mlsanityData to 7 Oct 2026

Exploring User-level Gradient Inversion with a Diffusion Prior

arXiv 2409.07291 ↗First posted 11 Sep 2024cs.LG cs.AI cs.CRcited by 2

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

We explore user-level gradient inversion as a new attack surface in distributed learning. We first investigate existing attacks on their ability to make inferences about private information beyond training data reconstruction. Motivated by the low reconstruction quality of existing methods, we propose a novel gradient inversion attack that applies a denoising diffusion model as a strong image prior in order to enhance recovery in the large batch setting. Unlike traditional attacks, which aim to reconstruct individual samples and suffer at large batch and image sizes, our approach instead aims to recover a representative image that captures the sensitive shared semantic information corresponding to the underlying user. Our experiments with face images demonstrate the ability of our methods to recover realistic facial images along with private user attributes.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 28 of its 34 references that are in the map. First posted on arXiv 11 Sep 2024.

Builds on

28 of 34 references.

References · 28

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  3. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  4. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  5. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  6. 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
  7. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  8. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  9. 2019Advances and Open Problems in Federated Learningcited by 3,021
  10. 2022Diffusion Posterior Sampling for General Noisy Inverse Problemscited by 1,375
  11. 2019Deep Leakage from Gradientscited by 1,004
  12. 2022Denoising Diffusion Restoration Modelscited by 951
16 more
  1. 2016Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networkscited by 895
  2. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  3. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  4. 2021Solving Inverse Problems in Medical Imaging with Score-Based Generative Modelscited by 514
  5. 2022Improving Diffusion Models for Inverse Problems using Manifold Constraintscited by 501
  6. 2021Label-Efficient Semantic Segmentation with Diffusion Modelscited by 495
  7. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  8. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  9. 2022Diffusion models as plug-and-play priorscited by 230
  10. 2022Diffusion-GAN: Training GANs with Diffusioncited by 203
  11. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  12. 2021Gradient Inversion with Generative Image Priorcited by 101
  13. 2022Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakagecited by 72
  14. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  15. 2021Bayesian Framework for Gradient Leakagecited by 34
  16. 2022Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning using Independent Component Analysiscited by 29

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 0; 2026: 1.

2 papers.

  1. 2026Deep Leakage with Generative Flow Matching Denoisercited by 1
  2. 2024A Stochastic Optimization Framework for Private and Fair Learning From Decentralized Datacited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Enhanced Privacy Leakage from Noise-Perturbed Gradients via Gradient-Guided Conditional Diffusion Models
  2. 2024Gradient-Guided Conditional Diffusion Models for Private Image Reconstruction: Analyzing Adversarial Impacts of Differential Privacy and Denoising
  3. 2024Gradient Inversion of Federated Diffusion Models
  4. 2025GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Models
  5. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  6. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Models
  7. 2024Model Will Tell: Training Membership Inference for Diffusion Models
  8. 2024Model Inversion Attacks Through Target-Specific Conditional Diffusion Models