# Information Stealing in Federated Learning Systems Based on Generative Adversarial Networks

arXiv: https://arxiv.org/abs/2108.00701 · HTML: https://mlsanity.com/paper/2108.00701/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 15 references that are in the map.
- First posted on arXiv 2 Aug 2021.

## Builds on (most cited first, 5 of 5)

- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning](https://mlsanity.com/paper/1702.07464/) (2017)
- [Adversarial Attacks and Defenses in Images, Graphs and Text: A Review](https://mlsanity.com/paper/1909.08072/) (2019)
- [NoPeek: Information leakage reduction to share activations in distributed deep learning](https://mlsanity.com/paper/2008.09161/) (2020)
- [NAttack! Adversarial Attacks to bypass a GAN based classifier trained to detect Network intrusion](https://mlsanity.com/paper/2002.08527/) (2020)

## Built on by (most cited first, 3 of 3)

- [A Systematic Review of Federated Generative Models](https://mlsanity.com/paper/2405.16682/) (2024)
- [Resilience of Wireless Ad Hoc Federated Learning against Model Poisoning Attacks](https://mlsanity.com/paper/2211.03489/) (2022)
- [Secure and Privacy-Preserving Federated Learning for Next-Generation Underground Mine Safety](https://mlsanity.com/paper/2512.08862/) (2025)

## Abstract (arXiv)

An attack on deep learning systems where intelligent machines collaborate to solve problems could cause a node in the network to make a mistake on a critical judgment. At the same time, the security and privacy concerns of AI have galvanized the attention of experts from multiple disciplines. In this research, we successfully mounted adversarial attacks on a federated learning (FL) environment using three different datasets. The attacks leveraged generative adversarial networks (GANs) to affect the learning process and strive to reconstruct the private data of users by learning hidden features from shared local model parameters. The attack was target-oriented drawing data with distinct class distribution from the CIFAR- 10, MNIST, and Fashion-MNIST respectively. Moreover, by measuring the Euclidean distance between the real data and the reconstructed adversarial samples, we evaluated the performance of the adversary in the learning processes in various scenarios. At last, we successfully reconstructed the real data of the victim from the shared global model parameters with all the applied datasets.