R-GAP: Recursive Gradient Attack on Privacy
Not on the map. Why?
Abstract (arXiv)
Federated learning frameworks have been regarded as a promising approach to break the dilemma between demands on privacy and the promise of learning from large collections of distributed data. Many such frameworks only ask collaborators to share their local update of a common model, i.e. gradients with respect to locally stored data, instead of exposing their raw data to other collaborators. However, recent optimization-based gradient attacks show that raw data can often be accurately recovered from gradients. It has been shown that minimizing the Euclidean distance between true gradients and those calculated from estimated data is often effective in fully recovering private data. However, there is a fundamental lack of theoretical understanding of how and when gradients can lead to unique recovery of original data. Our research fills this gap by providing a closed-form recursive procedure to recover data from gradients in deep neural networks. We name it Recursive Gradient Attack on Privacy (R-GAP). Experimental results demonstrate that R-GAP works as well as or even better than optimization-based approaches at a fraction of the computation under certain conditions. Additionally, we propose a Rank Analysis method, which can be used to estimate the risk of gradient attacks inherent in certain network architectures, regardless of whether an optimization-based or closed-form-recursive attack is used. Experimental results demonstrate the utility of the rank analysis towards improving the network's security. Source code is available for download from https://github.com/JunyiZhu-AI/R-GAP.
Key facts. Cited by 95 papers in the map (data through 7 Oct 2026). First posted on arXiv 15 Oct 2020.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 14; 2022: 17; 2023: 22; 2024: 24; 2025: 11; 2026: 7.
95 papers.
Sort:
By area:
- 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
- 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
- 2021Gradient Inversion with Generative Image Priorcited by 101
- 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 88
- 2021CAFE: Catastrophic Data Leakage in Vertical Federated Learningcited by 76
- 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 72
- 2022Recovering Private Text in Federated Learning of Language Modelscited by 67
- 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
- 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 52
- 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
- 2023Recent Advances on Federated Learning: A Systematic Surveycited by 40
- 2022A Survey on Gradient Inversion: Attacks, Defenses and Future Directionscited by 39
38 more
- 2022Masked Jigsaw Puzzle: A Versatile Position Embedding for Vision Transformerscited by 33
- 2021PRECODE - A Generic Model Extension to Prevent Deep Gradient Leakagecited by 28
- 2022Reconstructing Training Data from Model Gradient, Provablycited by 27
- 2022Data Leakage in Federated Averagingcited by 26
- 2023Privacy and Fairness in Federated Learning: on the Perspective of Trade-offcited by 26
- 2021APRIL: Finding the Achilles' Heel on Privacy for Vision Transformerscited by 23
- 2022On the (In)security of Peer-to-Peer Decentralized Machine Learningcited by 23
- 2021User-Level Label Leakage from Gradients in Federated Learningcited by 21
- 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 18
- 2021Gradient Leakage Attack Resilient Deep Learningcited by 17
- 2021Understanding Training-Data Leakage from Gradients in Neural Networks for Image Classificationcited by 16
- 2023A Survey for Federated Learning Evaluations: Goals and Measurescited by 16
- 2022AGIC: Approximate Gradient Inversion Attack on Federated Learningcited by 15
- 2023Privacy-preserving quantum federated learning via gradient hidingcited by 15
- 2024SPEAR:Exact Gradient Inversion of Batches in Federated Learningcited by 14
- 2022TabLeak: Tabular Data Leakage in Federated Learningcited by 13
- 2023Securing Distributed SGD against Gradient Leakage Threatscited by 13
- 2023Privacy Assessment on Reconstructed Images: Are Existing Evaluation Metrics Faithful to Human Perception?cited by 13
- 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attackscited by 13
- 2024GI-NAS: Boosting Gradient Inversion Attacks Through Adaptive Neural Architecture Searchcited by 13
- 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
- 2024DAGER: Exact Gradient Inversion for Large Language Modelscited by 12
- 2022Concealing Sensitive Samples against Gradient Leakage in Federated Learningcited by 11
- 2023Surrogate Model Extension (SME): A Fast and Accurate Weight Update Attack on Federated Learningcited by 10
- 2023Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learningcited by 9
- 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
- 2021Privacy Vulnerability of Split Computing to Data-Free Model Inversion Attackscited by 8
- 2021Improving Differentially Private SGD via Randomly Sparsified Gradientscited by 8
- 2023Expressive variational quantum circuits provide inherent privacy in federated learningcited by 8
- 2024Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attackscited by 7
- 2023Understanding Deep Gradient Leakage via Inversion Influence Functionscited by 6
- 2023Beyond Gradient and Priors in Privacy Attacks: Leveraging Pooler Layer Inputs of Language Models in Federated Learningcited by 6
- 2022Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategiescited by 5
- 2022Two Models are Better than One: Federated Learning Is Not Private For Google GBoard Next Word Predictioncited by 4
- 2023Probably Approximately Correct Federated Learningcited by 4
- 2023Temporal Gradient Inversion Attacks with Robust Optimizationcited by 4
- 2023Privacy Risks in Reinforcement Learning for Household Robotscited by 4
- 2023Client-side Gradient Inversion Against Federated Learning from Poisoningcited by 4
50 most cited of 95 All 95 (JSON)
- 2026Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning29 Sep 2026
- 2026TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement30 Jul 2026
- 2026Predictability as a Fine-Grained Measure for Privacy18 Jun 2026
- 2026TIGER: Inverting Transformer Gradients via Embedding-Subspace Distance Optimization16 Jun 2026
- 2026No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning16 Apr 2026
- 2026FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs7 Apr 2026
- 2026Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization1 Apr 2026
- 2025Privacy in Federated Learning with Spiking Neural Networks26 Nov 2025
- 2025GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Models20 Oct 2025
- 2025Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning11 Sep 2025
- 2025AdaDPIGU: Differentially Private SGD with Adaptive Clipping and Importance-Based Gradient Updates for Deep Neural Networks9 Jul 2025
- 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems2 Jun 2025
38 more
- 2025Label Leakage in Federated Inertial-based Human Activity Recognition27 May 2025
- 2025Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakage26 May 2025
- 2025TS-Inverse: A Gradient Inversion Attack Tailored for Federated Time Series Forecasting Models26 Mar 2025
- 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attacks13 Mar 2025
- 2025FedEM: A Privacy-Preserving Framework for Concurrent Utility Preservation in Federated Learning8 Mar 2025
- 2025Model Inversion Attack against Federated Unlearning20 Feb 2025
- 2024GDBR: Label Recovery Attack Against Partial Gradient Encryption in Federated Learning17 Dec 2024
- 2024Training Data Reconstruction: Privacy due to Uncertainty?11 Dec 2024
- 2024Gradient Inversion Attack on Graph Neural Networks29 Nov 2024
- 2024Federated Black-Box Adaptation for Semantic Segmentation31 Oct 2024
- 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Study28 Sep 2024
- 2024Data Poisoning and Leakage Analysis in Federated Learning19 Sep 2024
- 2024Understanding Data Reconstruction Leakage in Federated Learning from a Theoretical Perspective22 Aug 2024
- 2024Representation Magnitude has a Liability to Privacy Vulnerability23 Jul 2024
- 2024Bayes' capacity as a measure for reconstruction attacks in federated learning19 Jun 2024
- 2024R-CONV: An Analytical Approach for Efficient Data Reconstruction via Convolutional Gradients6 Jun 2024
- 2024GI-NAS: Boosting Gradient Inversion Attacks Through Adaptive Neural Architecture Search31 May 2024
- 2024DAGER: Exact Gradient Inversion for Large Language Models24 May 2024
- 2024Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomy16 May 2024
- 2024GI-SMN: Gradient Inversion Attack against Federated Learning without Prior Knowledge6 May 2024
- 2024On the Efficiency of Privacy Attacks in Federated Learning15 Apr 2024
- 2024Adaptive Hybrid Masking Strategy for Privacy-Preserving Face Recognition Against Model Inversion Attack14 Mar 2024
- 2024AFGI: Towards Accurate and Fast-convergent Gradient Inversion Attack in Federated Learning13 Mar 2024
- 2024MGIC: A Multi-Label Gradient Inversion Attack based on Canny Edge Detection on Federated Learning13 Mar 2024
- 2024SPEAR:Exact Gradient Inversion of Batches in Federated Learning6 Mar 2024
- 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attacks4 Mar 2024
- 2024Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks5 Feb 2024
- 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governance2 Feb 2024
- 2024Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attacks30 Jan 2024
- 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Them22 Jan 2024
- 2023Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspective19 Dec 2023
- 2023Beyond Gradient and Priors in Privacy Attacks: Leveraging Pooler Layer Inputs of Language Models in Federated Learning10 Dec 2023
- 2023Privacy-preserving quantum federated learning via gradient hiding7 Dec 2023
- 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction10 Nov 2023
- 2023Maximum Knowledge Orthogonality Reconstruction with Gradients in Federated Learning30 Oct 2023
- 2023Privacy Assessment on Reconstructed Images: Are Existing Evaluation Metrics Faithful to Human Perception?22 Sep 2023
- 2023Understanding Deep Gradient Leakage via Inversion Influence Functions22 Sep 2023
- 2023Expressive variational quantum circuits provide inherent privacy in federated learning22 Sep 2023
50 newest of 95 All 95 (JSON)
- 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attackscited by 13
- 2025Model Inversion Attack against Federated Unlearningcited by 2
- 2024Data Poisoning and Leakage Analysis in Federated Learningcited by 0
- 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systemscited by 0
- 2026TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglementcited by 0
- 2026TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement30 Jul 2026
- 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems2 Jun 2025
- 2025Model Inversion Attack against Federated Unlearning20 Feb 2025
- 2024Data Poisoning and Leakage Analysis in Federated Learning19 Sep 2024
- 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attacks4 Mar 2024
- 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
- 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
- 2021Gradient Inversion with Generative Image Priorcited by 101
- 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 88
- 2021CAFE: Catastrophic Data Leakage in Vertical Federated Learningcited by 76
- 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 72
- 2022Recovering Private Text in Federated Learning of Language Modelscited by 67
- 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
- 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 52
- 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
- 2023Recent Advances on Federated Learning: A Systematic Surveycited by 40
- 2022A Survey on Gradient Inversion: Attacks, Defenses and Future Directionscited by 39
12 most cited of 90 All 90 (JSON)
- 2026Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning29 Sep 2026
- 2026Predictability as a Fine-Grained Measure for Privacy18 Jun 2026
- 2026TIGER: Inverting Transformer Gradients via Embedding-Subspace Distance Optimization16 Jun 2026
- 2026No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning16 Apr 2026
- 2026FedSpy-LLM: Towards Scalable and Generalizable Data Reconstruction Attacks from Gradients on LLMs7 Apr 2026
- 2026Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization1 Apr 2026
- 2025Privacy in Federated Learning with Spiking Neural Networks26 Nov 2025
- 2025GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Models20 Oct 2025
- 2025Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning11 Sep 2025
- 2025AdaDPIGU: Differentially Private SGD with Adaptive Clipping and Importance-Based Gradient Updates for Deep Neural Networks9 Jul 2025
- 2025Label Leakage in Federated Inertial-based Human Activity Recognition27 May 2025
- 2025Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakage26 May 2025
12 newest of 90 All 90 (JSON)