mlsanityData to 7 Oct 2026

GradViT: Gradient Inversion of Vision Transformers

arXiv 2203.11894 ↗First posted 22 Mar 2022cs.CV cs.AI cs.CRcited by 52

Not on the map. Why?

Abstract (arXiv)

In this work we demonstrate the vulnerability of vision transformers (ViTs) to gradient-based inversion attacks. During this attack, the original data batch is reconstructed given model weights and the corresponding gradients. We introduce a method, named GradViT, that optimizes random noise into naturally looking images via an iterative process. The optimization objective consists of (i) a loss on matching the gradients, (ii) image prior in the form of distance to batch-normalization statistics of a pretrained CNN model, and (iii) a total variation regularization on patches to guide correct recovery locations. We propose a unique loss scheduling function to overcome local minima during optimization. We evaluate GadViT on ImageNet1K and MS-Celeb-1M datasets, and observe unprecedentedly high fidelity and closeness to the original (hidden) data. During the analysis we find that vision transformers are significantly more vulnerable than previously studied CNNs due to the presence of the attention mechanism. Our method demonstrates new state-of-the-art results for gradient inversion in both qualitative and quantitative metrics. Project page at https://gradvit.github.io/.

Key facts. Cited by 52 papers in the map (data through 7 Oct 2026). Builds on 37 of its 43 references that are in the map. First posted on arXiv 22 Mar 2022.

Builds on

37 of 43 references.

References · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  4. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  5. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  6. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  7. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  8. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  9. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
  10. 2017Improved Training of Wasserstein GANscited by 2,223
  11. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  12. 2018Spectral Normalization for Generative Adversarial Networkscited by 1,618
25 more
  1. 2021Per-Pixel Classification is Not All You Need for Semantic Segmentationcited by 1,148
  2. 2019Deep Leakage from Gradientscited by 1,004
  3. 2021Scaling Vision Transformerscited by 993
  4. 2018Self-Attention Generative Adversarial Networkscited by 809
  5. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  6. 2021Do Vision Transformers See Like Convolutional Neural Networks?cited by 671
  7. 2016MS-Celeb-1M: A Dataset and Benchmark for Large-Scale Face Recognitioncited by 621
  8. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  9. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 419
  10. 2014Understanding Deep Image Representations by Inverting Themcited by 399
  11. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  12. 2020ZeroQ: A Novel Zero Shot Quantization Frameworkcited by 265
  13. 2021ReStyle: A Residual-Based StyleGAN Encoder via Iterative Refinementcited by 248
  14. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
  15. 2019Data-Free Learning of Student Networkscited by 203
  16. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  17. 2016Synthesizing the preferred inputs for neurons in neural networks via deep generator networkscited by 181
  18. 2021Source-Free Domain Adaptation for Semantic Segmentationcited by 168
  19. 2021Gradient Inversion with Generative Image Priorcited by 101
  20. 2015Visualizing Deep Convolutional Neural Networks Using Natural Pre-Imagescited by 93
  21. 2021Domain Impression: A Source Data Free Domain Adaptation Methodcited by 91
  22. 2021CAFE: Catastrophic Data Leakage in Vertical Federated Learningcited by 76
  23. 2020RANSAC-Flow: generic two-stage image alignmentcited by 48
  24. 2021Face Transformer for Recognitioncited by 45
  25. 2020Large-Scale Generative Data-Free Distillationcited by 29

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 8; 2023: 15; 2024: 14; 2025: 7; 2026: 8.

52 papers.

Sort:

By area:

  1. 2023GIFD: A Generative Gradient Inversion Method with Feature Domain Optimizationcited by 45
  2. 2023FedML-HE: An Efficient Homomorphic-Encryption-Based Privacy-Preserving Federated Learning Systemcited by 38
  3. 2022Masked Jigsaw Puzzle: A Versatile Position Embedding for Vision Transformerscited by 33
  4. 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
  5. 2022Reconstructing Training Data from Model Gradient, Provablycited by 27
  6. 2023Privacy and Fairness in Federated Learning: on the Perspective of Trade-offcited by 26
  7. 2022DYNAFED: Tackling Client Data Heterogeneity with Global Dynamicscited by 22
  8. 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 18
  9. 2024A Comprehensive Survey of Convolutions in Deep Learning: Applications, Challenges, and Future Trendscited by 16
  10. 2024Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challengescited by 14
  11. 2024The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscapecited by 13
  12. 2022Dropout is NOT All You Need to Prevent Gradient Leakagecited by 11
38 more
  1. 2022Exploring Parameter-Efficient Fine-Tuning to Enable Foundation Models in Federated Learningcited by 11
  2. 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
  3. 2022How Does a Deep Learning Model Architecture Impact Its Privacy? A Comprehensive Study of Privacy Attacks on CNNs and Transformerscited by 8
  4. 2023NUPES : Non-Uniform Post-Training Quantization via Power Exponent Searchcited by 7
  5. 2023Understanding Deep Gradient Leakage via Inversion Influence Functionscited by 6
  6. 2024The Effect of Quantization in Federated Learning: A R'enyi Differential Privacy Perspectivecited by 6
  7. 2025CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Samplingcited by 5
  8. 2023Privacy Risks in Reinforcement Learning for Household Robotscited by 4
  9. 2023Federated Model Aggregation via Self-Supervised Priors for Highly Imbalanced Medical Image Classificationcited by 4
  10. 2023APPFLx: Providing Privacy-Preserving Cross-Silo Federated Learning as a Servicecited by 4
  11. 2023Maximum Knowledge Orthogonality Reconstruction with Gradients in Federated Learningcited by 4
  12. 2023Task-Distributionally Robust Data-Free Meta-Learningcited by 4
  13. 2024Towards Eliminating Hard Label Constraints in Gradient Inversion Attackscited by 4
  14. 2024Attacking Transformers with Feature Diversity Adversarial Perturbationcited by 3
  15. 2024Geminio: Language-Guided Gradient Inversion Attacks in Federated Learningcited by 3
  16. 2025Gradient Inversion Attacks on Parameter-Efficient Fine-Tuningcited by 3
  17. 2022Combining Stochastic Defenses to Resist Gradient Inversion: An Ablation Studycited by 2
  18. 2023Leaping Into Memories: Space-Time Deep Feature Synthesiscited by 2
  19. 2023Binary Federated Learning with Client-Level Differential Privacycited by 2
  20. 2023Privacy Preserving Federated Learning with Convolutional Variational Bottleneckscited by 2
  21. 2024GI-SMN: Gradient Inversion Attack against Federated Learning without Prior Knowledgecited by 2
  22. 2024Inference Attacks: A Taxonomy, Survey, and Promising Directionscited by 2
  23. 2026Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimizationcited by 2
  24. 2023Human-imperceptible, Machine-recognizable Imagescited by 1
  25. 2024TED: Accelerate Model Training by Internal Generalizationcited by 1
  26. 2024Federated Low-Rank Adaptation with Differential Privacy over Wireless Networkscited by 1
  27. 2024Intermediate Outputs Are More Sensitive Than You Thinkcited by 1
  28. 2025MIMIC: Multimodal Inversion for Model Interpretation and Conceptualizationcited by 1
  29. 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learningcited by 1
  30. 2024SEVEN: Pruning Transformer Model by Reserving Sentinelscited by 0
  31. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  32. 2025ImprovDML: Improved Trade-off in Private Byzantine-Resilient Distributed Machine Learningcited by 0
  33. 2025TRANSPORTER: Transferring Visual Semantics from VLM Manifoldscited by 0
  34. 2026A Unified Masked Jigsaw Puzzle Framework for Vision and Language Modelscited by 0
  35. 2026Position: Life-Logging Video Streams Make the Privacy-Utility Trade-off Inevitablecited by 0
  36. 2026On Privacy-Preserving Image Transmission in Low-Altitude Networks: A Swin Transformer-Based Framework with Federated Learningcited by 0
  37. 2026TIGER: Inverting Transformer Gradients via Embedding-Subspace Distance Optimizationcited by 0
  38. 2026MineGrad: Gradient Inversion Attacks on LoRA Fine-Tuningcited by 0

50 most cited of 52 All 52 (JSON)