Practical Feasibility of Gradient Inversion Attacks in Federated Learning

Viktor Valadi; Lucas Beerens; Mattias Åkesson; Johan Östman; Fazeleh Hoseini; Salman Toor; Andreas Hellander

cs.CRAug 27, 2025

Practical Feasibility of Gradient Inversion Attacks in Federated Learning

Authors: Viktor Valadi, Lucas Beerens, Mattias Åkesson, Johan Östman, Fazeleh Hoseini, Salman Toor, Andreas Hellander

Organizations: Scaleout Systems Sweden · Recorded Future Sweden · AI Sweden Sweden · Scaleout Systems Uppsala University Sweden

Abstract

Gradient inversion attacks are often presented as a serious privacy threat in federated learning, with recent work reporting increasingly strong reconstructions under favorable experimental settings. However, it remains unclear whether such attacks are feasible in modern, performance-optimized systems deployed in practice. In this work, we evaluate the practical feasibility of gradient inversion for image-based federated learning. We conduct a systematic study across multiple datasets and tasks, including image classification and object detection, using canonical vision architectures at contemporary resolutions. Our results show that while gradient inversion remains possible for certain legacy or transitional designs under highly restrictive assumptions, modern, performance-optimized models consistently resist meaningful reconstruction visually. We further demonstrate that many reported successes rely on upper-bound settings, such as inference mode operation or architectural simplifications which do not reflect realistic training pipelines. Taken together, our findings indicate that, under an honest-but-curious server assumption, high-fidelity image reconstruction via gradient inversion does not constitute a critical privacy risk in production-optimized federated learning systems, and that practical risk assessments must carefully distinguish diagnostic attack settings from real-world deployments.

Figures & tables

	Pre-activation ResNet18		Post-activation ResNet18
	Original	Reconstruction	Original	Reconstruction
Ours (shared)
	SSIM=0.054 SSIM=0.041
Ours (no shared)
	SSIM=0.040 SSIM=0.024
Prior methods

Fig. 1 : Validation of gradient inversion under training-mode BatchNorm (SSIM

\uparrow

). Columns compare pre-activation and post-activation ResNet18 architectures, while rows vary the reference statistics used to guide the reconstruction: exact batch statistics recovered from shared running statistics (Equation 6 ), proxy statistics estimated from auxiliary data when running statistics are withheld (Equation 7 ), and the running-statistic reference used by prior training-mode methods (Equation 4 ). The post-activation version of the model consistently resists the GIA which highlights a strong architectural dependence of attack feasibility.

Panel of Figure 2 — Fig. 2 : Feasibility probe on object detectors (gradient-matching objective, $n{=}10$ noise draws, $K{=}10$ smooth directions): fraction of draws in which a random step beats the step toward the target along the noise $\rightarrow$ target path; the legend gives $\nu$ (lower is more target-specific). (a) In inference mode, the ordering YOLOv8-nano $<$ RetinaNet $<$ DETR matches the full-attack outcomes in Fig. 3 . (b) In training mode, all three detectors are non-specific.

Panel of Figure 3 — Fig. 3 : Gradient inversion on object detectors with inference-mode client updates. Only YOLOv8-nano yields faint but visible structure, and only under this unrealistic setting; RetinaNet and DETR collapse to noise. None of the three is reconstructable under training-mode updates (Fig. 2 ).

Panel of Figure 4 — Fig. 4 : Controlled initialization on CIFAR-10 (LPIPS $\downarrow$ ). Each row initializes the attack from the target corrupted by increasing noise (factor $0.0$ = target, $1.0$ = pure noise; top row shows the starting points) and optimizes to convergence. Resistant architectures (ViT-B/16, MaxViT-T, ConvNeXt-T) recover semantic content only when the initialization is already close to the target, whereas Swin-T and SwinV2-T reconstruct accurately from any start.

Fig. 5 : Feasibility probe on the CIFAR-10 adapted models of Fig. 4 (gradient-matching objective, $n{=}10$ noise draws): fraction of draws in which the best of $K{=}10$ random smooth steps lowers the objective more than the step toward the target, with the mean over $\alpha\in[0,0.9]$ in the legend. Only MaxViT-T is non-specific along most of the path.

Panel of Figure 6 — Fig. 6 : Gradient inversion feasibility across modern ImageNet architectures in their canonical setting (SSIM $\uparrow$ ). Reconstructions for a range of modern vision architectures, trained and evaluated on ImageNet at 224×224 resolution. Despite favorable conditions and extensive optimization, only Swin-T yields partial reconstructions with recognizable structure. The remaining architectures either collapse to unstructured noise or, at best, recover weak global color statistics without semantic content, illustrating that modern, performance-optimized architectures largely resist practical gradient inversion.

Panel of Figure 7 — Fig. 7 : Gradient inversion on Swin-T with batch size two (SSIM $\uparrow$ ). Increasing the batch size from one to two is sufficient to cause reconstruction quality to collapse almost entirely to noise, illustrating the sensitivity of gradient inversion attacks to even minimal increases in inversion complexity.

Regime	Models	Configuration	Mode	Key factor	Feasible
Modern classifiers	Swin-T	Canonical, ImageNet	Training	Pre-norm LayerNorm	✓
	Swin-T	Canonical, ImageNet, $B{=}2$	Training	Second sample in batch	✗
	SwinV2-T	Canonical, ImageNet	Training	Post-norm LayerNorm	✗
	ViT-B/16, MaxViT-T, ConvNeXt-T	Canonical, ImageNet	Training	–	✗
	Swin-T, SwinV2-T	Adapted, CIFAR-10	Training	Reduced stem downsampling	✓
	ViT-B/16, MaxViT-T, ConvNeXt-T	Adapted, CIFAR-10	Training	Resist despite adapted stem	✗

TABLE I: Gradient inversion feasibility across architectural and procedural regimes. ✓ indicates meaningful reconstruction; ✗ indicates failure across all evaluated settings, repeated runs, and hyperparameter search (Appendix A ). Key factor gives the design or procedural choice distinguishing a row from its neighbours. Feasibility requires a legacy design, a resolution-adapted stem, or inference-mode client updates; among canonical modern models under training-mode updates, only Swin-T at batch size one shows partial leakage.

Explore similar work

No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning
Apr 16, 2026Francesco Diana, Chuan Xu, André Nusser +1Gradient-Based Attacks Federated Learning
Université Côte d’Azur, France · Inria, France · CNRS, France +1
Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
Sep 10, 2026Saeed Shariati, Mohsen Alambardar MeybodiFederated Learning Gradient-Based Attacks
Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran
Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning
May 31, 2026Ivo Osterberg Nilsson, Maximilian Birr Engvall, Viktor Valadi +1Federated Learning Gradient-Based Attacks
Department of Computing, Jönköping University, Jönköping, Sweden · Scaleout Systems, Uppsala, Sweden · Department of Information Systems, University of Haifa, Haifa, Israel

Apr 16, 2026, cs.LGJ/K move · Enter open · S save

No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning

Francesco Diana, Chuan Xu, André Nusser, Giovanni Neglia

Université Côte d’Azur, France · Inria, France · CNRS, France+1

Gradient-Based Attacks Federated Learning Reconstruction Fidelity Systemverilog Assertions

Open paper AskPDF arXiv

Gradient inversion attacks threaten client privacy in federated learning by reconstructing training samples from clients' shared gradients. Gradients aggregate contributions from multiple records and existing attacks may fail to disentangle them, yielding incorrect reconstructions with no intrinsic way to certify success. In vision and language, attackers may fall back on human inspection to judge reconstruction plausibility, but this is far less feasible for numerical tabular records, fueling the impression that tabular data is less vulnerable. We challenge this perception by proposing a verifiable gradient inversion attack (VGIA) that provides an explicit certificate of correctness for reconstructed samples. Our method adopts a geometric view of ReLU leakage: the activation boundary of a fully connected layer defines a hyperplane in input space. VGIA introduces an algebraic, subspace-based verification test that detects when a hyperplane-delimited region contains exactly one record. Once isolation is certified, VGIA recovers the corresponding feature vector analytically and reconstructs the target via a lightweight optimization step. Experiments on tabular benchmarks with large batch sizes demonstrate exact record and target recovery in regimes where existing state-of-the-art attacks either fail or cannot assess reconstruction fidelity. Compared to prior geometric approaches, VGIA allocates hyperplane queries more effectively, yielding faster reconstructions with fewer attack rounds.

Abstract

Explore similar work

No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning