Evaluating Gradient Inversion Attacks and Defenses in Federated Learning
Not on the map. Why?
Abstract (arXiv)
Gradient inversion attack (or input recovery from gradient) is an emerging threat to the security and privacy preservation of Federated learning, whereby malicious eavesdroppers or participants in the protocol can recover (partially) the clients' private data. This paper evaluates existing attacks and defenses. We find that some attacks make strong assumptions about the setup. Relaxing such assumptions can substantially weaken these attacks. We then evaluate the benefits of three proposed defense mechanisms against gradient inversion attacks. We show the trade-offs of privacy leakage and data utility of these defense methods, and find that combining them in an appropriate manner makes the attack less effective, even under the original strong assumptions. We also estimate the computation cost of end-to-end recovery of a single image under each evaluated defense. Our findings suggest that the state-of-the-art attacks can currently be defended against with minor data utility loss, as summarized in a list of potential strategies. Our code is available at: https://github.com/Princeton-SysML/GradAttack.
Key facts. Cited by 196 papers in the map (data through 14 Oct 2026). Builds on 25 of its 37 references that are in the map. First posted on arXiv 30 Nov 2021.
Builds on
25 of 37 references.
References · 25
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Adam: A Method for Stochastic Optimizationcited by 37,240
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 7,005
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
- 2019Advances and Open Problems in Federated Learningcited by 3,046
- 2016Deep Learning with Differential Privacycited by 2,728
- 2019Deep Leakage from Gradientscited by 1,021
- 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
- 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 571
- 2020iDLG: Improved Deep Leakage from Gradientscited by 382
13 more
- 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
- 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 235
- 2019Fixup Initialization: Residual Learning Without Normalizationcited by 198
- 2016Practical Secure Aggregation for Federated Learning on User-Held Datacited by 178
- 2018Solving Linear Programs in the Current Matrix Multiplication Timecited by 100
- 2020R-GAP: Recursive Gradient Attack on Privacycited by 97
- 2020InstaHide: Instance-hiding Schemes for Private Distributed Learningcited by 90
- 2020A Framework for Evaluating Gradient Leakage Attacks in Federated Learningcited by 64
- 2020Siloed Federated Learning for Multi-Centric Histopathology Datasetscited by 61
- 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
- 2019Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracycited by 49
- 2020Is Private Learning Possible with Instance Encoding?cited by 22
- 2020On InstaHide, Phase Retrieval, and Sparse Matrix Factorizationcited by 4
Built on by
Citing papers per year: 2022: 33; 2023: 53; 2024: 44; 2025: 49; 2026: 17.
196 papers.
Sort:
By area:
- 2022Transformers in Medical Imaging: A Surveycited by 245
- 2022Reconstructing Training Data from Trained Neural Networkscited by 133
- 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retrainingcited by 118
- 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 73
- 2022Recovering Private Text in Federated Learning of Language Modelscited by 70
- 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 54
- 2022GradViT: Gradient Inversion of Vision Transformerscited by 53
- 2023Bounding Training Data Reconstruction in DP-SGDcited by 46
- 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
- 2023Recent Advances on Federated Learning: A Systematic Surveycited by 41
- 2022Gradient Obfuscation Gives a False Sense of Security in Federated Learningcited by 39
- 2022Submodularity In Machine Learning and Artificial Intelligencecited by 38
38 more
- 2022Joint Privacy Enhancement and Quantization in Federated Learningcited by 35
- 2023An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learningcited by 32
- 2022Bilateral Dependency Optimization: Defending Against Model-inversion Attackscited by 30
- 2023Why Batch Normalization Damage Federated Learning on Non-IID Data?cited by 29
- 2022Reconstructing Training Data from Model Gradient, Provablycited by 27
- 2022Data Leakage in Federated Averagingcited by 26
- 2023Privacy and Fairness in Federated Learning: on the Perspective of Trade-offcited by 26
- 2023Deconstructing Data Reconstruction: Multiclass, Weight Decay and General Lossescited by 26
- 2023Selective Knowledge Sharing for Privacy-Preserving Federated Distillation without A Good Teachercited by 25
- 2023GPT-FL: Generative Pre-trained Model-Assisted Federated Learningcited by 24
- 2022DYNAFED: Tackling Client Data Heterogeneity with Global Dynamicscited by 22
- 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 21
- 2024Overcoming Data and Model Heterogeneities in Decentralized Federated Learning via Synthetic Anchorscited by 21
- 2022Subject Membership Inference Attacks in Federated Learningcited by 20
- 2022Feature Distribution Matching for Federated Domain Generalizationcited by 18
- 2023z-SignFedAvg: A Unified Stochastic Sign-based Compression for Federated Learningcited by 17
- 2023Fed-GraB: Federated Long-tailed Learning with Self-Adjusting Gradient Balancercited by 17
- 2023FedHCA2: Towards Hetero-Client Federated Multi-Task Learningcited by 17
- 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
- 2023Unlocking Accuracy and Fairness in Differentially Private Image Classificationcited by 16
- 2023FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attackscited by 15
- 2023Privacy-preserving quantum federated learning via gradient hidingcited by 15
- 2023Securing Distributed SGD against Gradient Leakage Threatscited by 14
- 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 14
- 2024GI-NAS: Boosting Gradient Inversion Attacks Through Adaptive Neural Architecture Searchcited by 14
- 2022TabLeak: Tabular Data Leakage in Federated Learningcited by 13
- 2023Privacy Assessment on Reconstructed Images: Are Existing Evaluation Metrics Faithful to Human Perception?cited by 13
- 2024Federated Learning Priorities Under the European Union Artificial Intelligence Actcited by 13
- 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
- 2023BAFFLE: A Baseline of Backpropagation-Free Federated Learningcited by 12
- 2023On the Efficacy of Differentially Private Few-shot Image Classificationcited by 12
- 2023Unmasking Transformers: A Theoretical Approach to Data Recovery via Attention Weightscited by 12
- 2024Reconstructing Training Data From Real World Models Trained with Transfer Learningcited by 12
- 2022Dropout is NOT All You Need to Prevent Gradient Leakagecited by 11
- 2022Concealing Sensitive Samples against Gradient Leakage in Federated Learningcited by 11
- 2022Exploring Parameter-Efficient Fine-Tuning to Enable Foundation Models in Federated Learningcited by 11
- 2023Surrogate Model Extension (SME): A Fast and Accurate Weight Update Attack on Federated Learningcited by 11
- 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
50 most cited of 196 All 196 (JSON)
- 2026Temporal Gradient Inversion for Private Trajectory Reconstruction in Embodied Reinforcement Learning24 Sep 2026
- 2026Privacy Preserving Gossip Learning13 Sep 2026
- 2026A Differentially Private Federated Proximal Optimization Framework for Customer Churn Prediction in Heterogeneous Federated Telecom Networks11 Sep 2026
- 2026MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning2 Aug 2026
- 2026TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement30 Jul 2026
- 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features do14 Jul 2026
- 2026Giskard : Byzantine Robust and Confidential Aggregation for Large-Scale Decentralized Learning17 Jun 2026
- 2026Beyond Weights and Gradients: A Taxonomy of Federated Learning Messages15 Jun 2026
- 2026Jellyfish: Zero-Shot Federated Unlearning Scheme with Knowledge Disentanglement5 Apr 2026
- 2026Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization1 Apr 2026
- 2026SOMP: Scalable Gradient Inversion for Large Language Models via Subspace-Guided Orthogonal Matching Pursuit17 Mar 2026
- 2026DeFRiS: Silo-Cooperative IoT Applications Scheduling via Decentralized Federated Reinforcement Learning16 Mar 2026
38 more
- 2026TIP: Resisting Gradient Inversion via Targeted Interpretable Perturbation in Federated Learning12 Feb 2026
- 2026ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation9 Feb 2026
- 2026UnlearnShield: Shielding Forgotten Privacy against Unlearning Inversion28 Jan 2026
- 2026Communication-Efficient and Privacy-Adaptable Mechanism -- a Federated Learning Scheme with Convergence Analysis15 Jan 2026
- 2026FedHypeVAE: Federated Learning with Hypernetwork Generated Conditional VAEs for Differentially Private Embedding Sharing2 Jan 2026
- 2025Secure and Explainable Fraud Detection in Finance via Hierarchical Multi-source Dataset Distillation26 Dec 2025
- 2025FedMPDD: Communication-Efficient Federated Learning with Privacy Preservation Attributes via Projected Directional Derivative23 Dec 2025
- 2025From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learning17 Dec 2025
- 2025Gradient Inversion in Federated Reinforcement Learning29 Nov 2025
- 2025FedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization24 Nov 2025
- 2025Trustworthy Quantum Machine Learning: A Roadmap for Reliability, Robustness, and Security in the NISQ Era4 Nov 2025
- 2025Differential Privacy: Gradient Leakage Attacks in Federated Learning Environments27 Oct 2025
- 2025DictPFL: Efficient and Private Federated Learning on Encrypted Gradients24 Oct 2025
- 2025ConvXformer: Differentially Private Hybrid ConvNeXt-Transformer for Inertial Navigation22 Oct 2025
- 2025CLIP: Client-Side Invariant Pruning for Mitigating Stragglers in Secure Federated Learning19 Oct 2025
- 2025Trajectory-Aware Information Matching for Multi-Step Gradient Inversion in Federated Learning26 Sep 2025
- 2025No Prior, No Leakage: Revisiting Reconstruction Attacks in Trained Neural Networks25 Sep 2025
- 2025MARS: A Malignity-Aware Backdoor Defense in Federated Learning21 Sep 2025
- 2025MAGIA: Sensing Per-Image Signals from Single-Round Averaged Gradients for Label-Inference-Free Gradient Inversion17 Sep 2025
- 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems12 Sep 2025
- 2025Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning11 Sep 2025
- 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learning27 Aug 2025
- 2025Adversarial Robustness in Distributed Quantum Machine Learning16 Aug 2025
- 2025SelectiveShield: Lightweight Hybrid Defense Against Gradient Leakage in Federated Learning6 Aug 2025
- 2025Evaluating Selective Encryption Against Gradient Inversion Attacks6 Aug 2025
- 2025Uncovering Gradient Inversion Risks in Practical Language Model Training28 Jul 2025
- 2025A Privacy-Preserving Federated Framework with Hybrid Quantum-Enhanced Learning for Financial Fraud Detection15 Jul 2025
- 2025Breaking Physical and Linguistic Borders: Multilingual Federated Prompt Tuning for Low-Resource Languages2 Jul 2025
- 2025Privacy-Preserving Quantized Federated Learning with Diverse Precision1 Jul 2025
- 2025Hear No Evil: Detecting Gradient Leakage by Malicious Servers in Federated Learning25 Jun 2025
- 2025Client Clustering Meets Knowledge Sharing: Enhancing Privacy and Robustness in Personalized Peer-to-Peer Learning25 Jun 2025
- 2025PASS: Private Attributes Protection with Stochastic Data Substitution8 Jun 2025
- 2025Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning4 Jun 2025
- 2025PC-MoE: Memory-Efficient and Privacy-Preserving Collaborative Training for Mixture-of-Experts LLMs3 Jun 2025
- 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems2 Jun 2025
- 2025Shadow defense against gradient inversion attack in federated learning30 May 2025
- 2025Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakage26 May 2025
- 2025ICAFS: Inter-Client-Aware Feature Selection for Vertical Federated Learning15 Apr 2025
50 newest of 196 All 196 (JSON)
- 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retrainingcited by 118
- 2023Bounding Training Data Reconstruction in DP-SGDcited by 46
- 2022Subject Membership Inference Attacks in Federated Learningcited by 20
- 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
- 2024Update Selective Parameters: Federated Machine Unlearning Based on Model Explanationcited by 5
- 2024Provable Privacy Attacks on Trained Shallow Neural Networkscited by 4
- 2024Goldfish: An Efficient Federated Unlearning Frameworkcited by 3
- 2025Model Inversion Attack against Federated Unlearningcited by 2
- 2026Jellyfish: Zero-Shot Federated Unlearning Scheme with Knowledge Disentanglementcited by 1
- 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systemscited by 0
- 2026UnlearnShield: Shielding Forgotten Privacy against Unlearning Inversioncited by 0
- 2026TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglementcited by 0
- 2026TriShield: Zero-Utility-Loss Defense Against Privacy Backdoors in Federated Language Model Fine-Tuning via Orthogonal Gradient Projection and Optimizer State Entanglement30 Jul 2026
- 2026Jellyfish: Zero-Shot Federated Unlearning Scheme with Knowledge Disentanglement5 Apr 2026
- 2026UnlearnShield: Shielding Forgotten Privacy against Unlearning Inversion28 Jan 2026
- 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems2 Jun 2025
- 2025Model Inversion Attack against Federated Unlearning20 Feb 2025
- 2024Provable Privacy Attacks on Trained Shallow Neural Networks10 Oct 2024
- 2024Update Selective Parameters: Federated Machine Unlearning Based on Model Explanation18 Jun 2024
- 2024Goldfish: An Efficient Federated Unlearning Framework4 Apr 2024
- 2023Bounding Training Data Reconstruction in DP-SGD14 Feb 2023
- 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesis19 Oct 2022
- 2022Subject Membership Inference Attacks in Federated Learning7 Jun 2022
- 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retraining14 Mar 2022
- 2023Selective Knowledge Sharing for Privacy-Preserving Federated Distillation without A Good Teachercited by 25
- 2024Knowledge Distillation in Federated Learning: a Survey on Long Lasting Challenges and New Solutionscited by 9
- 2023Adaptive Self-Distillation for Minimizing Client Drift in Heterogeneous Federated Learningcited by 1
- 2023Federated Learning for Data and Model Heterogeneity in Medical Imagingcited by 1
- 2024Knowledge Distillation in Federated Learning: a Survey on Long Lasting Challenges and New Solutions16 Jun 2024
- 2023Federated Learning for Data and Model Heterogeneity in Medical Imaging31 Jul 2023
- 2023Adaptive Self-Distillation for Minimizing Client Drift in Heterogeneous Federated Learning31 May 2023
- 2023Selective Knowledge Sharing for Privacy-Preserving Federated Distillation without A Good Teacher4 Apr 2023
- 2026Temporal Gradient Inversion for Private Trajectory Reconstruction in Embodied Reinforcement Learning24 Sep 2026
- 2026DeFRiS: Silo-Cooperative IoT Applications Scheduling via Decentralized Federated Reinforcement Learning16 Mar 2026
- 2025Gradient Inversion in Federated Reinforcement Learning29 Nov 2025
- 2022Transformers in Medical Imaging: A Surveycited by 245
- 2022Reconstructing Training Data from Trained Neural Networkscited by 133
- 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 73
- 2022Recovering Private Text in Federated Learning of Language Modelscited by 70
- 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 54
- 2022GradViT: Gradient Inversion of Vision Transformerscited by 53
- 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
- 2023Recent Advances on Federated Learning: A Systematic Surveycited by 41
- 2022Gradient Obfuscation Gives a False Sense of Security in Federated Learningcited by 39
- 2022Submodularity In Machine Learning and Artificial Intelligencecited by 38
- 2022Joint Privacy Enhancement and Quantization in Federated Learningcited by 35
- 2023An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learningcited by 32
12 most cited of 172 All 172 (JSON)
- 2026Privacy Preserving Gossip Learning13 Sep 2026
- 2026A Differentially Private Federated Proximal Optimization Framework for Customer Churn Prediction in Heterogeneous Federated Telecom Networks11 Sep 2026
- 2026MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuning2 Aug 2026
- 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features do14 Jul 2026
- 2026Giskard : Byzantine Robust and Confidential Aggregation for Large-Scale Decentralized Learning17 Jun 2026
- 2026Beyond Weights and Gradients: A Taxonomy of Federated Learning Messages15 Jun 2026
- 2026Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization1 Apr 2026
- 2026SOMP: Scalable Gradient Inversion for Large Language Models via Subspace-Guided Orthogonal Matching Pursuit17 Mar 2026
- 2026TIP: Resisting Gradient Inversion via Targeted Interpretable Perturbation in Federated Learning12 Feb 2026
- 2026ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation9 Feb 2026
- 2026Communication-Efficient and Privacy-Adaptable Mechanism -- a Federated Learning Scheme with Convergence Analysis15 Jan 2026
- 2026FedHypeVAE: Federated Learning with Hypernetwork Generated Conditional VAEs for Differentially Private Embedding Sharing2 Jan 2026
12 newest of 172 All 172 (JSON)