A Novel Federated Learning Framework for Defending Against Gradient Inversion Attacks

Pengxin Guo; Ziying Huang; Shuang Zeng; Xiaodan Zhang; Weihong Ren; Yuyin Zhou; Liangqiong Qu

cs.LGNov 2, 2026

A Novel Federated Learning Framework for Defending Against Gradient Inversion Attacks

Authors: Pengxin Guo, Ziying Huang, Shuang Zeng, Xiaodan Zhang, Weihong Ren, Yuyin Zhou, Liangqiong Qu

Organizations: School of Computing and Data Science, The University of Hong Kong, Hong Kong, 999077, China · Department of Electrical and Electronic Engineering, Southern University of Science and Technology, Shenzhen, 518055, China · Department of Mathematics, The University of Hong Kong, Hong Kong, 999077, China · College of Computer Science, Beijing University of Technology, Beijing, 100124, China ·

Abstract

Federated Learning (FL) offers a paradigm for collaborative machine learning model training among clients, preserving data privacy by avoiding direct data sharing. However, the gradient information exchanged in FL has been shown to be vulnerable to Gradient Inversion Attacks (GIA), which can reconstruct sensitive user data. To counter these threats, various privacy-enhancing technologies like Secure Multi-party Computing (SMC), Homomorphic Encryption (HE), and Differential Privacy (DP) have been integrated into FL. While effective, these methods often introduce significant trade-offs between privacy and model utility. By revisiting the key to privacy exposure in FL under GIA, which lies in the frequent sharing of model gradients that contain private data, we take a new perspective by designing a novel privacy-preserving FL framework that effectively ``breaks the direct connection'' between the shared parameters and the local private data to defend against GIA. Our proposed framework, HyperFL++, leverages hypernetworks to generate local model parameters, where only the hypernetwork parameters are aggregated by the server. To ensure practicality, HyperFL++ incorporates a Row-wise Kronecker Decomposition (RKD) to mitigate the memory and communication overhead from the hypernetwork. Comprehensive theoretical analysis and extensive experiments validate our method's effectiveness in protecting data privacy while maintaining high model utility. Our code is available at https://github.com/Pengxin-Guo/HyperFL/tree/hyperfl%2B%2B.

Figures & tables

Figure 1: Left . Current approaches focus on protective techniques for shared gradients, such as SMC, HE, and DP, which naturally entail significant privacy-utility trade-offs. Right . A new FL framework is introduced that “breaks the direct connection” between the shared parameters and the local private data, aiming to achieve an optimal balance between privacy and utility.

Figure 2: Left) . Illustration of HyperFL++ . HyperFL++ divides each client’s network into two components: the feature extractor

f(;\theta_{i})

and the classifier head

g(;{\phi_{i}})

. An auxiliary hypernetwork, denoted as

h(;{\varphi_{i}})

, is employed to create the feature extractor

f(;\theta_{i})

using the client’s specific private embedding vector

\mathbf{v}_{i}

, such that

{\theta_{i}}=h({{\bf{v}}_{i}};{\varphi_{i}})

. These parameters are then utilized to derive features from the input

{x}_{i}

, which are subsequently processed by the classifier to produce the output

\hat{y}_{i}

, represented as

\hat{y}_{i}=g(f({x}_{i};\theta_{i});\phi_{i})

. During the FL process, the hypernetwork

\varphi_{i}

is the only element shared with the server, while all other components remain private. This approach effectively addresses privacy leakage concerns. Right). Row-wise Kronecker Decomposition ( RKD ). The hypernetwork parameters (matrices) are first partitioned into rows, and then Kronecker decomposition is applied to each row.

\otimes

denotes Kronecker product.

Figure 3: The HyperFL++-LPM framework in each client. In this framework, the weights of the pre-trained model remain fixed, while only the classifier, hypernetwork, and client embedding are trainable. It’s important to note that $\theta$ refers to the parameters of the adapters.

Figure 4: Visualization of reconstructed images of IG [ geiping2020inverting ] . The images recovered from FedAvg, pFedHN, and pFedHN-PC are clearly recognizable, indicating severe privacy leakage. In contrast, images from DP-based methods, HyperFL, and HyperFL++ are noisy and unrecognizable, demonstrating effective privacy protection.

Method	EMNIST			CIFAR-10
Method	PSNR	SSIM	LPIPS	PSNR	SSIM	LPIPS
FedAvg [ mcmahan2017communication ]	32.64	0.8925	0.0526	16.16	0.6415	0.0536
pFedHN [ shamsian2021personalized ]	31.24	0.8701	0.0807	16.02	0.6351	0.0504
pFedHN-PC [ shamsian2021personalized ]	28.38	0.8713	0.0645	15.80	0.6247	0.0407
DP-FedAvg [ mcmahan2018learning ]	7.74	0.2978	0.7051	7.90	0.2716	0.3204
CENTAUR [ shen2023share ]	9.52	0.2136	0.6712	9.80	0.2723	0.2882

Table 1: Reconstruction results of IG [ geiping2020inverting ] . Higher LPIPS, Lower PSNR, and SSIM of recovered images indicate better defense ability.

Method	# Para	EMNIST		Fashion-MNIST		CIFAR-10		CINIC-10
Method	# Para	20 clients	100 clients	20 clients	100 clients	20 clients	100 clients	20 clients	100 clients
FedAvg [ mcmahan2017communication ]	[115,776; 106,400]	72.77	78.87	85.67	88.11	70.02	76.24	57.00	59.11
pFedHN [ shamsian2021personalized ]	[115,776; 106,400]	80.86	77.37	87.64	89.80	70.18	80.07	63.88	70.36
pFedHN-PC [ shamsian2021personalized ]	[109,368; 110,168]	82.04	79.32	89.17	90.06	72.52	78.15	64.92	68.73
DP-FedAvg [ mcmahan2018learning ]	[115,776; 106,400]	35.12	45.73	59.88	68.29	29.12	32.03	27.30	29.94
CENTAUR [ shen2023share ]	[115,776; 106,400]	68.82	67.24	83.07	79.77	50.85	51.86	48.82	51.01

Table 2: The comparison of final test accuracy (%) of different methods on various datasets. We apply full participation for FL system with 20 clients, and apply client sampling with rate 0.3 for FL system with 100 clients. # Para [EMNIST/Fashion-MNIST; CIFAR-10/CINIC-10] denotes the communication parameters during each FL round. Underline indicates better performance than FedAvg.

Method	EMNIST	Fashion-MNIST	CIFAR-10	CINIC-10
FedAvg † [ mcmahan2017communication ]	75.86	83.95	68.55	65.90
FedAvg †† [ mcmahan2017communication ]	72.73	85.69	92.37	91.37
HyperFL++-LPM	78.73	84.91	88.12	83.57

Table 3: The comparison of final test accuracy (%) of different methods on various datasets with 20 clients. † Adapter fine-tuning. †† Full parameter tuning.

Method	# Communicated Param		Computation Cost		# Comm. Rounds
Method	EMNIST	CIFAR-10	EMNIST	CIFAR-10	EMNIST	CIFAR-10
FedAvg [ mcmahan2017communication ]	115,776	106,400	21.99	19.39	11	123
pFedHN [ shamsian2021personalized ]	115,776	106,400	16.79	25.10	15	76
pFedHN-PC [ shamsian2021personalized ]	109,368	110,168	30.12	31.58	3	60
DP-FedAvg [ mcmahan2018learning ]	115,776	106,400	202.52	144.33	–	–
CENTAUR [ shen2023share ]	115,776	106,400	187.47	140.39	–	–

Table 4: Per-round communication and computation costs. # Comm. Rounds denotes the number of rounds to reach the predefined target performance. - means it cannot reach the target performance.

Figure 5: Average training loss on the EMNIST dataset with 20 clients. The curve for HyperFL++ shows a smooth and rapid decrease, achieving a lower final loss than FedAvg, which indicates better model performance.

Privacy-Preserving Federated Learning

See all 51 papers

Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization
Apr 1, 2026Hao Fang, Wenbo Yu, Bin Chen +4Gradient Inversion Attacks Federated Learning
Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen 518055, Guangdong, China · School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, Guangdong, China · Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China
Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning
May 31, 2026Ivo Osterberg Nilsson, Maximilian Birr Engvall, Viktor Valadi +1Gradient Inversion Attacks Adversarial Attacks
Department of Computing, Jönköping University, Jönköping, Sweden · Scaleout Systems, Uppsala, Sweden · Department of Information Systems, University of Haifa, Haifa, Israel
Trajectory-Aware Information Matching for Multi-Step Gradient Inversion in Federated Learning
Sep 26, 2025Li Xia, Jing Yu, Zheng Liu +3Gradient Inversion Attacks Adversarial Attacks
Key Laboratory of Ethnic Language Intelligent Analysis and Security Governance of MOE, Minzu University of China, Beijing, 100081, China

Apr 1, 2026J/K move · Enter open · S save

Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization

Hao Fang, Wenbo Yu, Bin Chen, Xuan Wang+3

Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen 518055, Guangdong, China · School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, Guangdong, China · Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China

Gradient Inversion Attacks Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) has emerged as a compelling paradigm for privacy-preserving distributed machine learning, allowing multiple clients to collaboratively train a global model by transmitting locally computed gradients to a central server without exposing their private data. Nonetheless, recent studies find that the gradients exchanged in the FL system are also vulnerable to privacy leakage, e.g., an attacker can invert shared gradients to reconstruct sensitive data by leveraging pre-trained generative adversarial networks (GAN) as prior knowledge. However, existing attacks simply perform gradient inversion in the latent space of the GAN model, which limits their expression ability and generalizability. To tackle these challenges, we propose Gradient Inversion over Feature Domains (GIFD), which disassembles the GAN model and searches the hierarchical features of the intermediate layers. Instead of optimizing only over the initial latent code, we progressively change the optimized layer, from the initial latent space to intermediate layers closer to the output images. In addition, we design a regularizer to avoid unreal image generation by adding a small

{l_1}

ball constraint to the searching range. We also extend GIFD to the out-of-distribution (OOD) setting, which weakens the assumption that the training sets of GANs and FL tasks obey the same data distribution. Furthermore, we consider the challenging OOD scenario of label inconsistency and propose a label mapping technique as an effective solution. Extensive experiments demonstrate that our method can achieve pixel-level reconstruction and outperform competitive baselines across a variety of FL scenarios.

Abstract

Privacy-Preserving Federated Learning

Explore similar work

Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization

Profiling Privacy Preservation Against Gradient Inversion Attacks in Tabular Federated Learning

Trajectory-Aware Information Matching for Multi-Step Gradient Inversion in Federated Learning