# User-Level Label Leakage from Gradients in Federated Learning

arXiv: https://arxiv.org/abs/2105.09369 · HTML: https://mlsanity.com/paper/2105.09369/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 42 references that are in the map.
- First posted on arXiv 19 May 2021.

## Builds on (most cited first, 20 of 20)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [Inverting Gradients -- How easy is it to break privacy in federated learning?](https://mlsanity.com/paper/2003.14053/) (2020)
- [Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Training](https://mlsanity.com/paper/1712.01887/) (2017)
- [Differentially Private Federated Learning: A Client Level Perspective](https://mlsanity.com/paper/1712.07557/) (2017)
- [iDLG: Improved Deep Leakage from Gradients](https://mlsanity.com/paper/2001.02610/) (2020)
- [A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection](https://mlsanity.com/paper/1907.09693/) (2019)
- [Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning](https://mlsanity.com/paper/1812.00535/) (2018)
- [Practical Secure Aggregation for Federated Learning on User-Held Data](https://mlsanity.com/paper/1611.04482/) (2016)
- [Feature Inference Attack on Model Predictions in Vertical Federated Learning](https://mlsanity.com/paper/2010.10152/) (2020)
- [R-GAP: Recursive Gradient Attack on Privacy](https://mlsanity.com/paper/2010.07733/) (2020)
- [Label Leakage and Protection in Two-party Split Learning](https://mlsanity.com/paper/2102.08504/) (2021)
- [Variance-based Gradient Compression for Efficient Distributed Deep Learning](https://mlsanity.com/paper/1802.06058/) (2018)
- [Layer-wise Characterization of Latent Information Leakage in Federated Learning](https://mlsanity.com/paper/2010.08762/) (2020)
- [Fidel: Reconstructing Private Training Samples from Weight Updates in Federated Learning](https://mlsanity.com/paper/2101.00159/) (2021)
- [Privacy-preserving Weighted Federated Learning within Oracle-Aided MPC Framework](https://mlsanity.com/paper/2003.07630/) (2020)

## Built on by (most cited first, 21 of 21)

- [FedLPA: One-shot Federated Learning with Layer-Wise Posterior Aggregation](https://mlsanity.com/paper/2310.00339/) (2023)
- [Privacy-Aware Document Visual Question Answering](https://mlsanity.com/paper/2312.10108/) (2023)
- [Similarity-based Label Inference Attack against Training and Inference of Split Learning](https://mlsanity.com/paper/2203.05222/) (2022)
- [Client-specific Property Inference against Secure Aggregation in Federated Learning](https://mlsanity.com/paper/2303.03908/) (2023)
- [Eliminating Label Leakage in Tree-Based Vertical Federated Learning](https://mlsanity.com/paper/2307.10318/) (2023)
- [Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learning](https://mlsanity.com/paper/2406.15731/) (2024)
- [FedLAP-DP: Federated Learning by Sharing Differentially Private Loss Approximations](https://mlsanity.com/paper/2302.01068/) (2023)
- [Recovering Labels from Local Updates in Federated Learning](https://mlsanity.com/paper/2405.00955/) (2024)
- [OLIVE: Oblivious Federated Learning on Trusted Execution Environment against the risk of sparsification](https://mlsanity.com/paper/2202.07165/) (2022)
- [Maximum Knowledge Orthogonality Reconstruction with Gradients in Federated Learning](https://mlsanity.com/paper/2310.19222/) (2023)
- [NeurIPS 2023 Competition: Privacy Preserving Federated Learning Document VQA](https://mlsanity.com/paper/2411.03730/) (2024)
- [Feature-based Federated Transfer Learning: Communication Efficiency, Robustness and Privacy](https://mlsanity.com/paper/2405.09014/) (2024)
- [GAN-based Vertical Federated Learning for Label Protection in Binary Classification](https://mlsanity.com/paper/2302.02245/) (2023)
- [Privacy Attack in Federated Learning is Not Easy: An Experimental Study](https://mlsanity.com/paper/2409.19301/) (2024)
- [FRIDA: Free-Rider Detection using Privacy Attacks](https://mlsanity.com/paper/2410.05020/) (2024)
- [GDBR: Label Recovery Attack Against Partial Gradient Encryption in Federated Learning](https://mlsanity.com/paper/2412.12640/) (2024)
- [Unveiling Client Privacy Leakage from Public Dataset Usage in Federated Distillation](https://mlsanity.com/paper/2502.08001/) (2025)
- [Label Leakage in Federated Inertial-based Human Activity Recognition](https://mlsanity.com/paper/2505.20924/) (2025)
- [Differentially private federated learning for localized control of infectious disease dynamics](https://mlsanity.com/paper/2509.14024/) (2025)
- [Information Hidden in Gradients of Regression with Target Noise](https://mlsanity.com/paper/2601.18546/) (2026)
- [Revisiting Label Inference Attacks in Vertical Federated Learning: Why They Are Vulnerable and How to Defend](https://mlsanity.com/paper/2603.18680/) (2026)

## Abstract (arXiv)

Federated learning enables multiple users to build a joint model by sharing their model updates (gradients), while their raw data remains local on their devices. In contrast to the common belief that this provides privacy benefits, we here add to the very recent results on privacy risks when sharing gradients. Specifically, we investigate Label Leakage from Gradients (LLG), a novel attack to extract the labels of the users' training data from their shared gradients. The attack exploits the direction and magnitude of gradients to determine the presence or absence of any label. LLG is simple yet effective, capable of leaking potential sensitive information represented by labels, and scales well to arbitrary batch sizes and multiple classes. We mathematically and empirically demonstrate the validity of the attack under different settings. Moreover, empirical results show that LLG successfully extracts labels with high accuracy at the early stages of model training. We also discuss different defense mechanisms against such leakage. Our findings suggest that gradient compression is a practical technique to mitigate the attack.