mlsanityData to 7 Oct 2026

MedLeak: Multimodal Medical Data Leakage in Secure Federated Learning with Crafted Models

arXiv 2407.09972 ↗First posted 13 Jul 2024cs.LG cs.CR eess.IVcited by 3

Not on the map. Why?

Abstract (arXiv)

Federated learning (FL) allows participants to collaboratively train machine learning models while keeping their data local, making it ideal for collaborations among healthcare institutions on sensitive data. However, in this paper, we propose a novel privacy attack called MedLeak, which allows a malicious FL server to recover high-quality site-specific private medical data from the client model updates. MedLeak works by introducing an adversarially crafted model during the FL training process. Honest clients, unaware of the insidious changes in the published models, continue to send back their updates as per the standard FL protocol. Leveraging a novel analytical method, MedLeak can efficiently recover private client data from the aggregated parameter updates, eliminating costly optimization. In addition, the scheme relies solely on the aggregated updates, thus rendering secure aggregation protocols ineffective, as they depend on the randomization of intermediate results for security while leaving the final aggregated results unaltered. We implement MedLeak on medical image datasets (MedMNIST, COVIDx CXR-4, and Kaggle Brain Tumor MRI), as well as a medical text dataset (MedAbstract). The results demonstrate that our attack achieves high recovery rates and strong quantitative scores on both image and text datasets. We also thoroughly evaluate MedLeak across different attack parameters, providing insights into key factors that influence attack performance and potential defenses. Furthermore, we demonstrate that the recovered data can support downstream tasks such as disease classification with minimal performance loss. Our findings validate the need for enhanced privacy measures in FL systems, particularly for safeguarding sensitive medical data against powerful model inversion attacks.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 19 of its 40 references that are in the map. First posted on arXiv 13 Jul 2024.

Builds on

19 of 40 references.

References · 19

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2019Deep Leakage from Gradientscited by 1,004
  3. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  4. 2021MedMNIST v2 -- A large-scale lightweight benchmark for 2D and 3D biomedical image classificationcited by 682
  5. 2020The Future of Digital Health with Federated Learningcited by 625
  6. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  7. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  8. 2020COVID-Net: A Tailored Deep Convolutional Neural Network Design for Detection of COVID-19 Cases from Chest X-Ray Imagescited by 264
  9. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  10. 2020Feature Inference Attack on Model Predictions in Vertical Federated Learningcited by 105
  11. 2021FedNLP: Benchmarking Federated Learning Methods for Natural Language Processing Taskscited by 84
  12. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 66
7 more
  1. 2021Federated Learning Meets Natural Language Processing: A Surveycited by 42
  2. 2022Evaluating Unsupervised Text Classification: Zero-shot and Similarity-based Approachescited by 39
  3. 2023LOKI: Large-scale Data Reconstruction Attack against Federated Learning through Model Manipulationcited by 35
  4. 2021APRIL: Finding the Achilles' Heel on Privacy for Vision Transformerscited by 23
  5. 2020Communication-Computation Efficient Secure Aggregation for Federated Learningcited by 18
  6. 2023Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstructioncited by 18
  7. 2022SPCXR: Self-supervised Pretraining using Chest X-rays Towards a Domain Specific Foundation Modelcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 1; 2026: 1.

3 papers.

  1. 2024Towards Privacy-Preserving Medical Imaging: Federated Learning with Differential Privacy and Secure Aggregation Using a Modified ResNet Architecturecited by 1
  2. 2025Enabling Trustworthy Federated Learning via Remote Attestation for Mitigating Byzantine Threatscited by 0
  3. 2026Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learningcited by 0