ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery

Zirui Gong; Leo Yu Zhang; Yanjun Zhang; Viet Vo; Tianqing Zhu; Shirui Pan; Cong Wang

cs.LGMar 18, 2026

ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery

Authors: Zirui Gong, Leo Yu Zhang, Yanjun Zhang, Viet Vo, Tianqing Zhu, Shirui Pan, Cong Wang

Organizations: Griffith University · Swinburne University of Technology · City University of Macau · City University of Hong Kong

Abstract

Federated Learning (FL) enables collaborative model training by sharing model updates instead of raw data, aiming to protect user privacy. However, recent studies reveal that these shared updates can inadvertently leak sensitive training data through gradient inversion attacks (GIAs). Among them, active GIAs are particularly powerful, enabling high-fidelity reconstruction of individual samples even under large batch sizes. Nevertheless, existing approaches often require architectural modifications, which limit their practical applicability. In this work, we bridge this gap by introducing the Activation REcovery via Sparse inversion (ARES) attack, an active GIA designed to reconstruct training samples from large training batches without requiring architectural modifications. Specifically, we formulate the recovery problem as a noisy sparse recovery task and solve it using the generalized Least Absolute Shrinkage and Selection Operator (Lasso). To extend the attack to multi-sample recovery, ARES incorporates the imprint method to disentangle activations, enabling scalable per-sample reconstruction. We further establish the expected recovery rate and derive an upper bound on the reconstruction error, providing theoretical guarantees for the ARES attack. Extensive experiments on CNNs and MLPs demonstrate that ARES achieves high-fidelity reconstruction across diverse datasets, significantly outperforming prior GIAs under large batch sizes and realistic FL settings. Our results highlight that intermediate activations pose a serious and underestimated privacy risk in FL, underscoring the urgent need for stronger defenses.

Figures & tables

Panel of Table 1 — TABLE I: Comparison of different GIAs. ⚫ supported; ❍ not supported; partially supported.

Fig. 1: Recovery results obtained using activation matching (optimizing activation discrepancy) and pseudoinverse (approximating inverse).

Fig. 2: Overview of ARES attack. The method consists of two main stages: (a) the attacker initializes network with malicious parameters to facilitate information leakage; (b) using gradients returned by the client, the attacker first recovers activations through linear layer leakage and then reconstructs input samples via noisy sparse recovery.

Fig. 3: Top: forward pass through the network. Bottom: sparse vector recovery via $\ell_{1}$ optimization. The bias term is omitted for clarity.

Fig. 4: Upper bound of the squared recovery error with varying numbers of convolutional layers.

Fig. 5: Bias values are set to divide the projected inputs into $k$ equal-probability bins.

Fig. 6: Expected recovery rate with different numbers of output neurons (

k

) and batch size (

N

Fig. 7: Recovery rate comparison in CNN.

Dataset	Batch	iDLG	IG	GI	FedLeak	Finshing ∗	RtF	TW	ARES (Ours)
MNIST	32	9.39	9.96	11.17	21.57	12.40	17.53	13.89	105.29
	64	9.27	9.88	10.94	21.12	12.58	16.68	13.02	94.16
	256	✗	✗	✗	✗	12.40	13.08	11.87	42.42
CIFAR-10	32	9.51	11.28	10.59	21.33	12.08	17.35	13.55	92.27
	64	8.52	✗	10.01	17.20	12.36	17.20	13.03	90.47
	256	✗	✗	✗	✗	12.36	15.08	13.51	37.08

TABLE II: PSNR comparison of state-of-the-art attacks versus our ARES across different batch sizes and datasets. For each row, the best-performing attack is highlighted in bold. ✗ indicates that the attack fails to get visually meaningful images.

Fig. 8: Recovery rate comparison in MLP.

Fig. 9: Expected vs. empirical recovery rates.

Fig. 10: Our attack under gradient quantization defense.

Fig. 11: Our attack under gradient sparsification defense.

Fig. 12: Our attack under differential privacy noise.

Fig. 13: PSNR of LOKI and ours under secure aggregation-based defenses. The radial axis is log-scaled for better visualization.

Global batch size	32	64	128	256
Scale-MIA	28.52	28.53	28.26	27.06
ARES	92.27	90.47	85.01	37.08

TABLE III: PSNR comparison of Scale-MIA and ARES on CIFAR-10 dataset in CNN.

Fig. 14: Our attack on the Wikitext dataset.

Fig. 15: Our attack on non-iid data with label skew.

Fig. 16: Our attack on non-iid data with feature skew.

Fig. 17: Our attack in the FedAvg setting.

Fig. 18: Our attack in the Asynchronous FL setting.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Architecture	Layers
	Conv(out=12, k=3, s=1, p=1, act=relu)
CNN	Conv(out=24, k=3, s=1, p=1, act=relu)
	FC(k=1024, act=relu)
	FC(k=#class, act=softmax)
	FC(k=512, act=relu),
MLP	FC(k=512, act=relu),

Appendix

TABLE IV: Network architectures. Conv: out = number of filters, k = kernel size, s = stride, p = padding, act = activation. FC: k = number of neurons, act = activation.

Fig. 19: Visual illustration of the recovery effect on five image datasets.

Fig. 20: Visualization of attack effect under gradient quantization-based defense.

Fig. 21: Visualization of attack effect under gradient sparsity-based defense.

Fig. 22: Visualization of attack effect under different differential privacy noise.

Fig. 23: Visualization of the augmented samples and recovered samples.

Fig. 24: Visual illustration of the recovery effect on the Wikitext dataset. Red text indicates the matching tokens.

Gradient Inversion Attacks

Gradient inversion attacks infer private training examples or labels from gradients shared during distributed model training.

See all 20 papers

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
Sep 9, 2026Saeed Shariati, Mohsen Alambardar MeybodiGradient Inversion Attacks Federated Learning
Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran
Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization
Apr 1, 2026Hao Fang, Wenbo Yu, Bin Chen +4Gradient Inversion Attacks Federated Learning
Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen 518055, Guangdong, China · School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, Guangdong, China · Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China
No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning
Apr 16, 2026Francesco Diana, Chuan Xu, André Nusser +1Gradient Inversion Attacks Adversarial Attacks
Université Côte d’Azur, France · Inria, France · CNRS, France +1

Sep 9, 2026J/K move · Enter open · S save

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

Saeed Shariati, Mohsen Alambardar Meybodi

Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran

Gradient Inversion Attacks Federated Learning Training Data Reconstruction Attacks

Open paper AskPDF arXiv

Federated learning shares model updates rather than raw data, yet these updates can be inverted to reconstruct the clients' training data. Analytic reconstruction attacks, which invert a gradient in closed form, degrade as the batch grows: prior single-round attacks recover only about half of a batch of size

100

even when the attacker fully controls the network parameters, and known upper bounds limit what any such method can recover. We establish a connection between gradient inversion and the theory of erasure-correcting codes, and use it to construct attacks that exceed these bounds. Our attacks recover batches exactly, together with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks they outperform prior single-round attacks by a wide margin. Even a passive attacker who only observes an honestly trained network recovers

94

100\%

of ImageNet batches at sizes up to

128

, more than prior single-round attacks achieve even with active manipulation of the model, and in the active setting more than

90\%

is recovered at batch sizes of several hundred. These results show that the privacy leakage of federated learning has been underestimated.

Abstract

Gradient Inversion Attacks

Explore similar work

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization

No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning