mlsanityData to 14 Oct 2026

Do Gradient Inversion Attacks Make Federated Learning Unsafe?

arXiv 2202.06924 ↗First posted 14 Feb 2022cs.LG cs.CR cs.CVcited by 44

Not on the map. Why?

Abstract (arXiv)

Federated learning (FL) allows the collaborative training of AI models without needing to share raw data. This capability makes it especially interesting for healthcare applications where patient and data privacy is of utmost concern. However, recent works on the inversion of deep neural networks from model gradients raised concerns about the security of FL in preventing the leakage of training data. In this work, we show that these attacks presented in the literature are impractical in FL use-cases where the clients' training involves updating the Batch Normalization (BN) statistics and provide a new baseline attack that works for such scenarios. Furthermore, we present new ways to measure and visualize potential data leakage in FL. Our work is a step towards establishing reproducible methods of measuring data leakage in FL and could help determine the optimal tradeoffs between privacy-preserving techniques, such as differential privacy, and model accuracy based on quantifiable metrics. Code is available at https://nvidia.github.io/NVFlare/research/quantifying-data-leakage.

Key facts. Cited by 44 papers in the map (data through 14 Oct 2026). Builds on 33 of its 58 references that are in the map. First posted on arXiv 14 Feb 2022.

Builds on

33 of 58 references.

References · 33

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  3. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 7,005
  4. 2016Densely Connected Convolutional Networkscited by 6,720
  5. 2019Advances and Open Problems in Federated Learningcited by 3,046
  6. 2018Federated Optimization in Heterogeneous Networkscited by 2,987
  7. 2016Deep Learning with Differential Privacycited by 2,728
  8. 2020Adaptive Federated Optimizationcited by 1,046
  9. 2019Deep Leakage from Gradientscited by 1,021
  10. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  11. 2020The Future of Digital Health with Federated Learningcited by 633
  12. 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 571
21 more
  1. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 423
  2. 2019Federated Machine Learning: Concept and Applicationscited by 412
  3. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 334
  4. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
  5. 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
  6. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  7. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  8. 2020Can AI help in screening Viral and COVID-19 pneumonia?cited by 200
  9. 2020FetchSGD: Communication-Efficient Federated Learning with Sketchingcited by 179
  10. 2019Privacy-preserving Federated Brain Tumour Segmentationcited by 169
  11. 2018Multi-Institutional Deep Learning Modeling Without Sharing Patient Data: A Feasibility Study on Brain Tumor Segmentationcited by 149
  12. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  13. 2018A General Approach to Adding Differential Privacy to Iterative Training Procedurescited by 84
  14. 2020Local and Central Differential Privacy for Robustness and Privacy in Federated Learningcited by 78
  15. 2020Federated Learning for Breast Density Classification: A Real-World Implementationcited by 62
  16. 2020Siloed Federated Learning for Multi-Centric Histopathology Datasetscited by 61
  17. 2020Local Differential Privacy and Its Applications: A Comprehensive Surveycited by 41
  18. 2016Understanding the Sparse Vector Technique for Differential Privacycited by 27
  19. 2020Federated Learning and Differential Privacy: Software tools analysis, the Sherpa.ai FL framework and methodological guidelines for preserving data privacycited by 22
  20. 2019P3SGD: Patient Privacy Preserving SGD for Regularizing Deep CNNs in Pathological Image Classificationcited by 14
  21. 2020Differentially Private Federated Learning with Laplacian Smoothingcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 6; 2023: 8; 2024: 17; 2025: 10; 2026: 3.

44 papers.

Sort:

By area:

  1. 2022NVIDIA FLARE: Federated Learning from Simulation to Real-Worldcited by 80
  2. 2023Federated Learning for Medical Image Analysis: A Surveycited by 78
  3. 2022Structural Pruning via Latency-Saliency Knapsackcited by 41
  4. 2024Advances in APPFL: A Comprehensive and Extensible Federated Learning Frameworkcited by 19
  5. 2023Private, fair and accurate: Training large-scale, privacy-preserving AI models in medical imagingcited by 17
  6. 2024From Challenges and Pitfalls to Recommendations and Opportunities: Implementing Federated Learning in Healthcarecited by 16
  7. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
  8. 2023Gradient-Free Privacy Leakage in Federated Language Models through Selective Weight Tamperingcited by 9
  9. 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
  10. 2022Beyond Gradients: Exploiting Adversarial Priors in Model Inversion Attackscited by 7
  11. 2025Differential privacy for medical deep learning: methods, tradeoffs, and deployment implicationscited by 7
  12. 2023Personalized and privacy-preserving federated heterogeneous medical image analysis with PPPML-HMIcited by 6
32 more
  1. 2024CGI-DM: Digital Copyright Authentication for Diffusion Models via Contrasting Gradient Inversioncited by 6
  2. 2024Secure Aggregation is Not Private Against Membership Inference Attackscited by 6
  3. 2023Private Federated Learning with Autotuned Compressioncited by 5
  4. 2024A Systematic Review of Federated Generative Modelscited by 5
  5. 2024Federated brain tumor segmentation: an extensive benchmarkcited by 5
  6. 2025A Thorough Assessment of the Non-IID Data Impact in Federated Learningcited by 5
  7. 2022Class Impression for Data-free Incremental Learningcited by 4
  8. 2022Split-U-Net: Preventing Data Leakage in Split Learning for Collaborative Multi-Modal Brain Tumor Segmentationcited by 4
  9. 2024Differential privacy enables fair and accurate AI-based analysis of speech disorders while protecting patient datacited by 4
  10. 2023SRATTA : Sample Re-ATTribution Attack of Secure Aggregation in Federated Learningcited by 3
  11. 2024Federated and Transfer Learning for Cancer Detection Based on Image Analysiscited by 3
  12. 2024A Federated Learning Platform as a Service for Advancing Stroke Management in European Clinical Centerscited by 3
  13. 2024AFGI: Towards Accurate and Fast-convergent Gradient Inversion Attack in Federated Learningcited by 2
  14. 2024GI-SMN: Gradient Inversion Attack against Federated Learning without Prior Knowledgecited by 2
  15. 2024Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomycited by 2
  16. 2024CCSI: Continual Class-Specific Impression for Data-free Class Incremental Learningcited by 2
  17. 2025Shadow defense against gradient inversion attack in federated learningcited by 2
  18. 2025On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directionscited by 2
  19. 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learningcited by 2
  20. 2024MGIC: A Multi-Label Gradient Inversion Attack based on Canny Edge Detection on Federated Learningcited by 1
  21. 2025Differentially Private 2D Human Pose Estimationcited by 1
  22. 2025PC-MoE: Memory-Efficient and Privacy-Preserving Collaborative Training for Mixture-of-Experts LLMscited by 1
  23. 2025Load-Aware Training Scheduling for Model Circulation-based Decentralized Federated Learningcited by 1
  24. 2025SHeRL-FL: When Representation Learning Meets Split Learning in Hierarchical Federated Learningcited by 1
  25. 2022Secure & Private Federated Neuroimagingcited by 0
  26. 2023Single-round Self-supervised Distributed Learning using Vision Transformercited by 0
  27. 2023Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspectivecited by 0
  28. 2024Survey of Privacy Threats and Countermeasures in Federated Learningcited by 0
  29. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  30. 2026Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Riskscited by 0
  31. 2026When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learningcited by 0
  32. 2026Differentially Private EEG Feature Anonymization: A Privacy-Utility Case Study in Clinical Neurophysiologycited by 0