mlsanityData to 7 Oct 2026

Data Reconstruction Attacks and Defenses: A Systematic Evaluation

arXiv 2402.09478 ↗First posted 13 Feb 2024cs.CR cs.LGcited by 5

Not on the map. Why?

Abstract (arXiv)

Reconstruction attacks and defenses are essential in understanding the data leakage problem in machine learning. However, prior work has centered around empirical observations of gradient inversion attacks, lacks theoretical grounding, and cannot disentangle the usefulness of defending methods from the computational limitation of attacking methods. In this work, we propose to view the problem as an inverse problem, enabling us to theoretically and systematically evaluate the data reconstruction attack. On various defense methods, we derived the algorithmic upper bound and the matching (in feature dimension and architecture dimension) information-theoretical lower bound on the reconstruction error for two-layer neural networks. To complement the theoretical results and investigate the utility-privacy trade-off, we defined a natural evaluation metric of the defense methods with similar utility loss among the strongest attacks. We further propose a strong reconstruction attack that helps update some previous understanding of the strength of defense methods under our proposed evaluation metric.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 41 of its 56 references that are in the map. First posted on arXiv 13 Feb 2024.

Builds on

41 of 56 references.

References · 41

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  5. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  6. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Deep Learning with Differential Privacycited by 2,682
  9. 2017Non-local Neural Networkscited by 2,290
  10. 2018Group Normalizationcited by 1,514
  11. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  12. 2017Deep Image Priorcited by 1,097
29 more
  1. 2019Deep Leakage from Gradientscited by 1,004
  2. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  3. 2016Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural Networkscited by 541
  4. 2019Federated Learning with Differential Privacy: Algorithms and Performance Analysiscited by 528
  5. 2018A Mean Field View of the Landscape of Two-Layers Neural Networkscited by 463
  6. 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 451
  7. 2017PixelCNN++: Improving the PixelCNN with Discretized Logistic Mixture Likelihood and Other Modificationscited by 415
  8. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  9. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  10. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  11. 2016Practical Secure Aggregation for Federated Learning on User-Held Datacited by 178
  12. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  13. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  14. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  15. 2021Gradient Inversion with Generative Image Priorcited by 101
  16. 2017Recovery Guarantees for One-hidden-layer Neural Networkscited by 94
  17. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  18. 2022Fishing for User Data in Large-Batch Federated Learning via Gradient Magnificationcited by 72
  19. 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
  20. 2020A Framework for Evaluating Gradient Leakage Attacks in Federated Learningcited by 63
  21. 2022Bounding Training Data Reconstruction in Private (Deep) Learningcited by 43
  22. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  23. 2017meProp: Sparsified Back Propagation for Accelerated Deep Learning with Reduced Overfittingcited by 34
  24. 2021Bayesian Framework for Gradient Leakagecited by 34
  25. 2022Defending against Reconstruction Attacks with R'enyi Differential Privacycited by 30
  26. 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29
  27. 2020SAPAG: A Self-Adaptive Privacy Attack From Gradientscited by 27
  28. 2022Reconstructing Training Data from Model Gradient, Provablycited by 27
  29. 2015Tensor Factorization via Matrix Factorizationcited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 1; 2026: 3.

5 papers.

  1. 2026Decentralized Federated Learning by Partial Message Exchangecited by 1
  2. 2024Optimal Defenses Against Gradient Reconstruction Attackscited by 0
  3. 2025Training Set Reconstruction from Differentially Private Forests: How Effective is DP?cited by 0
  4. 2026Informationally Compressive Anonymization: Non-Degrading Sensitive Input Protection for Privacy-Preserving Supervised Machine Learningcited by 0
  5. 2026A Sharp Transition in Data Reconstruction under Differential Privacycited by 0