Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Chaoyu Zhang; Shanghao Shi; Heng Jin; Ning Wang; Y. Thomas Hou; Wenjing Lou

cs.CRSep 29, 2026

Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Authors: Chaoyu Zhang, Shanghao Shi, Heng Jin, Ning Wang, Y. Thomas Hou, Wenjing Lou

Organizations: Virginia Tech · Washington University in St. Louis · University of South Florida

Abstract

Federated learning (FL) has become a foundational paradigm for multi-institutional medical AI, allowing hospitals and research centers to jointly train diagnostic models without exchanging patient records. This privacy promise, however, is increasingly contested: a malicious or honest-but-curious server can launch model inversion attacks (MIAs) that reconstruct private patient images directly from shared model updates, and recent scalable, closed-form attacks penetrate even secure aggregation at clinically realistic batch sizes. Existing defenses face an unsatisfactory dilemma. Gradient-perturbation methods such as differential privacy and pruning trade away the diagnostic accuracy on which clinical reliability depends, while cryptographic protocols add system complexity yet still leave updates exposed to these scalable attacks. We propose Aegis, a principled client-side defense that breaks this dilemma without perturbing patient data or modifying the FL protocol. Our key insight is that the success of every known MIA is fundamentally bounded by the local batch size relative to the model's leakage capacity; once this limit is exceeded, distinct samples collide and reconstructions collapse into indistinguishable mixtures. Aegis turns this universal bottleneck into a defense: each client superimposes onto its real update a masking gradient computed on locally synthesized, task-relevant data, deliberately pushing the effective batch beyond the attack's recovery capacity. We complement the design with theoretical convergence guarantees under standard convex assumptions and evaluate Aegis on MNIST, CIFAR-10, and three MedMNIST modalities (chest X-ray, abdominal CT, colon pathology). Aegis neutralizes three state-of-the-art MIAs while preserving model utility and incurring only modest overhead, offering a practical privacy primitive for medical FL.

Figures & tables

Figure 1: Two families of MIAs in FL: (a) optimization-based attacks iteratively minimize the distance between dummy and target gradients; (b) linear-leakage-based attacks recover inputs in closed form from the weight and bias gradients of a fully connected layer.

Figure 2: Overview of Aegis . Each client uses a local generative model to synthesize an in-distribution defense dataset, computes a large-batch masking gradient from it, and superimposes that masking gradient on its real model update once per local epoch. The combined update drives the effective batch size beyond the leakage capacity of the first crafted FC layer; multiple inputs collide in every leakage bin and the server’s reconstruction collapses into a blended mixture rather than identifiable patient samples.

Figure 3: Round-to-accuracy comparison of Aegis (defense batch size 2048) against state-of-the-art defenses on (a) MNIST and (b) CIFAR-10.

Dataset	None	Aegis	Soteria	GC	GD	Outpost	DP
MNIST	290.5	1890.1	19816.2	334.5	4622.4	512.4	330.9
CIFAR-10	433.1	2339.3	32482.0	512.1	8356.8	781.7	517.0

Table 1: Wall-clock training time (seconds) for 100 FL rounds on MNIST and 150 FL rounds on CIFAR-10.

Figure 4: Effectiveness of Aegis against three state-of-the-art linear-leakage MIAs (Robbing-the-Fed, LOKI, Scale-MIA) on CIFAR-10. As the defense batch size grows, RR, PSNR, and SSIM all decrease consistently.

Panel of Table 2 — Table 2: Robbing-the-Fed reconstructions on three MedMNIST modalities (ChestMNIST, OrganAMNIST, PathMNIST) under no defense, Aegis , DP, and GC. Each block shows qualitative samples (top) and quantitative reconstruction metrics (bottom). Blue scores in parentheses are computed only over successfully reconstructed samples (PSNR $>$ 18); RR is the overall reconstruction rate (fraction of samples with PSNR $>$ 18).

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Notation	Explanation
$c_{i}$ , $N$	Client $i$ and the total number of clients.
$t$ , $E$ , $B$	Communication round, number of local epochs, and local mini-batch size.
$K$ , $S_{t}$	Number and set of clients selected in round $t$ .
$G$ , $G_{\mathrm{adv}}$	Benign global model and potentially adversarial broadcast model.
$\theta^{t}$ , $\theta_{i}$	Global parameters at round $t$ and the local copy maintained by client $c_{i}$ .
$\delta_{i}^{t}$	Client update sent to the server after local training and masking.

Appendix

Table A.1: Notation used by Aegis . The left column lists the mathematical symbol and the right column gives its role in the FL protocol, defense mechanism, or convergence analysis.

Table A.2: Sensitivity of Robbing-the-Fed [ 5 ] to local training hyperparameters. The rows compare batch size, learning rate, and local-epoch choices that preserve normal training utility; attack quality remains high across these settings, showing that benign hyperparameter tuning alone is not a reliable defense.

Panel of Table 9 — Table A.3: CIFAR-10 reconstructions by Robbing-the-Fed under six settings: no defense, Aegis , DP, GC, Soteria, and Outpost. RR is the fraction of samples with PSNR $>$ 18. Blue parenthetical PSNR/SSIM values average only over successfully reconstructed samples, separating overall protection from the fidelity of the few surviving reconstructions.

Defense	ChestMNIST	OrganAMNIST	PathMNIST
No defense	55.8	58.6	57.3
Eloul et al.	55.7	58.5	57.2
Aegis	55.5	58.8	57.2
Soteria	53.8	56.6	55.3
GC	51.9	54.7	53.4
GD	47.2	50.0	48.7

Appendix

Table A.4: Final medical test accuracy (%). Aegis uses

M=2048

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
No defense	55.8	89.06	62.40	0.94
Eloul et al.	55.7	85.94	58.90	0.92
Aegis , $M=512$	56.0	49.95	34.59	0.69
Aegis , $M=1024$	55.9	27.03	25.06	0.55
Aegis , $M=1536$	55.7	16.24	21.08	0.49

Appendix

Table A.5: Medical privacy–utility trade-off against Robbing-the-Fed. PSNR (dB) and SSIM are overall reconstruction metrics.

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
No defense	55.8	89.06	62.40	0.94
Stable Diffusion 2.0	55.5	9.50	18.70	0.46
SDXL 1.0	55.6	9.06	18.30	0.44
VQ-VAE-2	55.4	10.63	19.20	0.48
StyleGAN2-ADA	55.3	11.25	19.60	0.49

Appendix

Table A.6: Generator ablation under the same Aegis and Robbing-the-Fed configuration.

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
Original: at most 5 classes	55.5	9.50	18.70	0.46
Label Dir(0.5)	58.8	9.38	18.61	0.45
Label Dir(0.1)	53.8	9.62	18.82	0.47
Label quantity: 2 classes	43.6	9.71	18.91	0.47
Feature Gau(0.1)	59.5	9.94	19.05	0.48

Appendix

Table A.7: Non-IID sensitivity of Aegis against Robbing-the-Fed. Partition labels follow the experimental settings.

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
3-layer CNN	55.5	9.50	18.70	0.46
ResNet-18	57.8	9.47	18.68	0.46
ViT-S/4	56.4	9.54	18.74	0.46
Swin-T	57.2	9.49	18.69	0.46
OrganAMNIST

Appendix

Table A.8: Backbone sensitivity under the same Aegis and Robbing-the-Fed setting.

MIA	Break SA	Batch Size	Optimization
DLG [ 50 ]	No	1	Yes
iDLG [ 47 ]	No	1	Yes
Inverting Gradients [ 6 ]	No	8	Yes
GradInversion [ 45 ]	No	48	Yes
GradViT [ 10 ]	No	8	Yes
APRIL-Optim [ 22 ]	No	1	Yes

Appendix

Table A.9: Representative gradient-based MIAs in FL. “Break SA” indicates attacks demonstrated under secure aggregation or equivalent aggregate-only settings. “Batch Size Constraint” reports the largest batch scale at which the attack is typically effective under a first crafted FC layer with 1024 neurons, highlighting why leakage capacity is the relevant bottleneck for Aegis .

Explore similar work

May 31, 2026cs.LG

Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning

Federated learning (FL) enables multiple data holders to train machine learning models collaboratively without centralizing raw data, making it useful in privacy sensitive domains such as healthcare and institutional data sharing. FL keeps data local to clients while communicating only model updates, such as gradients or model deltas. Nevertheless, these updates can expose private client data through gradient inversion attacks (GIAs). We study this risk for tabular FL under an honest-but-curious server threat model across FL protocols, client batch sizes, training stages, attacker assumptions, model architectures, and binary classification, multiclass classification, and regression tasks. We use MIMIC-IV and complementary benchmark datasets. Our evaluation distinguishes numerical and categorical recovery, baseline recoverability, feature level recovery, and exact match rate (EMR). We evaluate FedSGD gradients and FedAvg model deltas with an exposure aligned protocol, comparing attacked models after matched client data exposure rather than matched communication rounds. We compare multilayer perceptron (MLP), ResNet, and FT-Transformer models, and isolate architecture effects through an MLP grid over width, depth, activation, normalization, and dropout. The results show that small client batches and updates representing few distinct records are most vulnerable. Larger local batches and stronger aggregation reduce reconstruction but do not eliminate leakage. FT-Transformer is consistently harder to invert than one-hot baselines, while reconstructability also varies substantially within the MLP family. These findings identify architecture as a practical privacy variable in tabular FL. We also show that aggregate reconstruction accuracy can overstate complete record recovery in sparse data, making EMR and baseline comparisons essential.

Ivo Osterberg Nilsson, Maximilian Birr Engvall, Viktor Valadi +1

Department of Computing, Jönköping University, Jönköping, Sweden · Scaleout Systems, Uppsala, Sweden · Department of Information Systems, University of Haifa, Haifa, Israel

Federated Learning Gradient-Based Attacks Privacy

Ask PDF

Jun 10, 2026cs.LG

Fed-FBD: Federated Functional Block Diversification for Isolation, Privacy, and Surgical Unlearning

Federated learning (FL) enables collaborative model training without sharing raw patient data, but standard approaches such as FedAvg treat each client as a black box and provide no mechanism for isolating an adversarial contributor, auditing per-client influence, or honoring a departed participant's right to be forgotten. We present Fed-FBD (Federated Functional Block Diversification), a modular federated architecture that decomposes a ResNet backbone into six functional blocks (the stem, four residual groups, and the classification head) and maintains a warehouse of N color variants, each assembled from independently tracked and contributor-stamped blocks. Fed-FBD provides three capabilities absent in FedAvg: (i) architecturally guaranteed block-level isolation, so that an adversarial or mislabelled client cannot contaminate the clean colous; (ii) privacy-by-design, where membership inference advantage is already indistinguishable from chance before any privacy mechanism is applied; and (iii) surgical machine unlearning of a departed participant's contribution at sub-second cost and without retraining. Experiments on six MedMNIST-2D datasets, PathMNIST at 224x224, and CIFAR-10 show that Fed-FBD trades a modest 0.3%-3.1% IID accuracy gap on the adequately sized datasets for these guarantees, remains within 0.8%-4.0% of FedAvg at Dirichlet alpha=1.0 on three of four datasets, and confines all six adversarial attacks we study to the poisoned client's own blocks with at most +/-0.01 AUC drift on the clean colors.

Weijie Chen, Alan B. McMillan

Department of Radiology, University of Wisconsin–Madison

Federated Learning Federated Averaging Adversarial Training Privacy Patients

Ask PDF

Sep 10, 2026cs.LG

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

Federated learning shares model updates rather than raw data, yet these updates can be inverted to reconstruct the clients' training data. Analytic reconstruction attacks, which invert a gradient in closed form, degrade as the batch grows: prior single-round attacks recover only about half of a batch of size

100

even when the attacker fully controls the network parameters, and known upper bounds limit what any such method can recover. We establish a connection between gradient inversion and the theory of erasure-correcting codes, and use it to construct attacks that exceed these bounds. Our attacks recover batches exactly, together with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks they outperform prior single-round attacks by a wide margin. Even a passive attacker who only observes an honestly trained network recovers

94

100\%

of ImageNet batches at sizes up to

128

, more than prior single-round attacks achieve even with active manipulation of the model, and in the active setting more than

90\%

is recovered at batch sizes of several hundred. These results show that the privacy leakage of federated learning has been underestimated.

Saeed Shariati, Mohsen Alambardar Meybodi

Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran

Federated Learning Gradient-Based Attacks Diffusion Inversion Stochastic Gradient Descent Error Correction

Ask PDF