mlsanityData to 7 Oct 2026

Inverting Gradients -- How easy is it to break privacy in federated learning?

arXiv 2003.14053 ↗First posted 31 Mar 2020cs.CV cs.CR cs.LGcited by 707

Not on the map. Why?

Cited by 32 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The idea of federated learning is to collaboratively train a neural network on a server. Each user receives the current weights of the network and in turns sends parameter updates (gradients) based on local data. This protocol has been designed not only to train neural networks data-efficiently, but also to provide privacy benefits for users, as their input data remains on device and only parameter gradients are shared. But how secure is sharing parameter gradients? Previous attacks have provided a false sense of security, by succeeding only in contrived settings - even for a single image. However, by exploiting a magnitude-invariant loss along with optimization strategies based on adversarial attacks, we show that is is actually possible to faithfully reconstruct images at high resolution from the knowledge of their parameter gradients, and demonstrate that such a break of privacy is possible even for trained deep networks. We analyze the effects of architecture as well as parameters on the difficulty of reconstructing an input image and prove that any input to a fully connected layer can be reconstructed analytically independent of the remaining architecture. Finally we discuss settings encountered in practice and show that even averaging gradients over several iterations or several images does not protect the user's privacy in federated learning applications in computer vision.

Key facts. Cited by 707 papers in the map (data through 7 Oct 2026). First posted on arXiv 31 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 75; 2022: 127; 2023: 136; 2024: 161; 2025: 129; 2026: 79.

707 papers.

Sort:

By area:

  1. 2022Diffusion Models in Vision: A Surveycited by 1,008
  2. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  3. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  4. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
  5. 2021Federated Learning with Buffered Asynchronous Aggregationcited by 188
  6. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  7. 2022Reconstructing Training Data with Informed Adversariescited by 143
  8. 2021FedScale: Benchmarking Model and System Performance of Federated Learning at Scalecited by 135
  9. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  10. 2023Machine Learning for Synthetic Data Generation: A Reviewcited by 118
  11. 2021Rethinking Architecture Design for Tackling Data Heterogeneity in Federated Learningcited by 111
  12. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
38 more
  1. 2021Gradient Inversion with Generative Image Priorcited by 101
  2. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  3. 2022FedPrompt: Communication-Efficient and Privacy Preserving Prompt Tuning in Federated Learningcited by 86
  4. 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 81
  5. 2021Federated Reconstruction: Partially Local Federated Learningcited by 78
  6. 2022NVIDIA FLARE: Federated Learning from Simulation to Real-Worldcited by 78
  7. 2023Federated Learning for Medical Image Analysis: A Surveycited by 77
  8. 2021CAFE: Catastrophic Data Leakage in Vertical Federated Learningcited by 76
  9. 2022Variational Model Inversion Attackscited by 75
  10. 2021Differentially Private Federated Learning on Heterogeneous Datacited by 74
  11. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 72
  12. 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
  13. 2022Recovering Private Text in Federated Learning of Language Modelscited by 67
  14. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
  15. 2021From Distributed Machine Learning to Federated Learning: A Surveycited by 65
  16. 2021LightSecAgg: a Lightweight and Versatile Design for Secure Aggregation in Federated Learningcited by 63
  17. 2021What Do We Mean by Generalization in Federated Learning?cited by 62
  18. 2021HarmoFL: Harmonizing Local and Global Drifts in Federated Learning on Heterogeneous Medical Imagescited by 62
  19. 2021Privacy-Preserving Machine Learning: Methods, Challenges and Directionscited by 58
  20. 2025Embodied AI Agents: Modeling the Worldcited by 57
  21. 2022FederatedScope: A Flexible Federated Learning Platform for Heterogeneitycited by 53
  22. 2023Federated Continual Learning via Knowledge Fusion: A Surveycited by 53
  23. 2022Decepticons: Corrupted Transformers Breach Privacy in Federated Learning for Language Modelscited by 52
  24. 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 52
  25. 2022GradViT: Gradient Inversion of Vision Transformerscited by 52
  26. 2021Federated Learning for Internet of Things: Applications, Challenges, and Opportunitiescited by 49
  27. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  28. 2021Challenges and Approaches for Mitigating Byzantine Attacks in Federated Learningcited by 46
  29. 2022Preserving Privacy in Federated Learning with Ensemble Cross-Domain Knowledge Distillationcited by 45
  30. 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
  31. 2022Do Gradient Inversion Attacks Make Federated Learning Unsafe?cited by 44
  32. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  33. 2021FLOP: Federated Learning on Medical Datasets using Partial Networkscited by 42
  34. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  35. 2022Closing the Generalization Gap of Cross-silo Federated Medical Image Segmentationcited by 41
  36. 2023A Data-Free Approach to Mitigate Catastrophic Forgetting in Federated Class Incremental Learning for Vision Taskscited by 41
  37. 2021Gradient-Leakage Resilient Federated Learningcited by 40
  38. 2021Towards General Deep Leakage in Federated Learningcited by 40

50 most cited of 707 All 707 (JSON)