# Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under
Federated Learning – A Survey and Taxonomy

Yichuan Shi1 Olivera Kotevska2 Viktor Reshniak 2 Abhishek Singh1&Ramesh
Raskar1 1Massachusetts Institute of Technology
2Oak Ridge National Lab {kotevskao<EMAIL_ADDRESS>{yshi23, abhi24,
<EMAIL_ADDRESS>
###### Abstract

Federated Learning (FL) has emerged as a leading paradigm for decentralized,
privacy preserving machine learning training. However, recent research on
gradient inversion attacks (GIAs) have shown that gradient updates in FL can
leak information on private training samples. While existing surveys on GIAs
have focused on the honest-but-curious server threat model, there is a dearth
of research categorizing attacks under the realistic and far more privacy-
infringing cases of malicious servers and clients. In this paper, we present a
survey and novel taxonomy of GIAs that emphasize FL threat models,
particularly that of malicious servers and clients. We first formally define
GIAs and contrast conventional attacks with the malicious attacker. We then
summarize existing honest-but-curious attack strategies, corresponding
defenses, and evaluation metrics. Critically, we dive into attacks with
malicious servers and clients to highlight how they break existing FL
defenses, focusing specifically on reconstruction methods, target model
architectures, target data, and evaluation metrics. Lastly, we discuss open
problems and future research directions.

##  1 Introduction

Federated learning McMahan et al. (2017); Bonawitz et al. (2019) (FL) is a
machine learning framework in which multiple clients collaboratively train a
shared model without exposing their private data. In the simplest
configuration called FedSGD Konečnỳ et al. (2015), a central server
initializes the shared model and communicates model parameters to the clients.
Each client then independently trains the model on their own dataset, then
sends the gradient update back to the central server. The central server
aggregates these updates and adjusts the shared model’s parameters, which are
then sent back to the clients. To address the communication overhead of
sharing gradients with every round, FedAVG is proposed to allow clients to
send model parameter updates to the central server instead of gradients
McMahan et al. (2017).

Federated Learning (FL) configurations can be categorized as either
horizontal, where users possess distinct datasets sharing common features, or
vertical, where users possess different features from the same dataset. In
terms of system setup, FL may involve cross-device scenarios, wherein numerous
light-weight devices – such as IoT – participate with limited computing power
and sporadic data availability; or cross-silo setups, where a smaller user
base participates with robust computing capabilities and consistent dataset
access throughout the entire training rounds.

Of course, both gradient updates and parameter updates reveal underlying
information about the training data. As a result, GIAs (Gradient Inversion
Attacks) have emerged as a privacy attack that seeks to reconstruct, at time
$t$, client $i$’s private data and label $x_{t,i},y_{t,i}$ using parameter
information $W_{t,i}$ via the gradient
$\nabla_{W_{t,i}}\mathcal{L}(W_{t,i})=\frac{\partial\mathcal{L}(f(x_{t,i},W_{t}),y_{t,i})}{\partial
W_{t,i}}$ under FedSGD. Alternatively, reconstruction can also happen with the
FedAVG algorithm McMahan et al. (2017), where $W_{t,i}$ is calculated as
$W_{t,i}\xleftarrow{}W_{t,i}-\eta\nabla\mathcal{L}(W_{t,i};b)$ for batch $b\in
B$ total batches across $E$ total epochs per round.

Earlier works take inspiration from shallow leakages that naturally exist in
fully connected layers Zhu et al. (2019); Zhao et al. (2020) to reconstruct
private data from gradient updates only. Later variants innovate on
optimization or analytic methods to improve attack accuracy and scalability,
but fundamentally seek to breach privacy from gradient or parameter
information alone Geiping et al. (2020); Wei et al. (2020); Yin et al. (2021);
Jin et al. (2021); Huang et al. (2021a); Chen and Campbell (2021); Jeon et al.
(2021); Gupta et al. (2022); Yue et al. (2023); Kariyappa et al. (2022). This
is the honest-but-curious server model, in which the server neither
maliciously modifies the model nor interferes with the FL protocol, but only
tries to reconstruct user data from information it can normally access.
Generally, attacks under this threat model can accurately reconstruct single
image data points, but struggle to scale up to larger batch and image sizes
Huang et al. (2021a); Zhang et al. (2022). As a result, a natural defense
against this type of attack is aggregation.

In contrast, an emergent strain of GIAs relax the assumption that participants
in FL training are benign to also consider the case of malicious servers and
clients. Malicious servers could send inconsistent models to different clients
Pasquini et al. (2022), delay parameter updates and exploit side channels Lam
et al. (2021), intentionally misclassify target classes Wen et al. (2022),
insert malicious components in the instantiated model Boenisch et al. (2023b);
Fowl et al. (2021); Boenisch et al. (2023a); Fowl et al. (2022), and rally
sybil devices Boenisch et al. (2023a). Malicious clients could try to insert
backdoors into the global model via poisoning Wei et al. (2023) or become a
sybil device that aids the server in attacking a victim client Boenisch et al.
(2023a). Many malicious modifications aim to exploit gradient sparsity to
reveal outlier data points. Compared to the honest-but-curious threat model,
malicious attacks could scale up to arbitrarily large batch sizes and token
count, break existing defenses, and repeatedly extract the same target input.

While prior reviews have surveyed existing works on benign/passive attackers
Huang et al. (2021a); Zhang et al. (2022); Wainakh et al. (2022); Enthoven and
Al-Ars (2020), we systematically study existing works where the attacker is
malicious. Honest-but-curious attackers could generally be defeated with
aggregation techniques and larger batch sizes. Attacks utilizing malicious
central servers and clients, however, often circumvent secure aggregation
Bonawitz et al. (2016) and other defenses. Moreover, malicious participants
challenge the security and privacy assumptions in centralized federated
learning – i.e. federated learning using a central server. Thus, this paper
makes the following key contributions:

  * •

We present a novel taxonomy of GIA that focuses on threat models. We
categorize attacks based on whether they assume the honest-but-curious server,
malicious server, or malicious client. Unlike prior taxonomies based on
optimization objectives, our classification clarifies underlying threat
assumptions in practical security efforts. We further categorize attacks using
malicious participants based on reconstruction technique: analytical
decomposition, gradient sparsification, or gradient isolation. We specifically
highlight attacks that have been tested against defenses and their results.

  * •

For honest-but-curious server models, we enrich prior surveys by updating the
catalog of attacks to include most recent publications. Importantly, we
provide a contextual framework by integrating defense strategies and
evaluation metrics. Formally categorizing attack success metrics, we
distinguish between those rooted in model architecture, latent space, and
feature space.

  * •

We finally conclude the survey by discussing open problems and future research
directions. Aligning with the survey’s structure, we sequentially discuss
emerging trends in attacks, defenses, and evaluation metrics. We specifically
highlight the need to develop and evaluate attacks in a practical, realistic
FL setting, as well as a case for decentralized FL.

  * •

To the best of our knowledge, this is the first survey that overviews GIAs
using malicious participants. This is also the first effort to taxonomize GIAs
on the basis of threat models and in context of defenses and evaluation
metrics.

##  2 Background

Even without intentional reconstruction, past works Wen et al. (2022); Fowl et
al. (2021); Zhu et al. (2019) have pointed out that linear layers with ReLU
activation functions can naturally leak input information. This is because
gradients in fully connected NN layers are linear combinations of their
inputs. As a result, if the ReLU activation activates for only one feature out
of the input, then that feature would be leaked.

###  2.1 Attacks

Generally, classic GIAs follow one of the two reconstruction methods: a)
optimization based reconstruction, where the attacker minimizes a dual-
optimization problem, or b) analytical reconstruction, where the attack
recursively reconstructs the input from the gradient using knowledge about the
model structure. Attacks are generally deemed successful if one-shot attacks
are successful, i.e., if the attacker can recover at least one image from the
batch.

##### Optimization-based Reconstruction

broadly aims to minimize the distance between a randomly initialized sample
gradient and the actual gradient. Also known as iterative reconstruction, this
method fundamentally solves a dual-optimization objective Zhu et al. (2019);
Zhao et al. (2020)

$\displaystyle x^{*}_{i}=\arg\min_{\hat{x}}\|G^{t}_{i}-\hat{G}\|^{2}$ (1)
$\displaystyle y^{*}_{i}=\arg\min_{\hat{y}}\|G^{t}_{i}-\hat{G}\|^{2}$ (2)

where $G^{t}_{i}$ is the original gradient and $\hat{G}$ is the dummy gradient
computed from randomly instantiated data $(\hat{x},\hat{y})$ as
$\hat{G}=\nabla_{W^{t}}\mathcal{L}(f_{W^{t}}(\hat{x}),\hat{y})$. The accuracy
and stability of this optimization approach can be improved with knowledge of
mini-batch statistics Geiping et al. (2020). Later works improve this
optimization procedure with generative Jeon et al. (2021); Fang et al. (2023);
Hitaj et al. (2017) or adversarial models Wu et al. (2023), transformers Lu et
al. (2021), or novel data-sets Hatamizadeh et al. (2023). Additionally, Jin et
al. (2021) applies the distance minimization technique to vertical federated
learning, where each client maintains a unique features set.

Overall, optimization based approaches can attack more model architectures
such as CNN and transformers. However, they tend to struggle when scaling up
to larger batch sizes and may encounter issues with convergence instability
from the randomly instantiated dummy images. GAN-based methods are also
computationally heavy and often assume the attacker to have prior knowledge of
the victim’s data distribution.

##### Analytical-based Reconstruction

avoids instabilities associated with the dual optimization problem by starting
from the tail-end of the model and analytically reconstructing the input to
layers. While the majority of attacks under this method recursively
reconstruct input layer by layer Chen and Campbell (2021); Zhu and Blaschko
(2021), a recent attack Kariyappa et al. (2022) frames reconstruction as a
blind source separation problem (BSS) on a fully connected layer, and thus
uses principle component analysis to reconstruct it.

In contrast to optimization-based attacks, analytical attacks can better scale
to large batch sizes and avoid the dual-optimization problem. However, current
attacks only target fully connected and convolutional layers, and cannot
target mini-batch training Zhang et al. (2022).

###  2.2 Defenses

Prior surveys Zhang et al. (2022); Wainakh et al. (2022); Enthoven and Al-Ars
(2020) broadly categorize defense mechanisms under federated learning into
three classes based on the mechanism for additional privacy: cryptography,
perturbation, and sanitization.

##### Cryptographic

approaches employ methods such as homomorphic encryption and multi-party
computation to encrypt gradient information Bonawitz et al. (2016); Jin et al.
(2023). Additionally, Huang et al. (2021b) devised an encryption scheme for
training images. While recent encryption-based schemes seek to optimize
performance, cryptographic defenses still pose a greater overhead on
computation time and model size under a practical setting. Moreover, defenses
based on key exchange cannot safeguard the FL setup against malicious clients
Wei et al. (2023).

##### Obfuscation

based methods seek to hide user data through means such as additive noise or
trimming down the gradient information. Defenses on the front of noise
addition include local and distributed differential privacy (DP) Wei et al. .
Measures that obfuscate via gradient reduction originate from the need to
reduce network overhead in gradient and parameter exchanges, and they include
methods such as gradient compression Haddadpour et al. (2020) and pruning Zhu
et al. (2019). While compression has not been tested against attackers, there
have been attacks that recovered gradients under distributed differential
privacy Boenisch et al. (2023a); Wu et al. (2023) and pruning Huang et al.
(2021a).

Secure aggregation Bonawitz et al. (2016), on the other hand, requires that
clients aggregate their updates before sending it to the server. In essence,
each user $u$ sends to the server an update $y_{u}=x_{u}+p_{u}+\sum_{v\in
U_{2}}p_{u,v}$ where $x_{u}$ is the output, $p$ is a pseudorandom generator
function, and $v$ is a different user in the set of all users. While secure
aggregation generally provides security against GIAs under the honest-but-
curious server setting, later attacks using malicious participants – detailed
in Section 3 – demonstrate that secure aggregation is not sufficient to defend
against the malicious attacker either alone or even when paired with
distributed differential privacy.

##### Sanitization

techniques, in contrast, generally take a more protocol-level view to root out
inversion attacks. Byzantine-robust aggregation schemes (ARG) root out
malicious participants by analyzing their update according to algorithms that
evaluate the resulting distribution or error. Compared to other Byzantine-
robust techniques such as those based on redundancy or trust, ARGs do not
require trusted clients or datasets Li et al. (2023). However, a client side
poisoning attack Wei et al. (2023) shows that, with a cleaver and stealthy
attacker, such statistical margins could be manipulated to fool Byzantine-
robust ARGs.

###  2.3 Success Evaluation Metrics

Evaluating the effectiveness of gradient inversion attacks requires robust and
informative metrics. In imaging domain, $L$-norms and traditional perceptual
metrics (SSIM, PSNR, FSIM, etc., Wang et al. (2004)) are widely used but often
fail to capture the semantic context of recovered data, particularly in
multidimensional outputs like images. These metrics often assume pixel-wise
independence, overlooking spatial relationships and crucial information within
noisy and altered images. As a result, they can miss subtle yet significant
data leakage, leading to inaccurate assessments of attack success Papadopoulos
et al. (2023).

Emerging approaches that showed promise in capturing the semantic context and
perceptual nuances are commonly feature-based. Learned Perceptual Image Patch
Similarity (LPIPS) score is the notable example of such metric between two
images that is evaluated in the representation space of neural networks
trained on challenging visual prediction and modeling tasks Zhang et al.
(2018). Image Identifiability Precision (IIP) is a related metric that
measures the amount of leaked identifiable information revealed by gradient
inversion Yin et al. (2021). IIP achieves this by counting the fraction of
exact matches between the original image and the nearest neighbor to its
reconstruction evaluated in a deep feature embedding space. A variant of IIP
computed in pixel space has been also proposed as a model-independent but more
strict metric Fowl et al. (2021). Another extension of IIP was proposed in
Hatamizadeh et al. (2023) by computing it for the entire training and
validation data of all clients, not just a random sample, offering a
comprehensive picture of potential data leakage.

In an effort to address the considerable cost of deep learning based
approaches, alternative lightweight metrics utilizing linear or handcrafted
features were also suggested. Among others, frequency domain cosine similarity
was used in Yin et al. (2021) to capture high-frequency details that often
missed by pixel-wise comparisons. Absolute Variation Distance (AVD) is another
simplistic metric proposed in Papadopoulos et al. (2023), it evaluates
distances in gradient space and offers a continuous measure for information
retrieval in noisy images, aligning closely with human perception.

To measure data leakage across multiple clients with different training data
and privacy levels, Hatamizadeh et al. (2023) proposed a Relative Data Leakage
Value (RDLV) indicator based on a given similarity metric such as, e.g., SSIM.
RDLV evaluates normalized changes relative to the selected reference point
enabling comparison of base metric across the clients. To quantify latent
information leakages in property inference attacks, Mo et al. (2021) proposed
two additional metrics: a) empirical $\mathcal{V}$-information (Xu et al.
(2020)) measures the information flow between gradients and sensitive
properties (e.g., gender, race) in each layer of the FL model, and b)
Jacobian-based metric measures the sensitivity of gradients to input changes
and properties: non-sensitive gradients indicate lower attack success,
providing valuable insights into the attack’s vulnerability. These metrics
provide a useful insight into which clients or parts of the model are most
vulnerable to privacy attacks revealing opportunities for the design of
potential defenses.

While most existing GIAs focused on imaging problems, language tasks have been
somewhat overlooked despite that most successful industrial applications of FL
are for textual data. Partially, this is a result of the previously accepted
opinion that transformer-based models are hard to invert contributing to their
privacy preservation without the need for stronger defences. However, Fowl et
al. (2022) showed that malicious servers can significantly corrupt transformer
models at the client side breaking their privacy. For the attack evaluation,
they used standard NLP token accuracy metrics such as Bilingual Evaluation
Understudy (BLEU) and Recall-Oriented Understudy for Gisting Evaluation
(ROUGE).

##  3 Malicious Participants

In this section, we detail our taxonomy of GIAs involving malicious servers
and clients. For representative studies in each threat model, we categorize
them into three sub-categories by how they extract gradient information:
Analytical Decomposition, Gradient Sparsification, and Gradient Isolation. We
further analyze them on the basis of defenses broken, targeted data and model,
and FL setup. Detailed summaries and comparison of the selected studies for
malicious server and client attacks are listed in Figure 1.

###  3.1 Attacks

Compared to the honest-but-curious server model, malicious participants are
uniquely adept at breaking secure aggregation Bonawitz et al. (2016) and
isolating the individual gradient for a target data-point from the dense,
batched aggregate, a task that is often difficult for the honest-but-curious
server threat model Zhang et al. (2022). To pick out individual gradients from
the batch, the attacker often uses side channel information Lam et al. (2021),
malicious model modifications Fowl et al. (2022, 2021); Boenisch et al.
(2023b); Pasquini et al. (2022), or malicious parameter modifications Wen et
al. (2022); Wei et al. (2023).

Once the target gradient is sufficiently disaggregated, the attacker can use
standard GIA techniques such as gradient matching Zhu et al. (2019); Geiping
et al. (2020); Zhao et al. (2020) to recover the original data in the case of
image reconstruction. In the case of language reconstruction, the attacker
needs to take additional steps to sort recovered tokens in their proper
sequence. This can be achieved via a lookup dictionary that maps embeddings
back to tokens Boenisch et al. (2023b) or by solving a linear sum assignment
problem Fowl et al. (2022).

Name |  Lam et al. (2021) |  Boenisch et al. (2023b) |  Fowl et al. (2021) |  Wen et al. (2022) |  Fowl et al. (2022) |  Wei et al. (2023) |  Pasquini et al. (2022) |  Boenisch et al. (2023a)
---|---|---|---|---|---|---|---|---
Threat Model |  Adversarial Server + Side Channel |  Malicious Server |  Malicious Server |  Malicious Server |  Malicious Server |  Malicious Client |  Malicious Server |  Malicious Server + Sybil Devices
Reconstruction Method |  Matrix refactorization |  Sparsity by trap weights |  Sparsity by imprint module |  Sparsity by malicious parameters |  Sparsity by imprint module |  Sparsity by model poisoning |  Isolation by inconsistent model |  Isolation by sybil devices
Target Data |  CIFAR10 and CIFAR100. Batch sizes 18, 16, 32. User dataset size 64, 128. |  MNIST, CIFAR100, ImageNet. IMDB for text. Batch size up to 100 |  ImageNet. Batch size varying between 64, 128, 256. |  ImageNet. Batch size up to 250 tested. |  Wikitext, Batch size 512 w/ seq. len. 32. Stackoverflow, batch size 64 w/ seq. len. 512. |  CIFAR10, TinyImageNet, Caltech256, Batch Size 8-32. |  CIFAR10, CIFAR100, tinyImagenet. Batch size up to 512. |  CIFAR10 across mini batch sizes 10, 20, 100. IMDB for sentiment analysis
Target Model Architecture |  LeNet CNN with 3 layers |  Networks with fully connected layers and ReLU activation - FC-NNs and CNNs |  ResNet18 tested, but Model Agnostic for any neural network that gets non-zero gradient signal |  ResNet18 with Adam optimizer tested, Model Agnostic |  3 layer transformer, BERT-Base, and smallest GPT2 |  Resnet18 but any deep neural network |  Resnet, but should be model agnostic for any neural network with fully-connected layer. |  6-layer fully connected neural net, same as Curious Abandon Honesty
FL Setup |  FedAVG. Central server is adversarial and fixes the model across rounds. Random client selection / device participation of up to 1000 users. |  FedAVG. Central server target users by sending model with trap weights. Users hold five mini batches ranging from $\\{10,20,40\\}$ data points. |  Both FedAVG and FedSGD. FedAVG case necessitates additional linear scaling in imprint module. |  FedSGD, assuming attacker (central server) can estimate CDF of distribution for any feature of interest in the target class. |  FedSGD with up to 100 users. Claims FedAVG |  FedAVG and FedSGD with byzantine robust aggregation rules (AGRs). $m$ Coordinated malicious clinets out of $N$ total clients |  FedSGD and FedAVG with secure aggregation. Malicious server can corrupt a fixed number of users, same threat model as secure aggregation paper. |  FedSGD under distributed differential privacy (DDP) and secure aggregation. $M-1$ sybil devices for $M$ sampled participants per round.
Input |  Aggregated gradients $G_{\text{aggre}}$, constraint window, constraint sums, number of users |  Minibatch aggregated gradients |  Batched gradient update after secure aggregation under cross-silo setting. |  Batched gradient update after secure aggregation, for both cross device and cross silo settings. |  Averaged gradient of multiple sequences of multiple tokens |  Model parameter updates from uncompromised server |  Batch gradient after secure aggregation |  Batch gradient after secure aggregation and DDP
Defense Broken |  SA |  None tested |  SA |  SA |  None tested |  Byzantine Robust AGRs |  SA |  SA + DDP

Figure 1: Summary of attacks employing adversarial or malicious servers

Matrix Refactorization | Gradient Sparsification | Gradient Isolation
---|---|---

####  3.1.1 Means for Gradient Disambiguation

As one of the earliest attacks that employs an adversarial central server, the
Gradient Disaggregation attack Lam et al. (2021) disambiguates batched
gradients by solving a binary factorization problem with the side-channel
knowledge of user participation across rounds.

In the majority of later methods, the central server induces and exploits
gradient sparsity or gradient isolation through malicious model modifications
or malicious parameter updates. In those cases, both the federated learning
and secure aggregation protocols would run as designed, but either all but one
data point in the input batch return a zero gradient, or a sparse distribution
is created out of a dense aggregation to recover sparse single updates.

##### Analytical Decomposition

Lam et al. (2021) frames gradient disaggregation as a binary matrix
factorization:

$\displaystyle G_{aggregated}=P\cdot G_{individual},$

where $G_{aggregated}\in\mathbb{R}^{n\times d}$, $P\in\\{0,1\\}^{n\times u}$,
and $G_{individual}\in\mathbb{R}^{u\times d}$ across $d$ dimensions, $n$
rounds, and $u$ total participants. Additional constraints are imposed using
device analytics’ summary information that details how often a specific user
participates in training. Specifically, $C^{i}_{k}\in\\{0,1\\}^{n}$ denotes
the training rounds for which total number of participants $c^{i}_{k}$ is
known for the $k$th participant. Thus, with the additional constraint
$C_{k}p_{k}-c_{k}=0$, the user participation matrix $P$ is solved by the
following optimization:

$\displaystyle\text{Find }p_{k}\text{ s.t. }Nul(G^{T}_{aggregated})p_{k}=0,$
(3) $\displaystyle p_{k}\in\\{0,1\\}^{n},$ (4) $\displaystyle
C_{k}p_{k}-c_{k}=0.$ (5)

where $Nul$ is the null space of the matrix. The final $P$ then reveals
individual model updates.

##### Gradient Sparsification

Without explicit matrix decomposition, the compromised server could also
insert malicious model modifications Fowl et al. (2021, 2022); Boenisch et al.
(2023b) or parameter modifications Wen et al. (2022) to create gradient
sparsity and isolate individual data points.

Fowl et al. (2021) utilizes the natural leakage in linear layers detailed in
section 2 to construct a linear imprint module with malicious weights and bias
$W_{*},b_{*}$ such that $\langle W^{i}_{*},x\rangle$ creates a distribution of
user data (for instance, image brightness) and
$b^{i}_{*}=-\Phi^{-1}(\frac{i}{k})=-c_{i}$, where $\Phi^{-1}$ is the inverse
of the standard Gaussian CDF and $i$ denotes the $i^{th}$ row (or channel) of
$W_{*}$ and the $i^{th}$ entry of $b_{*}$. The bias term creates $k$ bins
according to the CDF of the distribution created by $\langle
W^{i}_{*},x\rangle$. In the example case of image brightness, if some image
$x_{t}$ land between two distinct brightness values $c_{l}$ and $c_{l+1}$ such
that $c_{l}\leq h(x_{t})\leq c_{l+1}$, the imprint module can thus reconstruct

$\displaystyle(\nabla_{W^{l}_{*}}\mathcal{L}-\nabla_{W^{l+1}_{*}}\mathcal{L})\oslash\left(\frac{\partial\mathcal{L}}{\partial
b^{l}_{*}}-\frac{\partial\mathcal{L}}{\partial b^{l+1}_{*}}\right)$ (6)
$\displaystyle=x_{t}+\sum_{s=1}^{p}x_{i_{s}}-\sum_{s=1}^{p}x_{i_{s}}$ (7)
$\displaystyle=x_{t},$

where every $x_{i}$ is a image from the batch that has brightness greater than
$c_{l}$.

Similarly, Fowl et al. (2022) extends this idea of measuring and then
capturing induced sparsity to language transformers. Malicious modifications
to the transformer first disable all attention layers and most outputs of each
feed-forward block, such that only the last entry has a non-zero gradient and
token information is not mixed. The reconstruction task then only deals with
the gradients of the first linear layer in each feed-forward block. The
operation of the first linear layer in each $i^{th}$ feed-forward block is
$y_{k}=W_{i}u_{k}+b_{i}$, where $\\{u_{k}\\}^{S}_{k=1}$ represents the input
embedding that the attacker wants to recover, in a sequence of $S$ elements.
The malicious $\langle W_{*_{i}},b_{*_{i}}\rangle$ in Fowl et al. (2021) are
then used for each linear layer $i$ to separate gradient signals. Crucially,
the bias terms over all layers are set to be sequentially ascending, so the
reconstructed $y^{j}_{k}=\langle W_{*},u_{k}\rangle+b^{j}$ have the ordering
$y^{j}_{k}\geq y^{j+1}_{k},\forall j<j+1$. When subsequent ReLU units are
thresholding at $y_{k}^{j}$, embedding ordering can be uncovered by the
following subtractions:

$\displaystyle\sum^{S}_{k=1}\nabla_{W^{j}_{i}}\mathcal{L}_{k}-\sum^{S}_{k=1}\nabla_{W^{j+1}_{i}}\mathcal{L}_{k}$
$\displaystyle=\lambda^{j}_{i}u_{k},$ (8)
$\displaystyle\sum^{S}_{k=1}\frac{\partial\mathcal{L}_{k}}{\partial
b^{j}}-\sum^{S}_{k=1}\frac{\partial\mathcal{L}_{k}}{\partial b^{j+1}}$
$\displaystyle=\lambda^{j}_{i}.$ (9)

In addition, multiple sequences are disambiguated with query, key, and value
weight matrices and biases $\langle W_{Q},b_{Q}\rangle,\langle
W_{K},b_{K}\rangle,\langle W_{V},b_{V}\rangle$. The query, key, and value
matrices are initialized such that
$W_{K}=I_{d},b_{K}=\overrightarrow{0},W_{Q}=\overrightarrow{0},b_{Q}=\gamma\overrightarrow{p}_{0},W_{V}=I_{d^{\prime}},b_{V}=\overrightarrow{0}$
where $\overrightarrow{p}_{0}$ is the first positional encoding, and
$\gamma,d^{\prime}$ are server hyperparameters. After passing attention
weights through the softmax function $\sigma(\frac{QK^{T}}{\sqrt{d_{k}}})$,
the recovered embeddings from each linear layer contain unique information
about each sequence’s first tokens. Sequence disambiguation can then be
performed by calculating correlations between such first-position embeddings
and later-position embeddings via clustering algorithms such as K-means.

Building off the idea of sparsification via model modification, but
recognizing that the imprint layer design could be more easily detectable by
the client, Boenisch et al. (2023b) instead constructs ”trap weights”.
Recognizing and amplifying the previous discussed natural gradient leakage in
fully-connected linear layers, the ”Curious Abandon Honesty” attack clarifies
that under ReLU activation, a neuron $i$ is only active if the sum of features
weighted by the negative weights $w^{n}_{i}$ is less than the sum of weights
that are positive $w^{p}_{i}$:

$\displaystyle\sum_{n\in N}w^{n}_{i}x_{n}<\sum_{n\in N}w^{p}_{i}x_{p}$ (10)

Thus, the adversarial server initialize the model such that roughly half of
the row weights are negative, and the other half positive. By controlling the
probability that Equation (10) holds, the adversarial initialization activates
for only one input data point per mini-batch, thereby disaggregating batched
gradients.

Lastly, Wen et al. (2022) takes the idea of stealth one step further and
constructs a server-side privacy attack that only uses compromised parameters,
rather than any detectable model modifications. The attack builds off the
crucial observation that when the confidence of a target class’ prediction
decreases, its corresponding gradient contribution to the gradient information
increases. As a result, the class fishing attack modifies a fully-connected
classification layer $\langle W\in\mathcal{R}^{n\times
m},b\in\mathcal{R}^{n}\rangle$ to isolate target class $c$ as follows:

$\displaystyle W_{i,j}=\begin{cases}W_{i,j}&\text{ if }i=c,\\\ 0&\text{
otherwise},\end{cases}$ (11) $\displaystyle b_{i}=\begin{cases}b_{i}&\text{ if
}i=c,\\\ \alpha&\text{ otherwise}.\end{cases}$ (12)

where $\alpha$ is a server-side hyperparameter. To address intra-batch class
collisions, a separate feature-fishing  strategy is devised using the same
idea. Both $\theta$ and $\beta$ are server-side hyperparameters.

$\displaystyle W_{i,j}=\begin{cases}\beta&\text{ if }i=c,j=k,\\\ 0&\text{
otherwise},\end{cases}$ (13) $\displaystyle
b_{i}=\begin{cases}-\beta\theta&\text{ if }i=c,\\\ \alpha&\text{
otherwise}.\end{cases}$ (14)

Though malicious server attacks are highly effective at disaggregating
gradients under protections such as secure aggregation and differential
privacy, gaining control of the central server may be unrealistic, as it is
typically heavily safe-guarded. Wei et al. (2023) instead argues that a
malicious client is a more realistic threat model, and conceives of the
client-side poisoning Gradient Inversion (CGI) attack. The malicious client
first crafts a local model that intentionally maximizes the loss of the
targeted sample class by misclassification or omission of the target class in
local training. Once the malicious local parameters $\Phi_{mal}$ are obtained,
the client then poison the global model while evading byzantine secure
aggregation rules by minimizing the distance between the malicious update
$\delta_{mal}$ and the current aggregated update $\delta_{agg}$:

$\displaystyle\delta_{poi}$ $\displaystyle=\Phi^{t}_{G}-\Phi_{mal},$ (15)
$\displaystyle\delta_{agg}$
$\displaystyle=\frac{1}{\alpha}(\Phi^{t-1}_{G}-\Phi^{\prime}_{G}),$ (16)
$\displaystyle\delta_{mal}$
$\displaystyle=\rho\frac{\delta_{poi}}{\|\delta_{poi}\|}+\beta\hat{\delta}_{benigh},$
(17)

where $\Phi_{G}$ denotes the global parameters, and $\alpha$, $\rho$, $\beta$
are tunable parameters. And thus, the adversary seeks to minimize

$\displaystyle\arg\min_{\gamma,\beta}\|\delta_{mal}-\delta_{agg}\|_{2}.$ (18)

With the global model poisoned, the adversary can then reconstruct the
targeted gradient by first calculating the aggregate update, instantiating a
target gradient with randomly generated data, and reconstructing the target
image by minimizing cosine distance in the same way as Zhu et al. (2019);
Geiping et al. (2020). Specifically, the numerical reconstruction method is
used from Geiping et al. (2020):

$\displaystyle\arg\min_{\hat{x}_{tar}}\lambda_{0}(1-\frac{\langle\hat{\delta}_{tar},\delta^{k}_{agg}\rangle}{\|\hat{\delta}_{tar}\|\|\delta^{k}_{agg}\|})$
$\displaystyle+\lambda_{1}R_{TV}(\hat{x}_{tar})+$
$\displaystyle\lambda_{2}R_{l2}(\hat{x}_{tar})+\lambda_{3}R_{clip}(\hat{x}_{tar})$
(19)

with

$\displaystyle\delta^{k}_{agg}$
$\displaystyle=\frac{1}{\alpha}(\Phi^{k+1}_{G}-\Phi^{k}_{G}),$ (20)
$\displaystyle\hat{\delta}_{target}$
$\displaystyle=\nabla_{\Phi^{k}_{G}}\mathcal{L}(\hat{x}_{target},y_{target}).$
(21)

##### Gradient Isolation

In contract to attacks that create a sparse distribution from a dense, batched
gradient, another variant of the malicious server attack instead pick out
single input gradients from the aggregation by isolating the target gradient
either through sending users inconsistent models Pasquini et al. (2022) or
rallying sybil devices Bonawitz et al. (2016).

Pasquini et al. (2022) pointed out that secure aggregation provides privacy
protection by performing a weighted sum across all users’ gradient
contributions. As a result, the malicious server breaks secure aggregation by
making sure that only the victim user returns a non-zero gradient to secure
aggregation. Using ReLU’s ability to cancel out values less than or equal to
zero, a sample modification would be to set $W=[0]$ and $b=[\mathcal{R}_{\leq
0}]$ for non-target users in the batch. For networks not using ReLU, the
malicious server can insert a ReLU layer.

Building off the exploitation of zeroing other gradients’ contribution to
secure aggregation, Boenisch et al. (2023a) conceives of a gradient-isolation
mechanism that depends on a malicious central server that can rally sybil
devices. This scheme not only breaks secure aggregation, but also distributed
differential privacy (DDP). Given an FL protocol that requires $M$ clients to
be sampled per round, the malicious server targets a single victim clients and
rallies $M-1$ sybil devices. Thus, when the sybil devices contribute known, or
empty, gradients to the server, secure aggregation is broken and the target
user’s gradient is exposed. The authors make the additional observation that
the attack also breaks DDP, as its sampled local Guassian noise is dependent
on the number of participants:

$\displaystyle\mathcal{N}\left(0,\frac{\sigma^{2}}{M-1}c^{2}\right).$

When the number of participants $M$ increases, the amount of noise needed from
each participant proportionally decreases. As a result, if $M$ is sufficiently
large and the $M-1$ sybil devices introduce less noise than necessary, or none
at all, the differential privacy safeguard for the target user could
significantly diminish, approaching a negligible level.

###  3.2 Performance Evaluation

Generally, attacks under the honest-but-curious server model struggles to
scale up to larger batches, higher resolution images, different data and model
types such as language, and many require unlikely assumptions like access to
minibatch statistics Huang et al. (2021a); Zhang et al. (2022); Geiping et al.
(2020). On the other hand, attacks using malicious participants are generally
much more successful in their scalability, reproducibility, and extensibility
to tasks beyond image classification.

##### Target Data

Classic GIAs using the honest-but-curious server generally work on simpler
image datasets with smaller batches, with Huang et al. (2021a) having the
biggest success in recovering ImageNet data with dimension of $224\times 224$
and batch size of 100. On the language front, Gupta et al. (2022) achieved a
ROUGUE-L score of around 0.3 for batch sizes greater than 16 when using a
language model prior and beam search to aid in attack success.

On the contrary, many attacks using malicious participants can scale up to
batch sizes of 100 with ImageNet data Boenisch et al. (2023b); Fowl et al.
(2021); Wen et al. (2022); Fowl et al. (2022); Pasquini et al. (2022);
Boenisch et al. (2023a). Moreover, the attacks targeting language
modelsBoenisch et al. (2023b); Fowl et al. (2022) outperform comparable
honest-but-curious attacks by the amount of recoverable tokens per sentence,
and sentence per batch (250 tokens in Boenisch et al. (2023b), and up to 512
sequences per batch in Fowl et al. (2022)).

##### Data Distribution

All malicious attacks are experimented on independent and identically
distributed (IID) data. Though there exists works that address the challenge
of data heterogeneity in a federated setting, we have not found any research
pertaining to malicious-participant GIAs that involve non-IID data. On the
other hand, while the majority of GIAs look at attacks in the cross-silo
setting in federated learning Boenisch et al. (2023b, a); Fowl et al. (2021);
Pasquini et al. (2022), Wen et al. look at both cross-device and cross-silo
scenarios.

##### FL Setup

In classic GIAs that operate under the honest-but-curious server threat model,
proposed gradient reconstruction methods often work only for the simple FedSGD
setting and struggle to adapt to FedAVG, which contains epoch updates in the
gradient information Zhang et al. (2022); Huang et al. (2021a). In contrast,
many malicious participant GIAs successfully break FedAVG Boenisch et al.
(2023b); Fowl et al. (2021); Pasquini et al. (2022); Boenisch et al. (2023a);
Lam et al. (2021). In fact, Lam et al. (2021) scaled the attack up to 1000
participating users that randomly enter and exit the FL protocol. Their work
demonstrates that under the malicious participant threat model, participation
of any given client in the aggregation step across training epochs can be used
to ”disaggregate” their updates from the aggregated model. Hence, aggregation
does not necessarily provide stronger security protections.

##### Defenses Broken

As previously mentioned, the unique challenge posed by the malicious
participant threat model is the ease by which they break secure aggregation
and scale up to larger batch sizes. Besides secure aggregation, however, only
distributed differential privacy has been broken by the attack proposed in
Boenisch et al. (2023a).

##  4 Future Research

###  4.1 Improving Evaluation

Evaluating reconstruction attack is difficult for high dimensional data
because the intrinsic dimension of data is smaller as it lies on a manifold.
For modalities like images, different evaluation metrics come with their own
trade-offs and hence, quantifying attack success solely based on a scalar
needs to account for practical considerations. Domain-specific metrics, like
comparing embeddings from large language models for text is perhaps the most
effective approach to capture semantic similarity.

Many times pixel perfect reconstruction is not a practical requirement anyway
because attackers might be interested in inferring sensitive information such
as a sensitive attribute in an image (such as identity, race, age etc.).

Differential privacy offers a solution to the problem of various trade-offs in
evaluation metrics by quantifying privacy budget in terms of $\epsilon$ (and
$\delta$), however, it rests on a very specific attack model (membership
inference attack) and hence may not be amenable for reconstruction attacks
Chatzikokolakis et al. (2013); Kifer and Machanavajjhala (2014); Singh et al.
(2023).

###  4.2 Improving Attacks

In a similar vein of standardization, we see that an emerging trend in
offensive GIA research is attacks that are viable under more realistic FL
setups, including defenses and real-world datasets. For instance, Hatamizadeh
et al. (2023) tested the proposed GIA attack against varied differential
privacy measures, clients with different amounts of data and batch sizes, and
Covid-19 chest X-Ray images. Similarly, Wu et al. (2023) benchmarked and
proved the success of an adaptive attack against gradient perturbation
(differential privacy), gradient pruning, and sign compression on both
language and image datasets. Going forward, we anticipate attacks under all
threat models to be tested against realistic defenses and FL scenarios where
clients potentially dropout and rejoin at will.

###  4.3 Improving Defenses

When considering potential defense strategies, one significant scenario
involves fortifying against gradient sparsification attacks. As illustrated in
Table 1, the previously employed secure aggregation defense mechanisms fell
victim to breaches detailed by Boenisch et al. (2023b); Fowl et al. (2021);
Wen et al. (2022); Fowl et al. (2022); Wei et al. (2023).

One way to defend against mechanisms that intentionally sparsify gradients is
to make the gradients more condensed. Techniques rooted in in data compaction
to improve communication efficiency, such as sketching techniques Hu et al.
(2021), may reduce the transmission and exposure of outlier points.

Another potential strategy involves the implementation of model shuffling
techniques Girgis et al. (2021). This method compresses updates and
dynamically selects a client for communication. Even if an adversary
compromises a client, there remains a probability that the compromised client
may not be chosen, adding a layer of resilience against attacks. Furthermore,
the development of client trust strategies based on the quality of data and
model parameters proves to be a promising avenue for defense.

Lastly, while not directly a mitigation strategy, decentralized FL may
inadvertently provide defenses against the malicious threat model.
Decentralized FL may employ a peer-to-peer network for transmitting,
aggregating, and updating local models. Participants solely engage with their
immediate neighbors in the network. Notably, this architecture poses a
formidable challenge for attackers due to the absence of a centralized node
communicating with all clients, rendering it a promising defense strategy for
further investigation and implementation.

##  5 Acknowledgement

This manuscript has been co-authored by UT-Battelle, LLC, under contract DE-
AC05-00OR22725 with the US Department of Energy (DOE). The US government
retains and the publisher, by accepting the article for publication,
acknowledges that the US government retains a nonexclusive, paid-up,
irrevocable, worldwide license to publish or reproduce the published form of
this manuscript, or allow others to do so, for US government purposes. DOE
will provide public access to these results of federally sponsored research in
accordance with the DOE Public Access Plan (http://energy.gov/downloads/doe-
public-access-plan).

## References

  * Boenisch et al. [2023a] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot.  Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation, 2023.
  * Boenisch et al. [2023b] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot.  When the curious abandon honesty: Federated learning is not private.  IEEE, 2023.
  * Bonawitz et al. [2016] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth.  Practical secure aggregation for federated learning on user-held data.  arXiv preprint arXiv:1611.04482, 2016.
  * Bonawitz et al. [2019] Keith Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloe Kiddon, Jakub Konečnỳ, Stefano Mazzocchi, Brendan McMahan, et al.  Towards federated learning at scale: System design.  Proceedings of machine learning and systems, 1:374–388, 2019.
  * Chatzikokolakis et al. [2013] Konstantinos Chatzikokolakis, Miguel E Andrés, Nicolás Emilio Bordenabe, and Catuscia Palamidessi.  Broadening the scope of differential privacy using metrics.  In Privacy Enhancing Technologies: 13th International Symposium, PETS 2013, Bloomington, IN, USA, July 10-12, 2013. Proceedings 13, pages 82–102. Springer, 2013.
  * Chen and Campbell [2021] Cangxiong Chen and Neill DF Campbell.  Understanding training-data leakage from gradients in neural networks for image classification.  arXiv preprint arXiv:2111.10178, 2021.
  * Enthoven and Al-Ars [2020] David Enthoven and Zaid Al-Ars.  An overview of federated deep learning privacy attacks and defensive strategies, 2020.
  * Fang et al. [2023] Hao Fang, Bin Chen, Xuan Wang, Zhi Wang, and Shu-Tao Xia.  Gifd: A generative gradient inversion method with feature domain optimization, 2023.
  * Fowl et al. [2021] Liam Fowl, Jonas Geiping, Wojtek Czaja, Micah Goldblum, and Tom Goldstein.  Robbing the fed: Directly obtaining private data in federated learning with modified models.  arXiv preprint arXiv:2110.13057, 2021.
  * Fowl et al. [2022] Liam Fowl, Jonas Geiping, Steven Reich, Yuxin Wen, Wojtek Czaja, Micah Goldblum, and Tom Goldstein.  Decepticons: Corrupted transformers breach privacy in federated learning for language models.  arXiv preprint arXiv:2201.12675, 2022.
  * Geiping et al. [2020] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting gradients-how easy is it to break privacy in federated learning?  Advances in Neural Information Processing Systems, 33:16937–16947, 2020.
  * Girgis et al. [2021] Antonious Girgis, Deepesh Data, Suhas Diggavi, Peter Kairouz, and Ananda Theertha Suresh.  Shuffled model of differential privacy in federated learning.  In International Conference on Artificial Intelligence and Statistics, pages 2521–2529. PMLR, 2021.
  * Gupta et al. [2022] Samyak Gupta, Yangsibo Huang, Zexuan Zhong, Tianyu Gao, Kai Li, and Danqi Chen.  Recovering private text in federated learning of language models.  Advances in Neural Information Processing Systems, 35:8130–8143, 2022.
  * Haddadpour et al. [2020] Farzin Haddadpour, Mohammad Mahdi Kamani, Aryan Mokhtari, and Mehrdad Mahdavi.  Federated learning with compression: Unified analysis and sharp guarantees, 2020.
  * Hatamizadeh et al. [2023] Ali Hatamizadeh, Hongxu Yin, Pavlo Molchanov, Andriy Myronenko, Wenqi Li, Prerna Dogra, Andrew Feng, Mona G Flores, Jan Kautz, Daguang Xu, and Holger R. Roth.  Do gradient inversion attacks make federated learning unsafe?  IEEE Transactions on Medical Imaging, 42(7):2044–2056, 2023.
  * Hitaj et al. [2017] Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz.  Deep models under the gan: Information leakage from collaborative deep learning, 2017.
  * Hu et al. [2021] Changhui Hu, Jin Li, Zheli Liu, Xiaojie Guo, Yu Wei, Xuan Guang, Grigorios Loukides, and Changyu Dong.  How to make private distributed cardinality estimation practical, and get differential privacy for free.  In 30th USENIX security symposium (USENIX Security 21), pages 965–982, 2021.
  * Huang et al. [2021a] Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora.  Evaluating gradient inversion attacks and defenses in federated learning.  Advances in Neural Information Processing Systems, 34:7232–7241, 2021.
  * Huang et al. [2021b] Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora.  Instahide: Instance-hiding schemes for private distributed learning, 2021.
  * Jeon et al. [2021] Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al.  Gradient inversion with generative image prior.  Advances in neural information processing systems, 34, 2021.
  * Jin et al. [2021] Xiao Jin, Pin-Yu Chen, Chia-Yi Hsu, Chia-Mu Yu, and Tianyi Chen.  Cafe: Catastrophic data leakage in vertical federated learning.  Advances in Neural Information Processing Systems, 34:994–1006, 2021.
  * Jin et al. [2023] Weizhao Jin, Yuhang Yao, Shanshan Han, Carlee Joe-Wong, Srivatsan Ravi, Salman Avestimehr, and Chaoyang He.  Fedml-he: An efficient homomorphic-encryption-based privacy-preserving federated learning system, 2023.
  * Kariyappa et al. [2022] Sanjay Kariyappa, Chuan Guo, Kiwan Maeng, Wenjie Xiong, G. Edward Suh, Moinuddin K Qureshi, and Hsien-Hsin S. Lee.  Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis, 2022.
  * Kifer and Machanavajjhala [2014] Daniel Kifer and Ashwin Machanavajjhala.  Pufferfish: A framework for mathematical privacy definitions.  ACM Transactions on Database Systems (TODS), 39(1):1–36, 2014.
  * Konečnỳ et al. [2015] Jakub Konečnỳ, Brendan McMahan, and Daniel Ramage.  Federated optimization: Distributed optimization beyond the datacenter.  arXiv preprint arXiv:1511.03575, 2015.
  * Lam et al. [2021] Maximilian Lam, Gu-Yeon Wei, David Brooks, Vijay Janapa Reddi, and Michael Mitzenmacher.  Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix.  In International Conference on Machine Learning, pages 5959–5968. PMLR, 2021.
  * Li et al. [2023] Shenghui Li, Edith C.-H. Ngai, and Thiemo Voigt.  An experimental study of byzantine-robust aggregation schemes in federated learning.  IEEE Transactions on Big Data, page 1–13, 2023.
  * Lu et al. [2021] Jiahao Lu, Xi Sheryl Zhang, Tianli Zhao, Xiangyu He, and Jian Cheng.  April: Finding the achilles’ heel on privacy for vision transformers, 2021.
  * McMahan et al. [2017] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017.
  * Mo et al. [2021] Fan Mo, Anastasia Borovykh, Mohammad Malekzadeh, Hamed Haddadi, and Soteris Demetriou.  Layer-wise characterization of latent information leakage in federated learning, 2021.
  * Papadopoulos et al. [2023] Georgios Papadopoulos, Yash Satsangi, Shaltiel Eloul, and Marco Pistoia.  Absolute variation distance: an inversion attack evaluation metric for federated learning.  In International Workshop on Federated Learning in the Age of Foundation Models in Conjunction with NeurIPS 2023, 2023.
  * Pasquini et al. [2022] Dario Pasquini, Danilo Francati, and Giuseppe Ateniese.  Eluding secure aggregation in federated learning via model inconsistency.  In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2429–2443, 2022.
  * Singh et al. [2023] Abhishek Singh, Praneeth Vepakomma, Vivek Sharma, and Ramesh Raskar.  Posthoc privacy guarantees for collaborative inference with modified propose-test-release.  In Thirty-seventh Conference on Neural Information Processing Systems, 2023.
  * Wainakh et al. [2022] Aidmar Wainakh, Ephraim Zimmer, Sandeep Subedi, Jens Keim, Tim Grube, Shankar Karuppayah, Alejandro Sanchez Guinea, and Max Mühlhäuser.  Federated learning attacks revisited: A critical discussion of gaps, assumptions, and evaluation setups.  Sensors, 23(1):31, 2022.
  * Wang et al. [2004] Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli.  Image quality assessment: from error visibility to structural similarity.  IEEE Transactions on Image Processing, 13(4):600–612, 2004.
  * [36] Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H. Yang, Farokhi Farhad, Shi Jin, Tony Q. S. Quek, and H. Vincent Poor.  Federated learning with differential privacy: Algorithms and performance analysis.
  * Wei et al. [2020] Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu.  A framework for evaluating gradient leakage attacks in federated learning.  arXiv preprint arXiv:2004.10397, 2020.
  * Wei et al. [2023] Jiaheng Wei, Yanjun Zhang, Leo Yu Zhang, Chao Chen, Shirui Pan, Kok-Leong Ong, Jun Zhang, and Yang Xiang.  Client-side gradient inversion against federated learning from poisoning.  arXiv preprint arXiv:2309.07415, 2023.
  * Wen et al. [2022] Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein.  Fishing for user data in large-batch federated learning via gradient magnification.  arXiv preprint arXiv:2202.00580, 2022.
  * Wu et al. [2023] Ruihan Wu, Xiangyu Chen, Chuan Guo, and Kilian Q. Weinberger.  Learning to invert: Simple adaptive attacks for gradient inversion in federated learning, 2023.
  * Xu et al. [2020] Yilun Xu, Shengjia Zhao, Jiaming Song, Russell Stewart, and Stefano Ermon.  A theory of usable information under computational constraints.  In International Conference on Learning Representations, 2020.
  * Yin et al. [2021] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov.  See through gradients: Image batch recovery via gradinversion.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16337–16346, 2021.
  * Yue et al. [2023] Kai Yue, Richeng Jin, Chau-Wai Wong, Dror Baron, and Huaiyu Dai.  Gradient obfuscation gives a false sense of security in federated learning.  In 32nd USENIX Security Symposium, 2023.
  * Zhang et al. [2018] Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang.  The unreasonable effectiveness of deep features as a perceptual metric.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2018.
  * Zhang et al. [2022] Rui Zhang, Song Guo, Junxiao Wang, Xin Xie, and Dacheng Tao.  A survey on gradient inversion: Attacks, defenses and future directions.  arXiv preprint arXiv:2206.07284, 2022.
  * Zhao et al. [2020] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  idlg: Improved deep leakage from gradients.  arXiv preprint arXiv:2001.02610, 2020.
  * Zhu and Blaschko [2021] Junyi Zhu and Matthew Blaschko.  R-gap: Recursive gradient attack on privacy, 2021.
  * Zhu et al. [2019] Ligeng Zhu, Zhijian Liu, and Song Han.  Deep leakage from gradients.  Advances in neural information processing systems, 32, 2019.