mlsanityData to 14 Oct 2026

Data Leakage in Federated Averaging

arXiv 2206.12395 ↗First posted 24 Jun 2022cs.LG cs.CR cs.DCcited by 26

Not on the map. Why?

Abstract (arXiv)

Recent attacks have shown that user data can be recovered from FedSGD updates, thus breaking privacy. However, these attacks are of limited practical relevance as federated learning typically uses the FedAvg algorithm. Compared to FedSGD, recovering data from FedAvg updates is much harder as: (i) the updates are computed at unobserved intermediate network weights, (ii) a large number of batches are used, and (iii) labels and network weights vary simultaneously across client steps. In this work, we propose a new optimization-based attack which successfully attacks FedAvg by addressing the above challenges. First, we solve the optimization problem using automatic differentiation that forces a simulation of the client's update that generates the unobserved parameters for the recovered labels and inputs to match the received client update. Second, we address the large number of batches by relating images from different epochs with a permutation invariant prior. Third, we recover the labels by estimating the parameters of existing FedSGD attacks at every FedAvg step. On the popular FEMNIST dataset, we demonstrate that on average we successfully recover >45% of the client's images from realistic FedAvg updates computed on 10 local epochs of 10 batches each with 5 images, compared to only <10% using the baseline. Our findings show many real-world federated learning implementations based on FedAvg are vulnerable.

Key facts. Cited by 26 papers in the map (data through 14 Oct 2026). Builds on 26 of its 32 references that are in the map. First posted on arXiv 24 Jun 2022.

Builds on

26 of 32 references.

References · 26

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  3. 2016PointNet: Deep Learning on Point Sets for 3D Classification and Segmentationcited by 5,248
  4. 2019Advances and Open Problems in Federated Learningcited by 3,046
  5. 2016Deep Learning with Differential Privacycited by 2,728
  6. 2016An overview of gradient descent optimization algorithmscited by 1,033
  7. 2019Deep Leakage from Gradientscited by 1,021
  8. 2018LEAF: A Benchmark for Federated Settingscited by 792
  9. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  10. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  11. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  12. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
14 more
  1. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  2. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 127
  3. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 108
  4. 2020R-GAP: Recursive Gradient Attack on Privacycited by 97
  5. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  6. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 73
  7. 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
  8. 2021TAG: Gradient Attack on Transformer-based Language Modelscited by 63
  9. 2022LAMP: Extracting Text from Gradients with Language Model Priorscited by 54
  10. 2022Decepticons: Corrupted Transformers Breach Privacy in Federated Learning for Language Modelscited by 53
  11. 2021Towards General Deep Leakage in Federated Learningcited by 40
  12. 2021Bayesian Framework for Gradient Leakagecited by 34
  13. 2021PRECODE - A Generic Model Extension to Prevent Deep Gradient Leakagecited by 28
  14. 2016Total Variation Applications in Computer Visioncited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 1; 2023: 9; 2024: 4; 2025: 9; 2026: 3.

26 papers.

Sort:

By area:

  1. 2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 36
  2. 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 21
  3. 2023FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregationcited by 16
  4. 2024SPEAR:Exact Gradient Inversion of Batches in Federated Learningcited by 15
  5. 2022TabLeak: Tabular Data Leakage in Federated Learningcited by 13
  6. 2023Surrogate Model Extension (SME): A Fast and Accurate Weight Update Attack on Federated Learningcited by 11
  7. 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
  8. 2023A Privacy Preserving System for Movie Recommendations Using Federated Learningcited by 6
  9. 2023Efficient Node Selection in Private Personalized Decentralized Learningcited by 4
  10. 2023Temporal Gradient Inversion Attacks with Robust Optimizationcited by 4
  11. 2023SRATTA : Sample Re-ATTribution Attack of Secure Aggregation in Federated Learningcited by 3
  12. 2023Controlling Federated Learning for Covertnesscited by 2
14 more
  1. 2025Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learningcited by 2
  2. 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learningcited by 2
  3. 2025Trajectory-Aware Information Matching for Multi-Step Gradient Inversion in Federated Learningcited by 2
  4. 2024FEDLAD: Federated Evaluation of Deep Leakage Attacks and Defensescited by 1
  5. 2025Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AIcited by 1
  6. 2025Improving Generalization in Heterogeneous Federated Continual Learning via Spatio-Temporal Gradient Matching with Prototypical Coresetcited by 1
  7. 2025GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Modelscited by 1
  8. 2026Deep Leakage with Generative Flow Matching Denoisercited by 1
  9. 2026ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregationcited by 1
  10. 2026No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learningcited by 1
  11. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  12. 2024Federated Black-Box Adaptation for Semantic Segmentationcited by 0
  13. 2025DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systemscited by 0
  14. 2025MAGIA: Sensing Per-Image Signals from Single-Round Averaged Gradients for Label-Inference-Free Gradient Inversioncited by 0