Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Chaoyu Zhang; Shanghao Shi; Heng Jin; Ning Wang; Y. Thomas Hou; Wenjing Lou

cs.CRSep 29, 2026

Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Authors: Chaoyu Zhang, Shanghao Shi, Heng Jin, Ning Wang, Y. Thomas Hou, Wenjing Lou

Organizations: Virginia Tech · Washington University in St. Louis · University of South Florida

Abstract

Federated learning (FL) has become a foundational paradigm for multi-institutional medical AI, allowing hospitals and research centers to jointly train diagnostic models without exchanging patient records. This privacy promise, however, is increasingly contested: a malicious or honest-but-curious server can launch model inversion attacks (MIAs) that reconstruct private patient images directly from shared model updates, and recent scalable, closed-form attacks penetrate even secure aggregation at clinically realistic batch sizes. Existing defenses face an unsatisfactory dilemma. Gradient-perturbation methods such as differential privacy and pruning trade away the diagnostic accuracy on which clinical reliability depends, while cryptographic protocols add system complexity yet still leave updates exposed to these scalable attacks. We propose Aegis, a principled client-side defense that breaks this dilemma without perturbing patient data or modifying the FL protocol. Our key insight is that the success of every known MIA is fundamentally bounded by the local batch size relative to the model's leakage capacity; once this limit is exceeded, distinct samples collide and reconstructions collapse into indistinguishable mixtures. Aegis turns this universal bottleneck into a defense: each client superimposes onto its real update a masking gradient computed on locally synthesized, task-relevant data, deliberately pushing the effective batch beyond the attack's recovery capacity. We complement the design with theoretical convergence guarantees under standard convex assumptions and evaluate Aegis on MNIST, CIFAR-10, and three MedMNIST modalities (chest X-ray, abdominal CT, colon pathology). Aegis neutralizes three state-of-the-art MIAs while preserving model utility and incurring only modest overhead, offering a practical privacy primitive for medical FL.

Figures & tables

Figure 1: Two families of MIAs in FL: (a) optimization-based attacks iteratively minimize the distance between dummy and target gradients; (b) linear-leakage-based attacks recover inputs in closed form from the weight and bias gradients of a fully connected layer.

Figure 2: Overview of Aegis . Each client uses a local generative model to synthesize an in-distribution defense dataset, computes a large-batch masking gradient from it, and superimposes that masking gradient on its real model update once per local epoch. The combined update drives the effective batch size beyond the leakage capacity of the first crafted FC layer; multiple inputs collide in every leakage bin and the server’s reconstruction collapses into a blended mixture rather than identifiable patient samples.

Figure 3: Round-to-accuracy comparison of Aegis (defense batch size 2048) against state-of-the-art defenses on (a) MNIST and (b) CIFAR-10.

Dataset	None	Aegis	Soteria	GC	GD	Outpost	DP
MNIST	290.5	1890.1	19816.2	334.5	4622.4	512.4	330.9
CIFAR-10	433.1	2339.3	32482.0	512.1	8356.8	781.7	517.0

Table 1: Wall-clock training time (seconds) for 100 FL rounds on MNIST and 150 FL rounds on CIFAR-10.

Figure 4: Effectiveness of Aegis against three state-of-the-art linear-leakage MIAs (Robbing-the-Fed, LOKI, Scale-MIA) on CIFAR-10. As the defense batch size grows, RR, PSNR, and SSIM all decrease consistently.

Panel of Table 2 — Table 2: Robbing-the-Fed reconstructions on three MedMNIST modalities (ChestMNIST, OrganAMNIST, PathMNIST) under no defense, Aegis , DP, and GC. Each block shows qualitative samples (top) and quantitative reconstruction metrics (bottom). Blue scores in parentheses are computed only over successfully reconstructed samples (PSNR $>$ 18); RR is the overall reconstruction rate (fraction of samples with PSNR $>$ 18).

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Notation	Explanation
$c_{i}$ , $N$	Client $i$ and the total number of clients.
$t$ , $E$ , $B$	Communication round, number of local epochs, and local mini-batch size.
$K$ , $S_{t}$	Number and set of clients selected in round $t$ .
$G$ , $G_{\mathrm{adv}}$	Benign global model and potentially adversarial broadcast model.
$\theta^{t}$ , $\theta_{i}$	Global parameters at round $t$ and the local copy maintained by client $c_{i}$ .
$\delta_{i}^{t}$	Client update sent to the server after local training and masking.

Appendix

Table A.1: Notation used by Aegis . The left column lists the mathematical symbol and the right column gives its role in the FL protocol, defense mechanism, or convergence analysis.

Table A.2: Sensitivity of Robbing-the-Fed [ 5 ] to local training hyperparameters. The rows compare batch size, learning rate, and local-epoch choices that preserve normal training utility; attack quality remains high across these settings, showing that benign hyperparameter tuning alone is not a reliable defense.

Panel of Table 9 — Table A.3: CIFAR-10 reconstructions by Robbing-the-Fed under six settings: no defense, Aegis , DP, GC, Soteria, and Outpost. RR is the fraction of samples with PSNR $>$ 18. Blue parenthetical PSNR/SSIM values average only over successfully reconstructed samples, separating overall protection from the fidelity of the few surviving reconstructions.

Defense	ChestMNIST	OrganAMNIST	PathMNIST
No defense	55.8	58.6	57.3
Eloul et al.	55.7	58.5	57.2
Aegis	55.5	58.8	57.2
Soteria	53.8	56.6	55.3
GC	51.9	54.7	53.4
GD	47.2	50.0	48.7

Appendix

Table A.4: Final medical test accuracy (%). Aegis uses

M=2048

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
No defense	55.8	89.06	62.40	0.94
Eloul et al.	55.7	85.94	58.90	0.92
Aegis , $M=512$	56.0	49.95	34.59	0.69
Aegis , $M=1024$	55.9	27.03	25.06	0.55
Aegis , $M=1536$	55.7	16.24	21.08	0.49

Appendix

Table A.5: Medical privacy–utility trade-off against Robbing-the-Fed. PSNR (dB) and SSIM are overall reconstruction metrics.

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
No defense	55.8	89.06	62.40	0.94
Stable Diffusion 2.0	55.5	9.50	18.70	0.46
SDXL 1.0	55.6	9.06	18.30	0.44
VQ-VAE-2	55.4	10.63	19.20	0.48
StyleGAN2-ADA	55.3	11.25	19.60	0.49

Appendix

Table A.6: Generator ablation under the same Aegis and Robbing-the-Fed configuration.

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
Original: at most 5 classes	55.5	9.50	18.70	0.46
Label Dir(0.5)	58.8	9.38	18.61	0.45
Label Dir(0.1)	53.8	9.62	18.82	0.47
Label quantity: 2 classes	43.6	9.71	18.91	0.47
Feature Gau(0.1)	59.5	9.94	19.05	0.48

Appendix

Table A.7: Non-IID sensitivity of Aegis against Robbing-the-Fed. Partition labels follow the experimental settings.

ChestMNIST
Setting	ACC (%) $\uparrow$	RR (%) $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$
3-layer CNN	55.5	9.50	18.70	0.46
ResNet-18	57.8	9.47	18.68	0.46
ViT-S/4	56.4	9.54	18.74	0.46
Swin-T	57.2	9.49	18.69	0.46
OrganAMNIST

Appendix

Table A.8: Backbone sensitivity under the same Aegis and Robbing-the-Fed setting.

MIA	Break SA	Batch Size	Optimization
DLG [ 50 ]	No	1	Yes
iDLG [ 47 ]	No	1	Yes
Inverting Gradients [ 6 ]	No	8	Yes
GradInversion [ 45 ]	No	48	Yes
GradViT [ 10 ]	No	8	Yes
APRIL-Optim [ 22 ]	No	1	Yes

Appendix

Table A.9: Representative gradient-based MIAs in FL. “Break SA” indicates attacks demonstrated under secure aggregation or equivalent aggregate-only settings. “Batch Size Constraint” reports the largest batch scale at which the attack is typically effective under a first crafted FC layer with 1024 neurons, highlighting why leakage capacity is the relevant bottleneck for Aegis .

Explore similar work

Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning
May 31, 2026Ivo Osterberg Nilsson, Maximilian Birr Engvall, Viktor Valadi +1Federated Learning Gradient-Based Attacks
Department of Computing, Jönköping University, Jönköping, Sweden · Scaleout Systems, Uppsala, Sweden · Department of Information Systems, University of Haifa, Haifa, Israel
Fed-FBD: Federated Functional Block Diversification for Isolation, Privacy, and Surgical Unlearning
Jun 10, 2026Weijie Chen, Alan B. McMillanFederated Learning Federated Averaging
Department of Radiology, University of Wisconsin–Madison
Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
Sep 10, 2026Saeed Shariati, Mohsen Alambardar MeybodiFederated Learning Gradient-Based Attacks
Department of Applied Mathematics and Computer Science, Faculty of Mathematics and Statistics, University of Isfahan, Isfahan 81746-73441, Iran

May 31, 2026, cs.LGJ/K move · Enter open · S save

Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning

Ivo Osterberg Nilsson, Maximilian Birr Engvall, Viktor Valadi, Teddy Lazebnik

Department of Computing, Jönköping University, Jönköping, Sweden · Scaleout Systems, Uppsala, Sweden · Department of Information Systems, University of Haifa, Haifa, Israel

Federated Learning Gradient-Based Attacks Privacy

Open paper AskPDF arXiv

Federated learning (FL) enables multiple data holders to train machine learning models collaboratively without centralizing raw data, making it useful in privacy sensitive domains such as healthcare and institutional data sharing. FL keeps data local to clients while communicating only model updates, such as gradients or model deltas. Nevertheless, these updates can expose private client data through gradient inversion attacks (GIAs). We study this risk for tabular FL under an honest-but-curious server threat model across FL protocols, client batch sizes, training stages, attacker assumptions, model architectures, and binary classification, multiclass classification, and regression tasks. We use MIMIC-IV and complementary benchmark datasets. Our evaluation distinguishes numerical and categorical recovery, baseline recoverability, feature level recovery, and exact match rate (EMR). We evaluate FedSGD gradients and FedAvg model deltas with an exposure aligned protocol, comparing attacked models after matched client data exposure rather than matched communication rounds. We compare multilayer perceptron (MLP), ResNet, and FT-Transformer models, and isolate architecture effects through an MLP grid over width, depth, activation, normalization, and dropout. The results show that small client batches and updates representing few distinct records are most vulnerable. Larger local batches and stronger aggregation reduce reconstruction but do not eliminate leakage. FT-Transformer is consistently harder to invert than one-hot baselines, while reconstructability also varies substantially within the MLP family. These findings identify architecture as a practical privacy variable in tabular FL. We also show that aggregate reconstruction accuracy can overstate complete record recovery in sparse data, making EMR and baseline comparisons essential.

Abstract

Explore similar work

Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning

Fed-FBD: Federated Functional Block Diversification for Isolation, Privacy, and Surgical Unlearning

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning