mlsanityData to 14 Oct 2026

Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack

arXiv 2304.11436 ↗First posted 22 Apr 2023cs.CR cs.AI cs.LGcited by 7

Not on the map. Why?

Abstract (arXiv)

Federated Learning with Model Distillation (FedMD) is a nascent collaborative learning paradigm, where only output logits of public datasets are transmitted as distilled knowledge, instead of passing on private model parameters that are susceptible to gradient inversion attacks, a known privacy risk in federated learning. In this paper, we found that even though sharing output logits of public datasets is safer than directly sharing gradients, there still exists a substantial risk of data exposure caused by carefully designed malicious attacks. Our study shows that a malicious server can inject a PLI (Paired-Logits Inversion) attack against FedMD and its variants by training an inversion neural network that exploits the confidence gap between the server and client models. Experiments on multiple facial recognition datasets validate that under FedMD-like schemes, by using paired server-client logits of public datasets only, the malicious server is able to reconstruct private images on all tested benchmarks with a high success rate.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 30 of its 54 references that are in the map. First posted on arXiv 22 Apr 2023.

Builds on

30 of 54 references.

References · 30

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 6,013
  3. 2016Deep Learning with Differential Privacycited by 2,728
  4. 2019Deep Leakage from Gradientscited by 1,021
  5. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  6. 2017Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networkscited by 707
  7. 2020Ensemble Distillation for Robust Model Fusion in Federated Learningcited by 682
  8. 2019FedMD: Heterogenous Federated Learning via Model Distillationcited by 459
  9. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  10. 2019DeblurGAN-v2: Deblurring (Orders-of-Magnitude) Faster and Bettercited by 362
  11. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 334
  12. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
18 more
  1. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  2. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  3. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  4. 2019AUTOVC: Zero-Shot Voice Style Transfer with Only Autoencoder Losscited by 192
  5. 2021FedKD: Communication Efficient Federated Learning via Knowledge Distillationcited by 187
  6. 2016A guide to convolution arithmetic for deep learningcited by 185
  7. 2020Privacy and Robustness in Federated Learning: Attacks and Defensescited by 166
  8. 2021Federated Learning for Open Bankingcited by 141
  9. 2020Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training with Non-IID Private Datacited by 125
  10. 2019Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfercited by 93
  11. 2020Improving Robustness to Model Inversion Attacks via Mutual Information Regularizationcited by 52
  12. 2021FedGEMS: Federated Learning of Larger Server Models via Selective Knowledge Fusioncited by 49
  13. 2021PhotoWCT2: Compact Autoencoder for Photorealistic Style Transfer Resulting from Blockwise Training and Skip Connections of High-Frequency Residualscited by 30
  14. 2022IOP-FL: Inside-Outside Personalization for Federated Medical Image Segmentationcited by 22
  15. 2021DeepFace-EMD: Re-ranking Using Patch-wise Earth Mover's Distance Improves Out-Of-Distribution Face Identificationcited by 20
  16. 2016Large age-gap face verification by feature injection in deep networkscited by 10
  17. 2021Multiple Style Transfer via Variational AutoEncodercited by 9
  18. 2021Federated Learning for Privacy-Preserving Open Innovation Future on Digital Healthcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 1; 2025: 1; 2026: 1.

7 papers.

  1. 2023Language Model Inversioncited by 68
  2. 2023Grounding Foundation Models through Federated Transfer Learning: A General Frameworkcited by 24
  3. 2024Federated Distillation: A Surveycited by 15
  4. 2023pFedES: Model Heterogeneous Personalized Federated Learning with Feature Extractor Sharingcited by 9
  5. 2025Towards Harnessing the Collaborative Power of Large and Small Models for Domain Taskscited by 4
  6. 2023Rethinking Model Inversion Attacks With Patch-Wise Reconstructioncited by 0
  7. 2026Out-of-Distribution Federated Distillation with Domain-Aware Proxycited by 0