i.e., a best-of-six selection, and (ii) matching each ground-truth image to the most similar reconstructed image in the batch without enforcing a one-to-one assignment. Under either reading, the reported PSNR, SSIM, LPIPS, and ASR values are per-image upper bounds rather than the output a server would obtain from a single gradient exchange. Because the central claim in the abstract and in Section 1 ('high-fidelity data reconstruction ... in practical environments') rests directly on these numbers, the paper needs to re-evaluate with a fixed protocol: report results for a single attack round (or average over the six rounds), enforce a one-to-one correspondence between ground-truth and reconstructed images, and include variances or success fractions. Without this, the magnitude of the reported improvements over baselines is not established.
  2. [Section 4.2, Theorem 2, and Section 4.4, Equation (15)] Theorem 2 establishes a higher μ for partial gradient matching only for an L1 distance with an oracle index set chosen by the largest inner products, as shown in Equation (9). The loss actually optimized, Equation (15), is a composite of L1 distance, cosine distance, total variation, and an activation penalty, and the index set Λ is selected by gradient magnitude rather than by inner-product values. The paper's justification for magnitude-based selection is a single empirical correlation (0.7372 in Appendix C), and no argument shows that the theorem's conclusion transfers to the composite loss. This is not fatal for the empirical attack, but it means the paper's stated contribution of a 'sufficient condition' and a 'guiding principle' is not proven for the implemented method. The claims in Section 1 and Section 4 should be softened to heuristic, or the analysis should be extended.
  3. [Section 1, Table 10, and Section 6.4] The paper claims to be 'the first attack method capable of reconstructing high-fidelity data from gradients shared by clients in practical environments.' This is a strong novelty claim that depends on the metric protocol discussed above. In addition, the ASR of 20.40% in Table 10 is computed only for reconstructions from a single client across the six attacked rounds, and the human-evaluation protocol is described only briefly; the sample size and inter-annotator agreement are not reported. Similarly, the defense trade-off curves in Figure 4 do not explain whether the PSNR values are single-round or best-of-round; if they are best-of-round, the defenses may be stronger than shown. Please clarify and, if necessary, re-plot with the fixed protocol.
minor comments (7)
  1. [Section 2.1] There is a typo: 'peformance' should be 'performance'.
  2. [Section 3] The text contains 'To illustrate this rmore concretely' — likely a leftover fragment; please correct to 'To illustrate this more concretely'.
  3. [Section 4.3, Equations (11)–(14)] Equation (12) uses a first-order Taylor expansion of the gradient; please state explicitly that the Hessian is evaluated at a point between x' and x'+φ, and clarify that the approximation in Equation (13) ignores higher-order terms.
  4. [Section 6.3] In 'we use Lung-Colon Cancer and stimulate three non-IID scenarios', 'stimulate' should read 'simulate'.
  5. [Appendix B] The notation '∇^2 L(F(z,w),y)' is ambiguous: it should indicate the Hessian with respect to the model inputs. Also, the statement that the Hessian 'should indeed be positive definite' for a well-fit model is asserted without a derivation or reference; please supply one or label this as a heuristic.
  6. [Section 6.4, Figure 4] The utility-privacy plots would benefit from error bars or at least a statement of how many repeated runs were averaged; as presented, it is unclear whether the PSNR values are single-run or averaged.
  7. [Section 7] The mitigation discussion introduces a noise-cancellation scheme between clients; it is under-specified (how clients agree on M, what happens if a client drops out, and how this interacts with the honest-but-curious server assumption). Since this is a suggestion for future work, a brief caveat would suffice.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; the attack's success is empirical and not derived from its own inputs.

full rationale

The paper's derivation chain is not circular under the taxonomy. The convergence analysis in Section 3 derives a standard sufficient decrease condition from the descent inequality (Eqs. 4-6); it does not assume the attack's success. Theorem 1's uniqueness invocation is cited to Geiping et al. [22], not to the authors. Theorem 2 and its appendix proof reduce to the elementary lemma that removing small elements from a set raises the average; this tautology is used only to motivate matching top-gradient elements, not to derive the empirical PSNR numbers. The choice of index set Lambda is explicitly approximate, supported by an independent correlation measurement (Appendix C, r=0.7372). The headline reconstruction results are empirical outcomes of optimizing Eq. (15), not quantities built from those results. Hyperparameters (R, lambda', alpha, beta) are tuned on CIFAR-10 in Appendix F and then applied to other datasets; this is standard practice and does not make later numbers circular predictions. The only self-citations are Guardian ([19]) as a defense baseline and [18] for loss design; neither is load-bearing because the main attack results are defense-free and the defense analysis includes external baselines. A separate evaluation-validity concern exists: Section 5 says 'For each image, we find the most similar reconstructed image to calculate metrics,' which may turn reported PSNR/SSIM into per-image best-of-several upper bounds rather than single-attempt reconstructions. That is a measurement-selection issue, not an equation-level circularity, so it does not change the circularity score under the stated rules.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities are introduced. The attack relies on free parameters tuned on a development dataset and a set of domain assumptions about network differentiability, gradient sensitivity, and representativeness of the evaluation protocol.

free parameters (5)
  • matching ratio R = 50%
    Selected as the optimum in Table 15 (CIFAR-10, batch 32). This is a hand-tuned constant used by the attack.
  • blend factor λ' = 0.7
    Selected from sensitivity analysis in Table 16 (CIFAR-10). Blends gradients at x and x+φ.
  • TV weight α = 1×10^-5
    Hand-tuned; Table 17 shows the best α is 10^-4 on CIFAR-10, but the paper fixes α=10^-5 for all experiments.
  • activation penalty β = 1×10^-4
    Hand-tuned; Table 18 shows β=10^-3 gives best PSNR, but the paper fixes β=10^-4.
  • perturbance scale k = not reported (absorbed into λ')
    The finite-difference step in Algorithm 1 line 7 requires a small k; the paper never states its value, claiming λ'=λ/k is tuned instead.
assumptions (5)
  • domain assumption The gradient matching problem is overdetermined and admits a unique solution for the networks considered (Theorem 1).
    Theorem 1 is quoted from Geiping et al. [22] and extends to CNNs/transformers by analogy, not by proof. If false, there may be multiple valid reconstructions and the convergence target is ambiguous.
  • ad hoc to paper High-magnitude gradient elements are the most sensitive to input changes (Section 4.2, Appendix C).
    Empirically validated by a single correlation (0.7372) on CIFAR-10/ResNet10; generalized to all models and datasets without proof.
  • ad hoc to paper The sufficient condition in Equation (5) is satisfiable by the proposed heuristics along the optimization path.
    Figure 1d shows 2μ/L increases for FedLeak on a toy experiment, but no proof that the actual composite loss and subset selection maintain this property.
  • domain assumption The Hessian of the loss is positive definite in the relevant region (Appendix B).
    Used to bound reconstruction error from gradient estimation error; assumed true for well-fitted models without verification on the studied datasets.
  • domain assumption The practical evaluation protocol (batch size 16-64, local step 1 or 12, pretrained/random init, etc.) represents real-world FL.
    Based on a literature review (Appendix E) with a limited number of papers and library defaults; may not generalize to all production FL systems.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Boosting Gradient Leakage Attacks: Data Reconstruction in Realistic FL Settings." pith.science (2026). https://pith.science/paper/YYQWRUP6

@misc{pith2026250608435,
  author       = {Pith},
  title        = {Pith review of: Boosting Gradient Leakage Attacks: Data Reconstruction in Realistic FL Settings},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YYQWRUP6}},
  note         = {Machine review of arXiv:2506.08435}
}
read the original abstract

Federated learning (FL) enables collaborative model training among multiple clients without the need to expose raw data. Its ability to safeguard privacy, at the heart of FL, has recently been a hot-button debate topic. To elaborate, several studies have introduced a type of attacks known as gradient leakage attacks (GLAs), which exploit the gradients shared during training to reconstruct clients' raw data. On the flip side, some literature, however, contends no substantial privacy risk in practical FL environments due to the effectiveness of such GLAs being limited to overly relaxed conditions, such as small batch sizes and knowledge of clients' data distributions. This paper bridges this critical gap by empirically demonstrating that clients' data can still be effectively reconstructed, even within realistic FL environments. Upon revisiting GLAs, we recognize that their performance failures stem from their inability to handle the gradient matching problem. To alleviate the performance bottlenecks identified above, we develop FedLeak, which introduces two novel techniques, partial gradient matching and gradient regularization. Moreover, to evaluate the performance of FedLeak in real-world FL environments, we formulate a practical evaluation protocol grounded in a thorough review of extensive FL literature and industry practices. Under this protocol, FedLeak can still achieve high-fidelity data reconstruction, thereby underscoring the significant vulnerability in FL systems and the urgent need for more effective defense methods.

Figures

Figures reproduced from arXiv: 2506.08435 by the authors.

Figure 1
Figure 1. Figure 1a shows the L2 GD between the images recovered by iDLG and the corresponding ground-truth images. Figure 1b demonstrates the L2 GD between the ground-truth images and the same images with varying levels of random sign noise added. Figure 1c and Figure 1d illustrate the values of 2µ L associated with x ′ achieved by the gradient descent algorithm and FEDLEAK, both with a step size of 1×10−4 . All results are … view at source ↗
Figure 2
Figure 2. The overview of the proposed attack FEDLEAK. Algorithm 1 Our attack: FEDLEAK Require: The global model F and parameters w; the gradi￾ents estimated by the server gˆ; the loss function (cross￾entropy loss) L; the step size η; the blend factor λ ′ ; the matching ratio R; maximum attack iterations I; 1: Infer the ground-truth labels y from gˆ using existing label inference techniques. 2: Initialize dummy data x ′ with … view at source ↗
Figure 3
Figure 3. The images recovered by FEDLEAK in three datasets. The batch size here is 32. See [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: The utility-privacy trade-offs of various defenses in [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Recovered images of FEDLEAK against combined defenses of Soteria and DP in Lung-Colon-Cancer. The left￾most image is the original image. The top row represents adaptive DP, while the bottom row shows standard DP-SGD. The values of ε from left to right are {105 ,104 ,10…
Figure 7
Figure 7. Figure 7: Performance of cryptography-based methods [7] against FEDLEAK with varying participating clients [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: The performance of FEDLEAK over two different gradient pruning strategies. 7 Mitigation and Future Work Section 6.4 shows that perturbation-based methods are in￾sufficient to fully resist FEDLEAK. We also observe that increasing local steps can significantly degrade th…
Figure 10
Figure 10. Figure 10: The search paths of the gradient descent algorithm [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 9
Figure 9. Figure 9: The x-axis represents the absolute value of the [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 11
Figure 11. Figure 11: The ground-truth batch of Figure [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: ROGS’s recovered batch in Lung-Colon Cancer. many useful elements, whereas matching too many can lead to an overly small µ value. The impact of blend factor λ ′ . A higher λ ′ heightens em￾phasis on gradient regularization, thereby reducing the value [PITH_FULL_IMAGE…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

58 extracted references · 49 canonical work pages

  1. [1]

    Federated learning and differential privacy for medical image analysis.Scientific reports, 12(1):1953, 2022

    Mohammed Adnan, Shivam Kalra, Jesse C Cresswell, et al. Federated learning and differential privacy for medical image analysis.Scientific reports, 12(1):1953, 2022

    work page 1953

  2. [2]

    A hybrid frame- work for glaucoma detection through federated machine learning and deep learning models.BMC Medical Infor- matics and Decision Making, 24(1):115, 2024

    Abeer Aljohani and Rua Y Aburasain. A hybrid frame- work for glaucoma detection through federated machine learning and deep learning models.BMC Medical Infor- matics and Decision Making, 24(1):115, 2024

    work page 2024

  3. [3]

    Privacy-preserving deep learning via additively homo- morphic encryption.IEEE TIFS, 13(5):1333–1345, 2017

    Yoshinori Aono, Takuya Hayashi, Lihua Wang, et al. Privacy-preserving deep learning via additively homo- morphic encryption.IEEE TIFS, 13(5):1333–1345, 2017

    work page 2017

  4. [4]

    Mislav Balunovic, Dimitar Iliev Dimitrov, Robin Staab, and Martin T. Vechev. Bayesian framework for gradient leakage. InICLR, 2022

    work page 2022

  5. [5]

    Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura

    Brian R. Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura. Adversarial robust- ness limits via scaling-law and human-alignment studies. InICML, 2024

    work page 2024

  6. [6]

    When the curious abandon honesty: Federated learning is not private

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, et al. When the curious abandon honesty: Federated learning is not private. InIEEE EuroS&P, pages 175–

    work page

  7. [7]

    Practical secure aggregation for privacy-preserving ma- chine learning

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, et al. Practical secure aggregation for privacy-preserving ma- chine learning. InCCS, pages 1175–1191, 2017. 14

    work page 2017

  8. [8]

    Convex optimization.Cambridge UP, 2004

    Stephen Boyd. Convex optimization.Cambridge UP, 2004

    work page 2004

Show all 58 references
  1. [9]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, et al. Extracting training data from large language models. In USENIX Security, pages 2633–2650, 2021

    2021

  2. [10]

    Quantifying memorization across neural language models.arXiv preprint arXiv:2202.07646, 2022

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, et al. Quantifying memorization across neural language models.arXiv preprint arXiv:2202.07646, 2022

    2022 arXiv

  3. [11]

    Extract- ing training data from diffusion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, et al. Extract- ing training data from diffusion models. InUSENIX Security, pages 5253–5270, 2023

    2023

  4. [12]

    Fowl, et al

    Hong-Min Chu, Jonas Geiping, Liam H. Fowl, et al. Panning for gold in federated learning: Targeted text extraction under arbitrarily large-scale aggregation. In ICLR, 2023

    2023

  5. [13]

    Revealing and protecting labels in distributed training

    Trung Dang, Om Thakkar, Swaroop Ramaswamy, et al. Revealing and protecting labels in distributed training. InNeurIPS, volume 34, pages 1727–1738, 2021

    2021

  6. [14]

    Federated learning for predicting clini- cal outcomes in patients with covid-19.Nature medicine, 27(10):1735–1743, 2021

    Ittai Dayan, Holger R Roth, Aoxiao Zhong, Ahmed Harouni, Amilcare Gentili, Anas Z Abidin, Andrew Liu, Anthony Beardsworth Costa, Bradford J Wood, Chien- Sung Tsai, et al. Federated learning for predicting clini- cal outcomes in patients with covid-19.Nature medicine, 27(10):17...

    2021

  7. [15]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, et al. An image is worth 16x16 words: Transformers for image recognition at scale. InICLR, 2021

    2021

  8. [16]

    Sok: Gradient leakage in federated learning.CoRR, abs/2404.05403, 2024

    Jiacheng Du, Jiahui Hu, Zhibo Wang, et al. Sok: Gradient leakage in federated learning.CoRR, abs/2404.05403, 2024

    2024 arXiv

  9. [17]

    The algorithmic foundations of differential privacy.Foundations and Trends® in Theoretical Computer Science, 9(3–4):211– 407, 2014

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy.Foundations and Trends® in Theoretical Computer Science, 9(3–4):211– 407, 2014

    2014

  10. [18]

    Exploiting pre-trained models and low- frequency preference for cost-effective transfer-based attack.ACM Trans

    Mingyuan Fan, Cen Chen, Chengyu Wang, and Jun Huang. Exploiting pre-trained models and low- frequency preference for cost-effective transfer-based attack.ACM Trans. Knowl. Discov. Data, jul 2024. ISSN 1556-4681

    2024

  11. [19]

    Guardian: Guarding against gradient leakage with provable de- fense for federated learning

    Mingyuan Fan, Yang Liu, Cen Chen, et al. Guardian: Guarding against gradient leakage with provable de- fense for federated learning. InProceedings of the 17th ACM International Conference on Web Search and Data Mining, pages 190–198, 2024

    2024

  12. [20]

    On the trustworthiness landscape of state-of-the-art generative models: A survey and outlook

    Mingyuan Fan, Chengyu Wang, Cen Chen, Yang Liu, and Jun Huang. On the trustworthiness landscape of state-of-the-art generative models: A survey and outlook. International Journal of Computer Vision, 2025

    2025

  13. [21]

    Adap dp-fl: Differ- entially private federated learning with adaptive noise

    Jie Fu, Zhili Chen, and Xiao Han. Adap dp-fl: Differ- entially private federated learning with adaptive noise. In2022 IEEE International Conference on Trust, Se- curity and Privacy in Computing and Communications (TrustCom), pages 656–663. IEEE, 2022

    2022

  14. [22]

    Inverting gradients-how easy is it to break privacy in federated learning? InNeurIPS, volume 33, pages 16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in federated learning? InNeurIPS, volume 33, pages 16937–16947, 2020

    2020

  15. [23]

    Differen- tially private federated learning: A client level perspec- tive.arXiv preprint arXiv:1712.07557, 2017

    Robin C Geyer, Tassilo Klein, and Moin Nabi. Differen- tially private federated learning: A client level perspec- tive.arXiv preprint arXiv:1712.07557, 2017

    2017 arXiv

  16. [24]

    Federated learning for medical image anal- ysis: A survey.Pattern Recognit., 151:110424, 2024

    Hao Guan, Pew-Thian Yap, Andrea Bozoki, and Mingxia Liu. Federated learning for medical image anal- ysis: A survey.Pattern Recognit., 151:110424, 2024

    2024

  17. [25]

    Does dif- ferential privacy really protect federated learning from gradient leakage attacks?IEEE Transactions on Mobile Computing, 2024

    Jiahui Hu, Jiacheng Du, Zhibo Wang, et al. Does dif- ferential privacy really protect federated learning from gradient leakage attacks?IEEE Transactions on Mobile Computing, 2024

    2024

  18. [26]

    Eval- uating gradient inversion attacks and defenses in feder- ated learning

    Yangsibo Huang, Samyak Gupta, Zhao Song, et al. Eval- uating gradient inversion attacks and defenses in feder- ated learning. InNeurIPS, pages 7232–7241, 2021

    2021

  19. [27]

    Gra- dient inversion with generative image prior

    Jinwoo Jeon, Kangwook Lee, Sewoong Oh, et al. Gra- dient inversion with generative image prior. InNeurIPS, volume 34, pages 29898–29908, 2021

    2021

  20. [28]

    Toward training at imagenet scale with differential pri- vacy.CoRR, abs/2201.12328, 2022

    Alexey Kurakin, Steve Chien, Shuang Song, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. Toward training at imagenet scale with differential pri- vacy.CoRR, abs/2201.12328, 2022

    2022 arXiv

  21. [29]

    An international study presenting a federated learning ai platform for pediatric brain tumors.Nature communica- tions, 15(1):7615, 2024

    Edward H Lee, Michelle Han, Jason Wright, et al. An international study presenting a federated learning ai platform for pediatric brain tumors.Nature communica- tions, 15(1):7615, 2024

    2024

  22. [30]

    On the convergence of fedavg on non-iid data

    Xiang Li, Kaixuan Huang, Wenhao Yang, et al. On the convergence of fedavg on non-iid data. InICLR, 2020

    2020

  23. [31]

    Fedbn: Federated learning on non-iid features via local batch normalization

    Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, et al. Fedbn: Federated learning on non-iid features via local batch normalization. InICLR, 2021

    2021

  24. [32]

    Auditing privacy defenses in federated learning via gen- erative gradient leakage

    Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing privacy defenses in federated learning via gen- erative gradient leakage. InCVPR, pages 10132–10142, 2022. 15

    2022

  25. [33]

    Backdoor defense with machine unlearning

    Yang Liu, Mingyuan Fan, Cen Chen, et al. Backdoor defense with machine unlearning. InINFOCOM, page 280–289. IEEE, 2022

    2022

  26. [34]

    Pre- dicting treatment response in multicenter non-small cell lung cancer patients based on federated learning.BMC cancer, 24(1):688, 2024

    Yuan Liu, Jinzao Huang, Jyh-Cheng Chen, et al. Pre- dicting treatment response in multicenter non-small cell lung cancer patients based on federated learning.BMC cancer, 24(1):688, 2024

    2024

  27. [35]

    SGDR: stochastic gradient descent with warm restarts

    Ilya Loshchilov and Frank Hutter. SGDR: stochastic gradient descent with warm restarts. InICLR, 2017

    2017

  28. [36]

    A tutorial on fisher information.Journal of Mathemati- cal Psychology, 80:40–55, 2017

    Alexander Ly, Maarten Marsman, Josine Verhagen, et al. A tutorial on fisher information.Journal of Mathemati- cal Psychology, 80:40–55, 2017

    2017

  29. [37]

    Instance-wise batch label restoration via gradients in federated learning

    Kailang Ma, Yu Sun, Jian Cui, et al. Instance-wise batch label restoration via gradients in federated learning. In The 11th International Conference on Learning Repre- sentations, 2023

    2023

  30. [38]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, et al. Towards deep learning models resistant to adversarial attacks. InICLR, 2018

    2018

  31. [39]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, et al. Communication-efficient learning of deep networks from decentralized data. InArtificial intelligence and statistics, pages 1273–1282. PMLR, 2017

    2017

  32. [40]

    Transforming large-size to lightweight deep neural networks for iot applications

    Rahul Mishra and Hari Gupta. Transforming large-size to lightweight deep neural networks for iot applications. ACM Computing Surveys, 55(11):1–35, 2023

    2023

  33. [41]

    Secureml: A system for scalable privacy-preserving machine learning

    Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy-preserving machine learning. InIEEE S&P, pages 19–38. IEEE, 2017

    2017

  34. [42]

    Nguyen, Ming Ding, Pubudu N

    Dinh C. Nguyen, Ming Ding, Pubudu N. Pathirana, et al. Federated learning for internet of things: A compre- hensive survey.IEEE Commun. Surv. Tutorials, 23(3): 1622–1658, 2021

    2021

  35. [43]

    Eluding secure aggregation in federated learning via model inconsistency

    Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. Eluding secure aggregation in federated learning via model inconsistency. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2429–2443, 2022

    2022

  36. [44]

    A survey on deep learning: Algorithms, techniques, and applica- tions.ACM computing surveys, 51(5):1–36, 2018

    Samira Pouyanfar, Saad Sadiq, Yilin Yan, et al. A survey on deep learning: Algorithms, techniques, and applica- tions.ACM computing surveys, 51(5):1–36, 2018

    2018

  37. [45]

    Federated learning in medicine: facil- itating multi-institutional collaborations without sharing patient data.Scientific reports, 10(1):12598, 2020

    Micah J Sheller, Brandon Edwards, G Anthony Reina, Jason Martin, et al. Federated learning in medicine: facil- itating multi-institutional collaborations without sharing patient data.Scientific reports, 10(1):12598, 2020

    2020

  38. [46]

    Soteria: Provable defense against privacy leakage in federated learning from representation perspective

    Jingwei Sun, Ang Li, Binghui Wang, et al. Soteria: Provable defense against privacy leakage in federated learning from representation perspective. InCVPR, pages 9311–9319, 2021

    2021

  39. [47]

    More than enough is too much: Adaptive defenses against gradient leakage in production federated learning.IEEE/ACM Transactions on Networking, 32(4):3061–3075, 2024

    Fei Wang, Ethan Hugh, and Baochun Li. More than enough is too much: Adaptive defenses against gradient leakage in production federated learning.IEEE/ACM Transactions on Networking, 32(4):3061–3075, 2024. doi: 10.1109/TNET.2024.3377655

    2024

  40. [48]

    Pro- tect privacy from gradient leakage attack in federated learning

    Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. Pro- tect privacy from gradient leakage attack in federated learning. InINFOCOM, pages 580–589. IEEE, 2022

    2022

  41. [49]

    Break- ing secure aggregation: Label leakage from aggre- gated gradients in federated learning.arXiv preprint arXiv:2406.15731, 2024

    Zhibo Wang, Zhiwei Chang, Jiahui Hu, et al. Break- ing secure aggregation: Label leakage from aggre- gated gradients in federated learning.arXiv preprint arXiv:2406.15731, 2024

    2024 arXiv

  42. [50]

    A frame- work for evaluating gradient leakage attacks in federated learning.CoRR, abs/2004.10397, 2020

    Wenqi Wei, Ling Liu, Margaret Loper, et al. A frame- work for evaluating gradient leakage attacks in federated learning.CoRR, abs/2004.10397, 2020

    2004 arXiv

  43. [51]

    Fishing for user data in large-batch federated learning via gradient magnification

    Yuxin Wen, Jonas Geiping, Liam Fowl, et al. Fishing for user data in large-batch federated learning via gradient magnification. InICML, volume 162, pages 23668– 23684. PMLR, 2022

    2022

  44. [52]

    See through gradients: Image batch recovery via gradinver- sion

    Hongxu Yin, Arun Mallya, Arash Vahdat, et al. See through gradients: Image batch recovery via gradinver- sion. InCVPR, pages 16337–16346, 2021

    2021

  45. [53]

    Gradient obfuscation gives a false sense of security in federated learning

    Kai Yue, Richeng Jin, Chau-Wai Wong, et al. Gradient obfuscation gives a false sense of security in federated learning. InUSENIX Security, pages 6381–6398, 2023

    2023

  46. [54]

    BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning

    Chengliang Zhang, Suyi Li, Junzhe Xia, et al. BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning. In2020 USENIX annual technical conference, pages 493–506, 2020

    2020

  47. [55]

    Re- cent methodological advances in federated learning for healthcare.Patterns, 5(6):101006, 2024

    Fan Zhang, Daniel Kreuter, Yichen Chen, et al. Re- cent methodological advances in federated learning for healthcare.Patterns, 5(6):101006, 2024

    2024

  48. [56]

    idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610, 2020

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610, 2020

    2001 arXiv

  49. [57]

    Zhao, Atul Sharma, Ahmed Roushdy Elko- rdy, et al

    Joshua C. Zhao, Atul Sharma, Ahmed Roushdy Elko- rdy, et al. Loki: Large-scale data reconstruction attack against federated learning through model manipulation. InIEEE S&P, pages 1287–1305. IEEE, 2024

    2024

  50. [58]

    specific/common parameters

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. InNeurIPS, volume 32, 2019. 16 Table 11: The gradient distance (GD) and PSNR using differ- ent attack strategies in MNIST and CIFAR-10. Attack Strategy MNIST CIFAR-10 GD PSNR GD PSNR BayesAttack 0.19 10.99 0.2...

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.