mlsanityData to 14 Oct 2026

GIFD: A Generative Gradient Inversion Method with Feature Domain Optimization

arXiv 2308.04699 ↗First posted 9 Aug 2023cs.CV cs.CRcited by 45

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) has recently emerged as a promising distributed machine learning framework to preserve clients' privacy, by allowing multiple clients to upload the gradients calculated from their local data to a central server. Recent studies find that the exchanged gradients also take the risk of privacy leakage, e.g., an attacker can invert the shared gradients and recover sensitive data against an FL system by leveraging pre-trained generative adversarial networks (GAN) as prior knowledge. However, performing gradient inversion attacks in the latent space of the GAN model limits their expression ability and generalizability. To tackle these challenges, we propose Gradient Inversion over Feature Domains (GIFD), which disassembles the GAN model and searches the feature domains of the intermediate layers. Instead of optimizing only over the initial latent code, we progressively change the optimized layer, from the initial latent space to intermediate layers closer to the output images. In addition, we design a regularizer to avoid unreal image generation by adding a small l1 ball constraint to the searching range. We also extend GIFD to the out-of-distribution (OOD) setting, which weakens the assumption that the training sets of GANs and FL tasks obey the same data distribution. Extensive experiments demonstrate that our method can achieve pixel-level reconstruction and is superior to the existing methods. Notably, GIFD also shows great generalizability under different defense strategy settings and batch sizes.

Key facts. Cited by 45 papers in the map (data through 14 Oct 2026). Builds on 33 of its 45 references that are in the map. First posted on arXiv 9 Aug 2023.

Builds on

33 of 45 references.

References · 33

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  5. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 6,013
  6. 2022Generative Adversarial Networkscited by 5,627
  7. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  8. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,626
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  10. 2019Deep Leakage from Gradientscited by 1,021
  11. 2017Deeper, Broader and Artier Domain Generalizationcited by 986
  12. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
21 more
  1. 2019Interpreting the Latent Space of GANs for Semantic Face Editingcited by 695
  2. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  3. 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 459
  4. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  5. 2021GAN Inversion: A Surveycited by 367
  6. 2020PULSE: Self-Supervised Photo Upsampling via Latent Space Exploration of Generative Modelscited by 358
  7. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 334
  8. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
  9. 2017Sparse Communication for Distributed Gradient Descentcited by 249
  10. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  11. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  12. 2021Gradient Inversion with Generative Image Priorcited by 101
  13. 2020R-GAP: Recursive Gradient Attack on Privacycited by 97
  14. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  15. 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
  16. 2021Intermediate Layer Optimization for Inverse Problems using Deep Generative Modelscited by 70
  17. 2022GradViT: Gradient Inversion of Vision Transformerscited by 53
  18. 2020PIE: Portrait Image Embedding for Semantic Controlcited by 41
  19. 2022A Survey on Gradient Inversion: Attacks, Defenses and Future Directionscited by 40
  20. 2020Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attackscited by 32
  21. 2021Understanding Training-Data Leakage from Gradients in Neural Networks for Image Classificationcited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 19; 2025: 19; 2026: 7.

45 papers.

Sort:

By area:

  1. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 40
  2. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
  3. 2024CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attackscited by 19
  4. 2024A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attackscited by 18
  5. 2024GI-NAS: Boosting Gradient Inversion Attacks Through Adaptive Neural Architecture Searchcited by 14
  6. 2024Hierarchical Features Matter: A Deep Exploration of Progressive Parameterization Method for Dataset Distillationcited by 13
  7. 2024LCM: Locally Constrained Compact Point Cloud Model for Masked Point Modelingcited by 12
  8. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  9. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputscited by 10
  10. 2025Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attackscited by 9
  11. 2024Improving Robustness to Model Inversion Attacks via Sparse Coding Architecturescited by 8
  12. 2025Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systemscited by 6
33 more
  1. 2025ICAS: Detecting Training Data from Autoregressive Image Generative Modelscited by 6
  2. 2024Recovering Labels from Local Updates in Federated Learningcited by 5
  3. 2024MIBench: A Comprehensive Framework for Benchmarking Model Inversion Attack and Defensecited by 5
  4. 2025Retrievals Can Be Detrimental: Unveiling the Backdoor Vulnerability of Retrieval-Augmented Diffusion Modelscited by 5
  5. 2025CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Samplingcited by 5
  6. 2025ALRPHFS: Adversarially Learned Risk Patterns with Hierarchical Fast & Slow Reasoning for Robust Agent Defensecited by 5
  7. 2024Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filteringcited by 4
  8. 2024Editable-DeepSC: Reliable Cross-Modal Semantic Communications for Facial Editingcited by 3
  9. 2025Gradient Inversion Attacks on Parameter-Efficient Fine-Tuningcited by 3
  10. 2024Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomycited by 2
  11. 2024Is Diffusion Model Safe? Severe Data Leakage via Gradient-Guided Diffusion Modelcited by 2
  12. 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learningcited by 2
  13. 2025SVDefense: Effective Defense against Gradient Inversion Attacks via Singular Value Decompositioncited by 2
  14. 2026Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimizationcited by 2
  15. 2026Bypassing Copyright Protection in Diffusion-based Customization via Two-Stage Latent Feature Optimizationcited by 2
  16. 2024Gradient Inversion of Federated Diffusion Modelscited by 1
  17. 2024Stable Heterogeneous Treatment Effect Estimation across Out-of-Distribution Populationscited by 1
  18. 2024Gradient-Guided Conditional Diffusion Models for Private Image Reconstruction: Analyzing Adversarial Impacts of Differential Privacy and Denoisingcited by 1
  19. 2025Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIPcited by 1
  20. 2025Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakagecited by 1
  21. 2025GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Modelscited by 1
  22. 2025Enhanced Privacy Leakage from Noise-Perturbed Gradients via Gradient-Guided Conditional Diffusion Modelscited by 1
  23. 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocolscited by 1
  24. 2025Gradient Inversion in Federated Reinforcement Learningcited by 1
  25. 2026Position: Life-Logging Video Streams Make the Privacy-Utility Trade-off Inevitablecited by 1
  26. 2024Efficiently Achieving Secure Model Training and Secure Aggregation to Ensure Bidirectional Privacy-Preservation in Federated Learningcited by 0
  27. 2025Real-Time Privacy Risk Measurement with Privacy Tokens for Gradient Leakagecited by 0
  28. 2025DRAGD: A Federated Unlearning Data Reconstruction Attack Based on Gradient Differencescited by 0
  29. 2025Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimizationcited by 0
  30. 2026TIP: Resisting Gradient Inversion via Targeted Interpretable Perturbation in Federated Learningcited by 0
  31. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  32. 2026CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignmentcited by 0
  33. 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features docited by 0