Data to 7 Oct 2026

Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Models

arXiv 2110.13057 ↗First posted 25 Oct 2021cs.LG cs.CRcited by 106

Not on the map. Why?

Abstract (arXiv)

Federated learning has quickly gained popularity with its promises of increased user privacy and efficiency. Previous works have shown that federated gradient updates contain information that can be used to approximately recover user data in some situations. These previous attacks on user privacy have been limited in scope and do not scale to gradient updates aggregated over even a handful of data points, leaving some to conclude that data privacy is still intact for realistic training regimes. In this work, we introduce a new threat model based on minimal but malicious modifications of the shared model architecture which enable the server to directly obtain a verbatim copy of user data from gradient updates without solving difficult inverse problems. Even user data aggregated over large batches -- where previous methods fail to extract meaningful content -- can be reconstructed by these minimally modified models.

Key facts. Cited by 106 papers in the map (data through 7 Oct 2026). Builds on 23 of its 43 references that are in the map. First posted on arXiv 25 Oct 2021.

Builds on

23 of 43 references.

References · 23

2017Attention Is All You Needcited by 59,932
2015Deep Residual Learning for Image Recognitioncited by 51,809
2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
2016Wide Residual Networkscited by 3,057
2019Advances and Open Problems in Federated Learningcited by 3,021
2016Pointer Sentinel Mixture Modelscited by 2,992
2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
2019Deep Leakage from Gradientscited by 1,004
2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509

11 more

2020iDLG: Improved Deep Leakage from Gradientscited by 367
2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
2021A Field Guide to Federated Optimizationcited by 312
2021SAINT: Improved Neural Networks for Tabular Data via Row Attention and Contrastive Pre-Trainingcited by 310
2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
2015Federated Optimization:Distributed Optimization Beyond the Datacentercited by 193
2020R-GAP: Recursive Gradient Attack on Privacycited by 95
2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
2018Algorithms that Remember: Model Inversion Attacks and Data Protection Lawcited by 52
2020Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attackscited by 32
2019Truth or Backpropaganda? An Empirical Investigation of Deep Learning Theorycited by 21

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 19; 2023: 25; 2024: 31; 2025: 15; 2026: 14.

106 papers.

Sort:

By area:

2023Heterogeneous Federated Learning: State-of-the-art and Research Challengescited by 160
2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
2022Decepticons: Corrupted Transformers Breach Privacy in Federated Learning for Language Modelscited by 52
2024Byzantine-Robust Decentralized Federated Learningcited by 47
2022Gradient Obfuscation Gives a False Sense of Security in Federated Learningcited by 37
2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 35
2022Learning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learningcited by 30
2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 28
2022Data Leakage in Federated Averagingcited by 26
2023Privacy and Fairness in Federated Learning: on the Perspective of Trade-offcited by 26

38 more

2022CANIFE: Crafting Canaries for Empirical Privacy Measurement in Federated Learningcited by 24
2022On the (In)security of Peer-to-Peer Decentralized Machine Learningcited by 23
2022Accelerated Federated Learning with Decoupled Adaptive Optimizationcited by 23
2022DYNAFED: Tackling Client Data Heterogeneity with Global Dynamicscited by 22
2022AdaBest: Minimizing Client Drift in Federated Learning via Adaptive Bias Estimationcited by 21
2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 20
2023FedSecurity: Benchmarking Attacks and Defenses in Federated Learning and Federated LLMscited by 19
2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 18
2023Private, fair and accurate: Training large-scale, privacy-preserving AI models in medical imagingcited by 17
2023Active Membership Inference Attack under Local Differential Privacy in Federated Learningcited by 17
2023Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregationcited by 16
2024SPEAR:Exact Gradient Inversion of Batches in Federated Learningcited by 14
2022Preserving Privacy and Security in Federated Learningcited by 13
2022TabLeak: Tabular Data Leakage in Federated Learningcited by 13
2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attackscited by 13
2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
2024DAGER: Exact Gradient Inversion for Large Language Modelscited by 12
2022Concealing Sensitive Samples against Gradient Leakage in Federated Learningcited by 11
2022Secure Federated Clusteringcited by 10
2023Client-specific Property Inference against Secure Aggregation in Federated Learningcited by 9
2023The Resource Problem of Using Linear Layer Leakage Attack in Federated Learningcited by 9
2023Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learningcited by 9
2023Gradient-Free Privacy Leakage in Federated Language Models through Selective Weight Tamperingcited by 9
2024Analysis of Privacy Leakage in Federated Large Language Modelscited by 9
2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
2022ScionFL: Efficient and Robust Secure Quantized Aggregationcited by 8
2023Manipulating Transfer Learning for Property Inferencecited by 7
2024Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attackscited by 7
2022Decoupled Federated Learning for ASR with Non-IID Datacited by 6
2023Samplable Anonymous Aggregation for Private Federated Data Analysiscited by 6
2023Understanding Deep Gradient Leakage via Inversion Influence Functionscited by 6
2023Beyond Gradient and Priors in Privacy Attacks: Leveraging Pooler Layer Inputs of Language Models in Federated Learningcited by 6
2024Clients Collaborate: Flexible Differentially Private Federated Learning with Guaranteed Improvement of Utility-Privacy Trade-offcited by 6
2023Private Federated Learning with Autotuned Compressioncited by 5
2024Data Reconstruction Attacks and Defenses: A Systematic Evaluationcited by 5
2024Secure Aggregation is Not Private Against Membership Inference Attackscited by 5
2024Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learningcited by 5
2025CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Samplingcited by 5

50 most cited of 106 All 106 (JSON)