# SoK: On Gradient Leakage in Federated Learning

arXiv: https://arxiv.org/abs/2404.05403 · HTML: https://mlsanity.com/paper/2404.05403/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Apr 2024.

## Built on by (most cited first, 12 of 12)

- [Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attacks](https://mlsanity.com/paper/2503.11514/) (2025)
- [Seeing the Forest through the Trees: Data Leakage from Partial Transformer Gradients](https://mlsanity.com/paper/2406.00999/) (2024)
- [Practical Feasibility of Gradient Inversion Attacks in Federated Learning](https://mlsanity.com/paper/2508.19819/) (2025)
- [Trajectory-Aware Information Matching for Multi-Step Gradient Inversion in Federated Learning](https://mlsanity.com/paper/2509.22082/) (2025)
- [Evaluating Membership Inference Attacks in heterogeneous-data setups](https://mlsanity.com/paper/2502.18986/) (2025)
- [GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Models](https://mlsanity.com/paper/2510.17621/) (2025)
- [Byzantine Outside, Curious Inside: Reconstructing Data Through Malicious Updates](https://mlsanity.com/paper/2506.11413/) (2025)
- [Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning](https://mlsanity.com/paper/2509.09742/) (2025)
- [On the Detectability of Active Gradient Inversion Attacks in Federated Learning](https://mlsanity.com/paper/2511.10502/) (2025)
- [FedVideoMAE: Efficient Federated Video Moderation with Differential Privacy and Secure Aggregation](https://mlsanity.com/paper/2512.18809/) (2025)
- [Choose Wisely and Privately: Proactive Client Selection for Fair and Efficient Federated Learning](https://mlsanity.com/paper/2605.20975/) (2026)
- [AI Security Research Should Better Incentivize Defense Research](https://mlsanity.com/paper/2605.23448/) (2026)

## Abstract (arXiv)

Federated learning (FL) facilitates collaborative model training among multiple clients without raw data exposure. However, recent studies have shown that clients' private training data can be reconstructed from shared gradients in FL, a vulnerability known as gradient inversion attacks (GIAs). While GIAs have demonstrated effectiveness under ideal settings and auxiliary assumptions, their actual efficacy against practical FL systems remains under-explored. To address this gap, we conduct a comprehensive study on GIAs in this work. We start with a survey of GIAs that establishes a timeline to trace their evolution and develops a systematization to uncover their inherent threats. By rethinking GIA in practical FL systems, three fundamental aspects influencing GIA's effectiveness are identified: textittraining setup, textitmodel, and textitpost-processing. Guided by these aspects, we perform extensive theoretical and empirical evaluations of SOTA GIAs across diverse settings. Our findings highlight that GIA is notably textitconstrained, textitfragile, and textiteasily defensible. Specifically, GIAs exhibit inherent limitations against practical local training settings. Additionally, their effectiveness is highly sensitive to the trained model, and even simple post-processing techniques applied to gradients can serve as effective defenses. Our work provides crucial insights into the limited threats of GIAs in practical FL systems. By rectifying prior misconceptions, we hope to inspire more accurate and realistic investigations on this topic.