mlsanityData to 14 Oct 2026

Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysis

arXiv 2209.05578 ↗First posted 12 Sep 2022cs.LG cs.AI cs.CRcited by 29

Not on the map. Why?

Abstract (arXiv)

Federated learning (FL) aims to perform privacy-preserving machine learning on distributed data held by multiple data owners. To this end, FL requires the data owners to perform training locally and share the gradient updates (instead of the private inputs) with the central server, which are then securely aggregated over multiple data owners. Although aggregation by itself does not provably offer privacy protection, prior work showed that it may suffice if the batch size is sufficiently large. In this paper, we propose the Cocktail Party Attack (CPA) that, contrary to prior belief, is able to recover the private inputs from gradients aggregated over a very large batch size. CPA leverages the crucial insight that aggregate gradients from a fully connected layer is a linear combination of its inputs, which leads us to frame gradient inversion as a blind source separation (BSS) problem (informally called the cocktail party problem). We adapt independent component analysis (ICA)--a classic solution to the BSS problem--to recover private inputs for fully-connected and convolutional networks, and show that CPA significantly outperforms prior gradient inversion attacks, scales to ImageNet-sized inputs, and works on large batch sizes of up to 1024.

Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Builds on 18 of its 26 references that are in the map. First posted on arXiv 12 Sep 2022.

Builds on

18 of 26 references.

References · 18

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  5. 2016Deep Learning with Differential Privacycited by 2,728
  6. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,538
  7. 2019Deep Leakage from Gradientscited by 1,021
  8. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  9. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 423
  10. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  11. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
  12. 2019The Non-IID Data Quagmire of Decentralized Machine Learningcited by 305
6 more
  1. 2016Practical Secure Aggregation for Federated Learning on User-Held Datacited by 178
  2. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 127
  3. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 108
  4. 2021Gradient Inversion with Generative Image Priorcited by 101
  5. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 73
  6. 2022GradViT: Gradient Inversion of Vision Transformerscited by 53

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 8; 2024: 7; 2025: 11; 2026: 3.

29 papers.

Sort:

By area:

  1. 2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 36
  2. 2024SPEAR:Exact Gradient Inversion of Batches in Federated Learningcited by 15
  3. 2023Information Flow Control in Machine Learning through Modular Model Architecturecited by 11
  4. 2023The Resource Problem of Using Linear Layer Leakage Attack in Federated Learningcited by 9
  5. 2023Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learningcited by 9
  6. 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
  7. 2024Privacy Attacks in Decentralized Learningcited by 8
  8. 2023Beyond Gradient and Priors in Privacy Attacks: Leveraging Pooler Layer Inputs of Language Models in Federated Learningcited by 6
  9. 2024Data Reconstruction Attacks and Defenses: A Systematic Evaluationcited by 6
  10. 2024Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learningcited by 6
  11. 2023Privacy Risks in Reinforcement Learning for Household Robotscited by 4
  12. 2023SRATTA : Sample Re-ATTribution Attack of Secure Aggregation in Federated Learningcited by 3
17 more
  1. 2025Gradient Inversion Attacks on Parameter-Efficient Fine-Tuningcited by 3
  2. 2025SPEAR++: Scaling Gradient Inversion via Sparsely-Used Dictionary Learningcited by 3
  3. 2023Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verificationcited by 2
  4. 2024Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomycited by 2
  5. 2024Exploring User-level Gradient Inversion with a Diffusion Priorcited by 2
  6. 2025Towards Privacy-aware Mental Health AI Models: Advances, Challenges, and Opportunitiescited by 2
  7. 2025Cutting Through Privacy: A Hyperplane-Based Data Reconstruction Attack in Federated Learningcited by 2
  8. 2025On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directionscited by 2
  9. 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learningcited by 2
  10. 2025Cocoon: A System Architecture for Differentially Private Training with Correlated Noisescited by 1
  11. 2025GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Modelscited by 1
  12. 2026No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learningcited by 1
  13. 2024Privacy Attack in Federated Learning is Not Easy: An Experimental Studycited by 0
  14. 2025Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Modelscited by 0
  15. 2025Fast, Private, and Protected: Safeguarding Data Privacy and Defending Against Model Poisoning Attacks in Federated Learningcited by 0
  16. 2026TIGER: Inverting Transformer Gradients via Embedding-Subspace Distance Optimizationcited by 0
  17. 2026FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregationcited by 0