Mitigating Data Reconstruction Attacks in Federated Learning: Conditions, Bounds, and Theoretical Guarantees

Xiaojin Zhang; Mingcong Xu; Wei Chen; Qiang Yang

cs.CRJul 23, 2024

Mitigating Data Reconstruction Attacks in Federated Learning: Conditions, Bounds, and Theoretical Guarantees

Authors: Xiaojin Zhang, Mingcong Xu, Wei Chen, Qiang Yang

Organizations: Huazhong University of Science and Technology

Abstract

Privacy attacks, particularly data reconstruction attacks, pose significant challenges to federated learning despite its promise in privacy-preserving collaborative training. This paper presents a comprehensive theoretical analysis of privacy leakage in federated learning through dual perspectives: linear algebra and optimization theory. By analyzing the client-update Jacobian, we identify conditions under which distinct data batches produce the same model update and derive a sufficient batch-size criterion for non-unique reconstruction. Through optimization theory, we establish a novel upper bound for privacy leakage that incorporates batch size, distortion extent, and other critical parameters. These theoretical insights elucidate the fundamental relationships between system parameters and privacy vulnerability, laying the groundwork for developing more robust privacy-preserving federated learning frameworks.

Figures & tables

Notation	Description
$K$	Number of clients
$\mathcal{D}^{k}$	Local dataset of client $k$
$n^{k}$	Number of data samples in $\mathcal{D}^{k}$
$\mathbf{x}_{i}^{k},y_{i}^{k}$	The $i$ -th data sample and label of client $k$
$\theta_{t}$	Global model at round $t$
$\theta_{t}^{k}$	Local model of client $k$ at round $t$

Table 1: Notation Table

Batchsize	Val Acc (U $\uparrow$ )	Test Acc (U $\uparrow$ )	Stage	Test MSE (P $\uparrow$ )	PSNR (P $\downarrow$ )	SSIM (P $\downarrow$ )	LPIPS (P $\uparrow$ )	KL (P $\uparrow$ )
8	$0.9805\pm 0.0022$	$0.9751\pm 0.0027$	E1	$1.2935\pm 0.0214$	$9.2315\pm 0.0842$	$0.0985\pm 0.0042$	$0.5888\pm 0.0124$	$3.6115\pm 0.0452$
16	$0.9772\pm 0.0018$	$0.9723\pm 0.0025$	E1	$1.0195\pm 0.0185$	$10.451\pm 0.0765$	$0.1115\pm 0.0038$	$0.6294\pm 0.0105$	$2.8761\pm 0.0384$
32	$0.9791\pm 0.0015$	$0.9719\pm 0.0021$	E1	$1.1055\pm 0.0152$	$9.9382\pm 0.0654$	$0.0871\pm 0.0031$	$0.6438\pm 0.0092$	$3.4585\pm 0.0321$
64	$0.9748\pm 0.0012$	$0.9692\pm 0.0018$	E1	$1.2405\pm 0.0121$	$9.4025\pm 0.0512$	$0.0605\pm 0.0025$	$0.6795\pm 0.0075$	$3.6468\pm 0.0285$
128	$0.9701\pm 0.0010$	$0.9615\pm 0.0015$	E1	$1.2815\pm 0.0095$	$9.2652\pm 0.0423$	$0.0535\pm 0.0018$	$0.6792\pm 0.0061$	$3.6515\pm 0.0214$

Table 2: Performance of FedSGD under different batchsize on the MNIST dataset. Metrics are grouped into utility ( U ) and privacy ( P ) categories. Gradient leakage attacks are launched at epochs E1. Arrows indicate desired direction:

\uparrow

= higher is better,

\downarrow

= lower is better.

Batchsize	Val Acc (U $\uparrow$ )	Test Acc (U $\uparrow$ )	Stage	Test MSE (P $\uparrow$ )	PSNR (P $\downarrow$ )	SSIM (P $\downarrow$ )	LPIPS (P $\uparrow$ )	KL (P $\uparrow$ )
8	$0.8562\pm 0.0042$	$0.8431\pm 0.0051$	E1	$1.4018\pm 0.0312$	$8.1275\pm 0.184$	$0.1472\pm 0.012$	$0.5521\pm 0.024$	$2.1035\pm 0.082$
16	$0.8654\pm 0.0035$	$0.8535\pm 0.0048$	E1	$0.9795\pm 0.0245$	$9.4218\pm 0.156$	$0.2255\pm 0.015$	$0.5005\pm 0.018$	$2.9648\pm 0.095$
32	$0.8741\pm 0.0058$	$0.8631\pm 0.0062$	E1	$1.0872\pm 0.0412$	$8.9392\pm 0.213$	$0.1932\pm 0.018$	$0.4938\pm 0.021$	$2.1225\pm 0.114$
64	$0.8674\pm 0.0028$	$0.8565\pm 0.0031$	E1	$1.1055\pm 0.0185$	$8.8122\pm 0.095$	$0.1305\pm 0.008$	$0.5845\pm 0.012$	$2.0441\pm 0.063$
128	$0.8621\pm 0.0045$	$0.8428\pm 0.0054$	E1	$0.9651\pm 0.0352$	$9.5112\pm 0.162$	$0.1535\pm 0.014$	$0.5621\pm 0.019$	$2.2931\pm 0.088$

Table 3: Performance of FedSGD under different batchsize on the FMNIST dataset. Metrics are grouped into utility ( U ) and privacy ( P ) categories. Gradient leakage attacks are launched at epochs E1. Arrows indicate desired direction:

\uparrow

= higher is better,

\downarrow

= lower is better.

Batchsize	Val Acc (U $\uparrow$ )	Test Acc (U $\uparrow$ )	Stage	Test MSE (P $\uparrow$ )	PSNR (P $\downarrow$ )	SSIM (P $\downarrow$ )	LPIPS (P $\uparrow$ )	KL (P $\uparrow$ )
8	$0.6713\pm 0.0054$	$0.6842\pm 0.0068$	E1	$1.8398\pm 0.0421$	$9.5305\pm 0.213$	$0.0241\pm 0.003$	$0.6822\pm 0.015$	$3.8315\pm 0.104$
16	$0.7045\pm 0.0031$	$0.7155\pm 0.0039$	E1	$2.0312\pm 0.0285$	$9.0335\pm 0.142$	$0.0265\pm 0.002$	$0.7052\pm 0.011$	$3.5421\pm 0.087$
32	$0.6771\pm 0.0042$	$0.6848\pm 0.0045$	E1	$1.9692\pm 0.0354$	$9.2481\pm 0.165$	$0.0304\pm 0.004$	$0.7312\pm 0.014$	$3.4412\pm 0.092$
64	$0.6882\pm 0.0037$	$0.6985\pm 0.0041$	E1	$1.9885\pm 0.0312$	$9.1955\pm 0.151$	$0.1552\pm 0.008$	$0.7428\pm 0.012$	$3.0292\pm 0.076$
128	$0.6125\pm 0.0061$	$0.6155\pm 0.0072$	E1	$2.0912\pm 0.0514$	$9.0182\pm 0.194$	$0.0382\pm 0.005$	$0.7108\pm 0.018$	$3.1105\pm 0.112$

Table 4: Performance of FedSGD under different batchsize on the CIFAR-10 dataset. Metrics are grouped into utility ( U ) and privacy ( P ) categories. Gradient leakage attacks are launched at epochs E1. Arrows indicate desired direction:

\uparrow

= higher is better,

\downarrow

= lower is better.

Panel of Figure 1 — Figure 1: Privacy-utility trade-off curves under different batch sizes. Blue line: test accuracy; red dashed line: privacy leakage measured by PSNR.

Batchsize	Val Acc (U $\uparrow$ )	Test Acc (U $\uparrow$ )	Stage	Test MSE (P $\uparrow$ )	PSNR (P $\downarrow$ )	SSIM (P $\downarrow$ )	LPIPS (P $\uparrow$ )	KL (P $\uparrow$ )
8	$0.2562\pm 0.0084$	$0.2471\pm 0.0092$	E1	$2.3295\pm 0.0712$	$7.9941\pm 0.284$	$0.0485\pm 0.005$	$0.7002\pm 0.024$	$3.0878\pm 0.142$
16	$0.2738\pm 0.0065$	$0.2567\pm 0.0071$	E1	$2.1285\pm 0.0452$	$8.4455\pm 0.192$	$0.0421\pm 0.004$	$0.7121\pm 0.018$	$3.2805\pm 0.115$
32	$0.3075\pm 0.0052$	$0.2963\pm 0.0068$	E1	$2.1705\pm 0.0518$	$8.2872\pm 0.215$	$0.0435\pm 0.004$	$0.6789\pm 0.021$	$3.5732\pm 0.108$
64	$0.2995\pm 0.0048$	$0.2915\pm 0.0055$	E1	$2.1768\pm 0.0384$	$8.3331\pm 0.156$	$0.0485\pm 0.003$	$0.7163\pm 0.015$	$2.8715\pm 0.094$
128	$0.2718\pm 0.0057$	$0.2608\pm 0.0062$	E1	$2.9821\pm 0.0625$	$6.8322\pm 0.231$	$0.0322\pm 0.005$	$0.7405\pm 0.019$	$3.5442\pm 0.126$

Table 5: Performance of FedSGD under different batchsize on the CIFAR-100 dataset. Metrics are grouped into utility ( U ) and privacy ( P ) categories. Gradient leakage attacks are launched at epochs E1. Arrows indicate desired direction:

\uparrow

= higher is better,

\downarrow

= lower is better.

Batchsize	Val Acc (U $\uparrow$ )	Test Acc (U $\uparrow$ )	Stage	Test MSE (P $\uparrow$ )	PSNR (P $\downarrow$ )	SSIM (P $\downarrow$ )	LPIPS (P $\uparrow$ )	KL (P $\uparrow$ )
8	$0.1315\pm 0.0072$	$0.1382\pm 0.0084$	E1	$2.8398\pm 0.0642$	$6.7412\pm 0.254$	$0.0255\pm 0.004$	$0.7451\pm 0.021$	$5.8205\pm 0.184$
16	$0.1564\pm 0.0051$	$0.1592\pm 0.0058$	E1	$1.9692\pm 0.0415$	$8.3065\pm 0.187$	$0.0325\pm 0.003$	$0.7235\pm 0.018$	$5.8421\pm 0.142$
32	$0.1815\pm 0.0065$	$0.1853\pm 0.0071$	E1	$2.1505\pm 0.0528$	$7.9851\pm 0.211$	$0.0281\pm 0.005$	$0.7638\pm 0.024$	$4.5872\pm 0.165$
64	$0.1548\pm 0.0048$	$0.1647\pm 0.0052$	E1	$2.1715\pm 0.0384$	$7.9352\pm 0.156$	$0.0185\pm 0.002$	$0.7441\pm 0.015$	$5.5871\pm 0.128$
128	$0.1128\pm 0.0081$	$0.1242\pm 0.0093$	E1	$2.1732\pm 0.0712$	$7.9515\pm 0.234$	$0.0244\pm 0.006$	$0.7642\pm 0.028$	$4.9108\pm 0.201$

Table 6: Performance of FedSGD under different batchsize on the Tiny-imagenet dataset. Metrics are grouped into utility ( U ) and privacy ( P ) categories. Gradient leakage attacks are launched at epochs E1. Arrows indicate desired direction:

\uparrow

= higher is better,

\downarrow

= lower is better.

Panel of Figure 2 — Figure 2: CIFAR-100: Privacy–utility trade-off under different batch sizes. Test accuracy is shown as the utility metric, while PSNR/MSE/LPIPS quantify reconstruction quality (privacy leakage).

Panel of Figure 3 — Figure 3: Tiny-ImageNet: Privacy–utility trade-off under different batch sizes. The overall trend matches CIFAR-100: moderate batch sizes often yield better utility, while larger batch sizes generally lead to weaker gradient leakage.

Batch Size ( $B$ )	Accuracy (%) $\uparrow$	$C_{\mathrm{L1}}$ (%) $\downarrow$	Empty Sets (/60) $\uparrow$
1	$\mathbf{94.15}$	92.28	0
2	94.12	58.45	4
4	94.08	18.12	27
8	93.98	$\mathbf{1.05}$	$\mathbf{58}$

Table 7: Qwen3-1.7B-Base Layer-1 utility and reconstruction-relevant candidate information under different batch sizes on SST-2 without defense. Lower candidate-set coverage and more empty candidate sets indicate less information available for subsequent DAGER reconstruction.

B=1

B=2

B=4

B=8

Model

Dataset

Method

R-1

R-2

Utility

R-1

R-2

Utility

R-1

R-2

Utility

R-1

R-2

Utility

GPT-2

CoLA

TAG

7.0

\pm

2.5

0.54

\pm

0.54

32.5

\pm

1.8

8.0

\pm

2.0

1.4

\pm

1.3

35.1

\pm

1.5

7.8

\pm

1.2

0.8

\pm

0.5

34.2

\pm

1.6

5.3

\pm

0.7

0.4

\pm

0.2

36.8

\pm

1.4

LAMP

73.3

\pm

4.5

43.3

\pm

7.0

32.5

\pm

1.8

26.8

\pm

2.8

11.0

\pm

3.0

35.1

\pm

1.5

13.4

\pm

1.4

3.9

\pm

1.2

34.2

\pm

1.6

8.9

\pm

1.2

1.9

\pm

0.6

36.8

\pm

1.4

DAGER

100.0

\pm

0.0

100.0

\pm

0.0

32.5

\pm

1.8

100.0

\pm

0.0

100.0

\pm

0.0

35.1

\pm

1.5

100.0

\pm

0.0

100.0

\pm

0.0

34.2

\pm

1.6

100.0

\pm

0.0

100.0

\pm

0.0

36.8

\pm

1.4

SST-2

TAG

5.3

\pm

0.5

0.0

\pm

0.0

82.4

\pm

1.1

6.0

\pm

1.7

0.5

\pm

0.4

84.1

\pm

0.9

6.1

\pm

1.2

0.6

\pm

0.6

83.6

\pm

1.3

4.4

\pm

0.6

0.2

\pm

0.1

86.8

\pm

0.8

LAMP

62.2

\pm

6.9

31.8

\pm

8.4

82.4

\pm

1.1

21.4

\pm

3.1

9.2

\pm

3.1

84.1

\pm

0.9

9.8

\pm

2.0

2.7

\pm

1.3

83.6

\pm

1.3

8.1

\pm

1.1

0.7

\pm

0.4

86.8

\pm

0.8

Table 8: Comparison of sequence reconstruction performance and downstream utility under different batch sizes. R-1 and R-2 denote ROUGE-1 and ROUGE-2, respectively. For downstream utility, CoLA is evaluated using MCC (%), while SST-2 and RT are evaluated using classification accuracy (%).

B=16

B=32

B=64

B=128

Dataset

Model

R-1

R-2

Utility

R-1

R-2

Utility

R-1

R-2

Utility

R-1

R-2

Utility

CoLA

GPT-2

100.0

\pm

0.0

100.0

\pm

0.0

36.8

\pm

1.1

100.0

\pm

0.0

100.0

\pm

0.0

36.2

\pm

1.3

100.0

\pm

0.0

100.0

\pm

0.0

37.9

\pm

0.9

30.3

\pm

1.0

14.6

\pm

0.9

37.4

\pm

1.0

LLaMA-2 (7B)

100.0

\pm

0.0

100.0

\pm

0.0

39.2

\pm

0.8

100.0

\pm

0.0

100.0

\pm

0.0

40.5

\pm

0.7

99.9

\pm

0.1

99.9

\pm

0.1

39.8

\pm

0.9

99.5

\pm

0.2

99.3

\pm

0.3

41.2

\pm

0.6

SST-2

GPT-2

100.0

\pm

0.0

94.6

\pm

1.1

90.5

\pm

0.8

100.0

\pm

0.1

93.4

\pm

1.0

89.8

\pm

0.9

92.9

\pm

3.0

85.0

\pm

3.5

91.6

\pm

0.6

13.7

\pm

1.4

4.3

\pm

0.5

91.1

\pm

0.7

LLaMA-2 (7B)

100.0

\pm

0.0

100.0

\pm

0.0

95.1

\pm

0.5

99.9

\pm

0.1

99.9

\pm

0.1

94.6

\pm

0.6

99.9

\pm

0.1

99.9

\pm

0.1

95.8

\pm

0.4

98.2

\pm

0.4

97.8

\pm

0.4

95.3

\pm

0.5

GPT-2

100.0

\pm

0.0

99.9

\pm

0.1

84.5

\pm

0.9

98.0

\pm

1.7

97.8

\pm

1.8

83.9

\pm

1.0

2.8

\pm

1.1

\pm

0.4

85.4

\pm

0.7

0.0

\pm

0.0

\pm

0.0

84.8

\pm

0.8

Table 9: DAGER reconstruction performance and downstream model utility at large batch sizes on GPT-2 BASE and LLaMA-2 7B. CoLA utility is measured using MCC (%), while SST-2 and RT utility is measured using classification accuracy (%).

B=16

B=32

B=64

B=128

Model

R-1

R-2

Utility

R-1

R-2

Utility

R-1

R-2

Utility

R-1

R-2

Utility

GPT-2 BASE

100.0

\pm

0.0

99.9

\pm

0.1

84.2

\pm

0.5

98.0

\pm

1.7

97.8

\pm

1.8

85.1

\pm

0.4

2.8

\pm

1.1

\pm

0.4

85.8

\pm

0.4

0.0

\pm

0.0

\pm

0.0

86.2

\pm

0.3

GPT-2 FineTuned

100.0

\pm

0.0

99.8

\pm

0.1

86.5

\pm

0.4

96.4

\pm

2.3

96.0

\pm

2.5

87.2

\pm

0.4

0.84

\pm

0.6

0.2

\pm

0.1

87.8

\pm

0.3

0.0

\pm

0.0

\pm

0.0

88.0

\pm

0.3

GPT-2 NextToken

99.9

\pm

0.0

99.7

\pm

0.1

82.0

\pm

0.6

99.6

\pm

0.2

99.4

\pm

0.2

83.1

\pm

0.5

2.3

\pm

0.8

0.5

\pm

0.2

84.0

\pm

0.5

0.0

\pm

0.0

\pm

0.0

84.5

\pm

0.4

GPT-2 LARGE

100.0

\pm

0.0

99.8

\pm

0.1

87.1

\pm

0.3

100.0

\pm

0.0

99.9

\pm

0.1

88.0

\pm

0.3

44.1

\pm

4.2

38.1

\pm

4.7

88.7

\pm

0.3

0.0

\pm

0.0

\pm

0.0

89.1

\pm

0.2

Table 10: Effect of batch size on DAGER reconstruction across different GPT-2 model and training configurations on Rotten Tomatoes. Utility denotes downstream classification accuracy (%).

Batch Size ( $B$ )	Token Recovery $\downarrow$	R1+R2 $\downarrow$	Accuracy $\uparrow$	Macro-F1 $\uparrow$
1	$1.0000\pm 0.0000$	$193.67\pm 1.15$	$0.9121\pm 0.0018$	$0.9120\pm 0.0018$
2	$0.8845\pm 0.0125$	$162.30\pm 3.15$	$0.9124\pm 0.0016$	$0.9123\pm 0.0016$
4	$0.6520\pm 0.0210$	$110.85\pm 5.42$	$0.9128\pm 0.0015$	$0.9127\pm 0.0015$
8	$\mathbf{0.3815\pm 0.0284}$	$\mathbf{54.20\pm 4.10}$	$\mathbf{0.9132\pm 0.0012}$	$\mathbf{0.9131\pm 0.0012}$

Table 11: Impact of batch size on PEFTLeak-style text reconstruction and downstream utility under undefended PEFT updates on SST-2 using GPT-2. Lower Token Recovery and R1+R2 indicate weaker privacy leakage.

Batch Size $B$	8	16	32	48	64
Patches Recovered (%) $\downarrow$	90.0	84.7	73.2	66.5	62.6
Utility (Acc %) $\uparrow$	78.4 $\pm$ 0.8	79.6 $\pm$ 0.6	80.3 $\pm$ 0.5	79.9 $\pm$ 0.7	80.8 $\pm$ 0.4

Table 12: Patch reconstruction performance and downstream top-1 accuracy of PEFTLeak under different batch sizes on ImageNet using ViT-B/16. Each

224\times 224

image contains 196 patches.

		Enron Emails						PersonaChat						SQuAD v2
		$b=2$		$b=16$		$b=128$		$b=2$		$b=16$		$b=128$		$b=2$		$b=16$		$b=128$
PEFT	Attack	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility
Full-FT	Phish	10.12	71.5	10.66	76.8	10.89	76.1	9.13	63.8	9.36	68.5	9.38	68.1	4.26	74.3	4.18	79.6	4.24	79.0
Full-FT	ReCIT	54.53	70.8	41.21	76.1	30.07	75.4	49.58	63.1	35.79	67.8	27.43	67.4	47.23	73.6	33.84	78.9	23.54	78.3
LoRA	Phish	7.91	70.8	7.36	76.0	7.45	75.3	7.31	63.0	6.96	67.6	7.65	67.2	2.91	73.5	2.76	78.8	2.85	78.1
LoRA	ReCIT	48.27	70.1	35.87	75.4	29.42	74.7	44.21	62.4	33.85	67.1	26.62	66.7	45.71	72.8	33.16	78.1	25.21	77.5

Table 13: PII extraction rate (

R_{\mathrm{PII}}

, %

\downarrow

) and downstream task performance (Utility, %

\uparrow

) under different batch sizes, fine-tuning mechanisms, and privacy attacks. Utility denotes classification accuracy for Enron Emails, dialogue-response F1 for PersonaChat, and the average of exact match and F1 for SQuAD v2.

	$b=2$						$b=16$
	$\sigma=0$		$\sigma=10^{-5}$		$\sigma=10^{-4}$		$\sigma=0$		$\sigma=10^{-5}$		$\sigma=10^{-4}$
Attack	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility	$R_{\mathrm{PII}}$	Utility
Phish	2.91	73.5	2.53	68.2	1.92	64.1	2.76	78.8	2.37	74.5	1.84	70.3
ReCIT	45.71	72.8	28.53	67.6	24.86	63.5	29.41	78.1	17.43	73.9	11.23	69.8

Table 14: PII extraction rate (

R_{\mathrm{PII}}

, %

\downarrow

) and downstream utility (%

\uparrow

) under different batch sizes and Gaussian gradient-noise levels on SQuAD v2 using Bloomz-3B with LoRA.

	CoLA			SST-2			RT
Gradient Exposure	$B=1$	$B=2$	$B=4$	$B=1$	$B=2$	$B=4$	$B=1$	$B=2$	$B=4$
LAMP ( $\Delta W_{\mathrm{all}}$ )	80.0	58.9	43.8	85.6	69.8	59.5	34.6	22.7	19.0
$\Delta W_{T}$	80.4	66.3	46.5	87.1	71.8	57.7	35.9	25.4	19.6
$\Delta W_{t,1}$	58.7	48.6	38.9	82.1	54.5	42.2	34.8	20.2	19.0
$\Delta W_{q,1}$	65.0	40.7	35.9	79.7	55.8	40.1	36.7	23.0	20.2
$\Delta W_{o,1}$	57.0	41.8	33.9	73.9	50.9	47.5	25.5	21.3	17.7

Table 15: ROUGE-L reconstruction performance (R-L, %

\uparrow

) under different batch sizes and gradient-exposure settings using BERT BASE . LAMP with

\Delta W_{\mathrm{all}}

denotes the full-gradient baseline, while the remaining settings correspond to partial-gradient exposure. Utility denotes downstream classification accuracy (%

\uparrow

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 921 papers

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
Sep 9, 2026Saeed Shariati, Mohsen Alambardar MeybodiGradient Inversion Attacks Federated Learning
Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
Sep 8, 2026Wenrui Yu, Changlong Ji, Johannes Bjerva +1Federated Learning Aggregation Secure Aggregation
Aalborg University Copenhagen, Denmark · Institut Polytechnique de Paris Paris, France
No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning
Apr 16, 2026Francesco Diana, Chuan Xu, André Nusser +1Gradient Inversion Attacks Adversarial Attacks
Université Côte d’Azur, France · Inria, France · CNRS, France +1

Sep 9, 2026J/K move · Enter open · S save

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

Saeed Shariati, Mohsen Alambardar Meybodi

Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran

Gradient Inversion Attacks Federated Learning Training Data Reconstruction Attacks

Open paper AskPDF arXiv

Federated learning shares model updates rather than raw data, yet these updates can be inverted to reconstruct the clients' training data. Analytic reconstruction attacks, which invert a gradient in closed form, degrade as the batch grows: prior single-round attacks recover only about half of a batch of size

100

even when the attacker fully controls the network parameters, and known upper bounds limit what any such method can recover. We establish a connection between gradient inversion and the theory of erasure-correcting codes, and use it to construct attacks that exceed these bounds. Our attacks recover batches exactly, together with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks they outperform prior single-round attacks by a wide margin. Even a passive attacker who only observes an honestly trained network recovers

94

100\%

of ImageNet batches at sizes up to

128

, more than prior single-round attacks achieve even with active manipulation of the model, and in the active setting more than

90\%

is recovered at batch sizes of several hundred. These results show that the privacy leakage of federated learning has been underestimated.

Abstract

Federated Learning

Explore similar work

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning

No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning