Pith. sign in

REVIEW 5 major objections 4 minor 40 references

GDBR: Label Recovery Attack Against Partial Gradient Encryption in Federated Learning

T0 review · 5 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Encrypting only the classification head's gradients does not protect label privacy in federated learning: a server that sees any one lower-layer gradient can recover a client's batch label counts with over 80% instance-level accuracy.

desk verdict Novel attack direction against partial gradient encryption, but the generality claim is unsubstantiated because every evaluated architecture was customized to keep activations positive. read the letter →

arxiv 2412.12640 v2 pith:2LKZJHFF submitted 2024-12-17 cs.LG cs.CR

Rui Zhang , Ka-Ho Chow , Ping Li This is my paper · ORCID
classification cs.LGcs.CR
keywords federatedlearninggradientleakagelabelrecoveryattackpartialencryptionbridgeprivacydistributionFedSGD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that partial gradient encryption—specifically, hiding only the final classification layer's gradients—does not protect label privacy in federated learning. It introduces GDBR, a white-box attack in which a semi-honest server takes the gradient of a single non-output layer and reconstructs the batch-averaged gradient of the output logits through a chain of layer-wise gradient identities. From that reconstructed gradient, the attack solves a linear equation to recover the per-class counts of the victim's training batch. Experiments across five datasets and five model families report more than 80% instance-level label recovery, and the recovered labels are a prerequisite for stronger attacks such as data reconstruction and membership inference. If the paper is right, any shared lower layer becomes a sufficient channel for label leakage in FedSGD, not just the final layer.

What carries the argument

The central object is the 'gradient bridge', a chain of gradient-propagation identities connecting a shared lower-layer gradient to the gradient of the output logits. Lemma 1–4 establish the per-layer identities, Theorem 1 and Theorem 2 extend them through FC-ReLU and Conv-ReLU stacks, and Equations (17)–(19) convert the chain into a batch-averaged recursive reconstruction. The load-bearing formula is $\lambda = B(\hat p - \overline{\nabla z}^{[L]})$, which turns the reconstructed logit gradient into a vector of integer label counts because $\lambda$ sums to $B$ and each entry counts how many samples in the batch belong to that class.

What would settle it

On a late- or fully-trained model, take a batch containing images from visually distant classes so that penultimate-layer features diverge, run GDBR with the same auxiliary data, and measure instance-level label accuracy; if it remains above 80%, the similarity assumptions are not the limiting factor, and if it collapses, the attack is confined to the early-training regime the paper focuses on.

Watch

Extended reading notes

Core claim

GDBR's central claim is that the gradient of one unencrypted layer—for example the first fully connected or convolutional layer in the bottom stack, or the penultimate layer before the classifier—is enough to recover the label multiset of a client's batch. The proof chain uses four gradient identities: in an FC layer $\nabla x x^\top = W^\top \nabla W$, $\nabla z z^\top = \nabla W W^\top$, and $\nabla z \odot z = \operatorname{diag}(\nabla W W^\top)$; in a Conv layer $\langle \nabla W_k, W_k\rangle_F = \langle \nabla Z_k, Z_k\rangle_F$; and in a ReLU layer $\nabla z \odot z = \nabla a \odot a$. Recursively propagating from the shared layer to the logits yields the reconstructed batch-averaged logit gradient $\overline{\nabla z}^{[L]}$ (Equations 17–19). With two approximations—that per-sample features in the shared layer and per-sample output probabilities are each close to auxiliary-data estimates—the attack obtains $\lambda = B(\hat p - \overline{\nabla z}^{[L]})$, where $\lambda$ is the vector of per-class label counts and $B$ is the batch size. The paper argues this defeats final-layer-only encryption defenses.

Load-bearing premise

The attack's load-bearing premise is that every sample in the victim's batch has roughly the same penultimate-layer features and roughly the same output probabilities as the attacker's auxiliary-data estimates, so that batch-averaged equations behave like single-sample formulas.

Editorial extensions

If this is right

  • A defense that encrypts or hides only the final fully connected layer's gradients leaves label information reachable through any other layer whose gradient is shared.
  • GDBR achieves over 80% instance-level label recovery across MNIST, SVHN, CIFAR-10/100, and ImageNet using MLP, LeNet, AlexNet, VGG, and ResNet models.
  • The attack remains effective under moderate gradient pruning and noise; only aggressive defenses (pruning threshold at or above 0.9 or noise scale at or above 0.2) substantially degrade it.
  • Recovered label counts are a stepping stone for data reconstruction and membership inference, so partial-encryption systems must be re-evaluated for this expanded attack surface.
  • GDBR needs only auxiliary data—or, on simple datasets, dummy Gaussian data—rather than access to the victim's private batch.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same bridge construction could in principle be adapted to architectures with batch normalization, attention, or residual connections, but the paper only derives identities for FC, Conv, and ReLU layers.
  • Because the recovered counts $\lambda$ must sum to the batch size $B$, an attacker can in principle self-calibrate an unknown batch size from the same equation, although the paper does not discuss this.
  • The similarity assumptions behind the bridge are most plausible early in training, which the paper acknowledges; a defense that shifts to later-stage training or amplifies per-sample feature diversity could blunt the attack.
  • A concrete extension would be to test GDBR on a converged model; the paper's early-training focus leaves open whether the bridge survives once features and probabilities become sample-specific.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes GDBR, a white-box label-recovery attack against FedSGD when a client shares gradients of only one non-output layer. The attack builds a 'gradient bridge' through stacks of FC-ReLU and Conv-ReLU layers to estimate the batch-averaged gradient with respect to the output logits, and then recovers per-class label counts using Eq. (21) with auxiliary estimates of the final-layer features and softmax probabilities. Experiments on MNIST, SVHN, CIFAR-10/100, and ImageNet report instance-level accuracy above 80% and claim robustness to gradient pruning and noise perturbation. The algebraic chain in Eqs. (6)-(21) is coherent under explicit positivity and rank conditions, but the implementation and validation impose conditions that are not satisfied by standard unmodified architectures.

Significance. If the claimed generality held, GDBR would be an important result because it challenges the common defense of encrypting only classification-head gradients in federated learning. The paper is among the first analytical label-recovery attacks to operate from a single unencrypted non-output layer, and the comparison against ZLG and LLG is informative, especially because the baselines are given part of the ground-truth final-layer gradient while GDBR is not. The derivation is self-contained and the experimental scope is broad at first sight. However, the results are obtained on models that are modified to guarantee the attack's core positivity assumption, and the batch-averaging step is a heuristic with no error analysis; the significance is therefore conditional on a much narrower setting than the abstract and conclusion claim.

major comments (5)
  1. [Section IV.C, Eq. (17)] The passage from per-sample gradients to batch averages is an unproven approximation. For each sample n, the shared-layer gradient has the form diag(∇W^(1)(n) W^(1)⊤) ⊘ a^(1)(n) or the analogous Conv expression, and Eq. (17) sums the numerators while replacing the per-sample denominators by a single auxiliary estimate ea^(1). This is valid only if a^(1)(n) is nearly constant across the batch, whereas Assumption 1 asserts only that the features have 'similar Gaussian distributions'; Fig. 2 shows visible spread for five selected dimensions of one model at one training point. The approximation error propagates through Eqs. (18)-(19) into ∇z^[L] and hence into the recovered labels. The same issue affects Assumption 2 and Eq. (21), where per-sample deviations of p^(n) from the auxiliary estimate ep are not accounted for. The paper should either provide an error bound in terms of the variance of a^(1)(n) and p^(n), or evaluate the attack in settings where activation variation is not suppressed by custom initialization.
  2. [Section V.A, Implementation Details] The attacked models are modified to guarantee the positivity condition of Theorems 1-2: the average pooling layer in ResNet is replaced by a convolutional layer, bias terms in the bottom layers are ignored, and bottom-layer weights are initialized uniformly in [0.01, 0.2]. This initialization makes every pre-activation positive, so dead ReLUs essentially do not occur and the identity a = z used in the proof of Theorem 1 holds. The only experiment with standard PyTorch initialization is the 6-layer MLP in Fig. 5b, where zero features are additionally replaced by the mean of non-zero elements; no standard ResNet, VGG, or AlexNet is evaluated without these modifications. The abstract's claim that the attack applies to 'convolutional and transformer-based networks' in ordinary FL deployments is therefore not established by the reported experiments.
  3. [Section IV.B, Lemma 2 and Theorem 2] The bridge equations rely on unstated algebraic conditions. Eq. (9) and its recursive use in Eqs. (15)-(19) require inverting WW^⊤, which demands that each FC weight matrix have full row rank and that its output dimension not exceed its input dimension; the paper neither states nor verifies these conditions. Theorem 2 is derived only for convolution outputs of spatial shape 1×1, yet the theorem statement and its use in Eq. (14) do not carry this restriction forward. These conditions are necessary for the derivation to be well-defined and should appear as explicit assumptions in Section IV.C, with rank and shape checks in the experiments.
  4. [Section IV.B and Section V.A] The derivation covers only stacks of FC-ReLU and Conv-ReLU with bias terms ignored. Standard ResNet, VGG, and AlexNet architectures contain BatchNorm layers, residual connections, or bias parameters, each of which introduces additional gradient paths not represented in Eqs. (12)-(19). The ResNet experiments replace the average pooling and ignore biases, but they do not remove BatchNorm or residual connections, and the paper does not explain how these components are incorporated into the gradient bridge. Without an analysis of these extra terms, the validity of the bridge for standard ResNet-style architectures is unsupported.
  5. [Section IV.D, Eq. (21)] The label recovery formula assumes that the batch size B is known and that the reconstructed ∇z^[L] is the exact batch-averaged gradient. In practice the gradient bridge produces an estimate, so the vector B·(ep - ∇z^[L]) is not guaranteed to be a nonnegative integer count summing to B; the paper does not describe how λ is projected, rounded, or constrained. This is not merely cosmetic, because any error in ∇z^[L] is multiplied by B and can dominate at the large batch sizes shown in Fig. 3.
minor comments (4)
  1. [Section V.D.1 and Fig. 4] The text says the 6-layer MLP experiment uses the SVHN and CIFAR-10 datasets, while the Fig. 4 caption says MNIST and CIFAR-10; please correct the inconsistency.
  2. [Abstract and Section V] The abstract and introduction mention transformer-based networks, but no transformer architecture appears in the experiments; either add such an experiment or remove that claim.
  3. [Section IV.C] The notation for batch-averaged gradients (e.g., ∇a[1] versus ∇a^(1)(n)) is easy to confuse because the overline is not consistently rendered throughout the text; a single notation for sample-level and batch-averaged quantities would improve readability.
  4. [Section V.E] The model name 'Resnet18' appears with inconsistent capitalization; please unify it with 'ResNet18' used elsewhere.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the label-recovery formula is a direct inversion of the softmax-gradient identity, and the only same-author citation is for evaluation metrics.

full rationale

The derivation chain is not circular. Eq. (1), ∇z = p − y, is the standard softmax cross-entropy gradient identity; the paper then derives layer-wise bridge identities (Lemmas 1-4, Theorems 1-2, Eqs. 17-19) that propagate a shared bottom-layer gradient ∇W[1] to a batch-averaged logit gradient ∇zbar[L] using known server-side weights and auxiliary-data feature estimates. Eq. (21), λ = B(ep − ∇zbar[L]), is the batched rearrangement of Eq. (1) after substituting the auxiliary probability estimate ep; the recovered label counts are not fitted to the attack's own output. The formula's inputs—shared gradient, known model weights, auxiliary features/probabilities—do not already contain the victim labels, and the label counts are not used to estimate those inputs. Assumptions 1 and 2 are empirical approximation assumptions, not definitions of the target labels. The custom positive initialization and the ResNet pooling replacement are experimental validity and generality limitations, and the paper itself notes it focuses on the early training stage; these weaken the claimed scope but are not circularity. The only direct same-author citation, [9], is used solely to name the InsAcc/ClsAcc metrics, so it is a minor self-citation that is not load-bearing. The central claim therefore retains independent mathematical and empirical content.

Assumptions & free parameters 4 free parameters · 7 assumptions · 0 invented entities

The central claim rests on two similarity assumptions, an unstated rank condition, and a simplified architecture model. No new physical or conceptual entities are introduced.

free parameters (4)
  • Bottom-layer weight initialization range = Uniform(0.01, 0.2)
    Chosen by hand to keep estimated features positive so division by a in Eqs (14) and (17) is well-defined. Fig 5b shows accuracy drops with default Kaiming initialization.
  • Auxiliary sample count and class balance = 1000 samples, evenly distributed
    The size and composition of the auxiliary set used to form â and p̂ are hand-picked. They are not tuned to the victim batch but affect accuracy, as shown in Table II.
  • Shared gradient layer index = Penultimate layer by default
    The default experimental setting provides the gradient of the penultimate layer, close to the output, while the threat model describes sharing a single bottom layer. Performance varies with layer choice, as shown in Fig 4.
  • Batch size B = 64 default; evaluated 2 to 512
    Eq (21) requires B to recover label counts, and Fig 3 shows accuracy depends strongly on batch size. The paper assumes B is known to the attacker without explaining how.
assumptions (7)
  • standard math The weight matrices W^[l] in every FC layer traversed by the bridge satisfy that W^[l]W^[l]^T is invertible, and the feature vectors x have non-zero norm (Lemma 2, Eq 9).
    The derivation of ∇z = (WW^T)^{-1}W∇x requires full row rank of W and nonzero x; the paper does not state these conditions.
  • domain assumption The victim's batch size B is known to the attacker (Eq 21, λ = B(p̂ − ∇z̄)).
    Label count recovery multiplies and divides by B; the paper never explains how the attacker learns B in the threat model.
  • domain assumption Assumption 1: activation features a^[1](n) in the shared layer are approximately identical across samples in the batch and equal to auxiliary features â (Section IV.C).
    This allows the batch-averaged gradient formula Eq (17). It is only visually verified on ResNet18 at early training.
  • domain assumption Assumption 2: softmax probabilities p(n) are approximately identical across samples and equal to auxiliary probabilities p̂ (Section IV.D).
    This is used to derive the label vector λ from ∇z̄ (Eq 21). It holds mainly near initialization.
  • ad hoc to paper ReLU activations along the bridge are non-zero so element-wise division ⊘ by a is valid (Theorems 1-2).
    The paper assumes non-zero a; experiments replace zero features with the mean of non-zero elements, an ad hoc fix outside the derivation.
  • domain assumption The target model is attacked only at the early stage of FL training (Threat Model, Section III.C; Conclusion).
    The attack's feature and probability similarity estimates break down after training; the conclusion explicitly limits GDBR to early training.
  • domain assumption The bridged architecture contains only FC-ReLU and Conv-ReLU stacks with no bias, pooling, BatchNorm, or residual connections (Section IV).
    The derivation ignores bias and pooling and does not analyze normalization or residuals, yet evaluated models such as LeNet, AlexNet, VGG, and ResNet include them.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GDBR: Label Recovery Attack Against Partial Gradient Encryption in Federated Learning." pith.science (2026). https://pith.science/paper/2LKZJHFF

@misc{pith2026241212640,
  author       = {Pith},
  title        = {Pith review of: GDBR: Label Recovery Attack Against Partial Gradient Encryption in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2LKZJHFF}},
  note         = {Machine review of arXiv:2412.12640}
}
read the original abstract

The increasing demand for data privacy, alongside the benefits of aggregating data from networked devices, has catalyzed the emergence of federated learning (FL). In FL, clients jointly train a global model by sharing gradients computed over private data. While this paradigm eliminates the need to exchange raw data, inference attacks can still be launched to extract sensitive information from gradients. To this end, partial gradient encryption has emerged as a promising design for balancing privacy and efficiency in practical FL systems, as encrypting only the classification-head gradients is believed to prevent known inference attacks while avoiding the high computational cost of encrypting the entire model. However, this design provides a false sense of privacy. By proposing GDBR, we show that sharing even a single unencrypted layer of gradients can lead to serious privacy leakage. GDBR is the first attack capable of high-fidelity label recovery with partial access to the gradients. It exploits a vulnerability in a commonly used neural building block, constructs a gradient bridge from the unencrypted layer to the final output layer, and approximates the logits information for accurate inference of private labels. These inferred labels not only reveal sensitive information about a client's private dataset but also serve as a prerequisite for many downstream attacks, such as data reconstruction and membership inference. GDBR brings these threats squarely into scope for FL systems employing partial encryption. In addition to theoretical analysis, extensive experiments demonstrate the severity of the problem across a wide variety of datasets and model architectures, including convolutional and transformer-based networks. Overall, our findings challenge the widespread assumption that encrypting only the output layer suffices for privacy protection.

Figures

Figures reproduced from arXiv: 2412.12640 by the authors.

Figure 1
Figure 1. Illustration of our Gradient Bridge (GDBR) attack. The [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The distributions of input features and output probabilities of the FC layer in ResNet18, which is trained on the CIFAR [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Comparison of GDBR with baselines on InsAcc and ClsAcc across different datasets and batch sizes. The experiments [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Comparison of utilized gradients from different layers [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Comparison of gradient simulation modes for baselines [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 22 canonical work pages

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  2. [2]

    Towards federated learning at scale: System design,

    K. Bonawitz, H. Eichner, W. Grieskamp, D. Huba, A. Ingerman, V . Ivanov, C. Kiddon, J. Kone ˇcn`y, S. Mazzocchi, B. McMahan et al. , “Towards federated learning at scale: System design,” in Proceedings of Machine Learning and Systems (MLSys) , 2019, pp. 374–388

    work page 2019

  3. [3]

    Beyond inferring class representatives: User-level privacy leakage from federated learning,

    Z. Wang, M. Song, Z. Zhang, Y . Song, Q. Wang, and H. Qi, “Beyond inferring class representatives: User-level privacy leakage from federated learning,” in IEEE INFOCOM 2019-IEEE conference on computer communications. IEEE, 2019, pp. 2512–2520

    work page 2019

  4. [4]

    A framework for evaluating gradient leakage attacks in federated learning,

    W. Wei, L. Liu, M. Loper, K.-H. Chow, M. E. Gursoy, S. Truex, and Y . Wu, “A framework for evaluating gradient leakage attacks in federated learning,” in ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18,

    work page 2020

  5. [5]

    A survey on gradient inversion: Attacks, defenses and future directions,

    R. Zhang, S. Guo, J. Wang, X. Xie, and D. Tao, “A survey on gradient inversion: Attacks, defenses and future directions,” in Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, 2023, pp. 5678–685

    work page 2023

  6. [6]

    Revealing and protecting labels in distributed training,

    T. Dang, O. Thakkar, S. Ramaswamy, R. Mathews, P. Chin, and F. Beaufays, “Revealing and protecting labels in distributed training,” in Advances in Neural Information Processing Systems (NeurIPS) , 2021

    work page 2021

  7. [7]

    Towards general deep leakage in federated learning,

    J. Geng, Y . Mou, F. Li, Q. Li, O. Beyan, S. Decker, and C. Rong, “Towards general deep leakage in federated learning,” arXiv preprint arXiv:2110.09074, 2021

    arXiv 2021

  8. [8]

    User-level label leakage from gradients in federated learning,

    A. Wainakh, F. Ventola, T. M ¨ußig, J. Keim, C. G. Cordero, E. Zimmer, T. Grube, K. Kersting, and M. M ¨uhlh¨auser, “User-level label leakage from gradients in federated learning,” Proceedings on Privacy Enhanc- ing Technologies, vol. 2, pp. 227–244, 2022

    work page 2022

Show all 40 references
  1. [9]

    Posterior probability-based label recovery attack in federated learning,

    R. Zhang, S. Guo, and P. Li, “Posterior probability-based label recovery attack in federated learning,” in Privacy Regulation and Protection in Machine Learning, 2024

    2024

  2. [10]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Advances in Neural Information Processing Systems (NeurIPS) , 2019

    2019

  3. [11]

    Gradvit: Gradient inversion of vision transformers,

    A. Hatamizadeh, H. Yin, H. R. Roth, W. Li, J. Kautz, D. Xu, and P. Molchanov, “Gradvit: Gradient inversion of vision transformers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10 021–10 030

    2022

  4. [12]

    Graddiff: Gradient-based membership inference attacks against federated distillation with differential compar- ison,

    X. Wang, L. Wu, and Z. Guan, “Graddiff: Gradient-based membership inference attacks against federated distillation with differential compar- ison,” Information Sciences, vol. 658, p. 120068, 2024

    2024

  5. [13]

    Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models,

    S. Mehnaz, S. V . Dibbo, R. De Viti, E. Kabir, B. B. Brandenburg, S. Mangard, N. Li, E. Bertino, M. Backes, E. De Cristofaro et al. , “Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models,” in 31st USENIX Security Sy...

    2022

  6. [14]

    Privacy-preserving deep learning via additively homomorphic encryption,

    Y . Aono, T. Hayashi, L. Wang, S. Moriaiet al., “Privacy-preserving deep learning via additively homomorphic encryption,” IEEE transactions on information forensics and security, vol. 13, no. 5, pp. 1333–1345, 2017

    2017

  7. [15]

    {BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu, “ {BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning,” in 2020 USENIX annual technical conference (USENIX ATC 20) , 2020, pp. 493–506

    2020

  8. [16]

    Evaluating gradient inversion attacks and defenses in federated learning,

    Y . Huang, S. Gupta, Z. Song, K. Li, and S. Arora, “Evaluating gradient inversion attacks and defenses in federated learning,” Advances in neural information processing systems , vol. 34, pp. 7232–7241, 2021

    2021

  9. [17]

    Securing distributed sgd against gradient leakage threats,

    W. Wei, L. Liu, J. Zhou, K.-H. Chow, and Y . Wu, “Securing distributed sgd against gradient leakage threats,” IEEE Transactions on Parallel and Distributed Systems, vol. 34, no. 7, pp. 2040–2054, 2023

    2023

  10. [18]

    Partially encrypted multi- party computation for federated learning,

    E. Sotthiwat, L. Zhen, Z. Li, and C. Zhang, “Partially encrypted multi- party computation for federated learning,” in 2021 IEEE/ACM 21st International Symposium on Cluster, Cloud and Internet Computing (CCGrid). IEEE, 2021, pp. 828–835

    2021

  11. [19]

    Combining variational model- ing with partial gradient perturbation to prevent deep gradient leakage,

    D. Scheliga, P. M ¨ader, and M. Seeland, “Combining variational model- ing with partial gradient perturbation to prevent deep gradient leakage,” arXiv preprint arXiv:2208.04767 , 2022

    2022 arXiv

  12. [20]

    Fedvf: Personalized federated learning based on layer-wise parameter updates with variable frequency,

    Y . Mei, B. Guo, D. Xiao, and W. Wu, “Fedvf: Personalized federated learning based on layer-wise parameter updates with variable frequency,” in 2021 IEEE International Performance, Computing, and Communica- tions Conference (IPCCC) . IEEE, 2021, pp. 1–9

    2021

  13. [21]

    Inverting gradients – how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients – how easy is it to break privacy in federated learning?” in Advances in Neural Information Processing Systems (NeurIPS) , 2020, pp. 16 937–16 947

    2020

  14. [22]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 16 337–16 346

    2021

  15. [23]

    R-gap: Recursive gradient attack on privacy,

    J. Zhu and M. Blaschko, “R-gap: Recursive gradient attack on privacy,” in International Conference on Learning Representations (ICLR) , 2021

    2021

  16. [24]

    Recovering private text in federated learning of language models,

    S. Gupta, Y . Huang, Z. Zhong, T. Gao, K. Li, and D. Chen, “Recovering private text in federated learning of language models,” Advances in Neural Information Processing Systems , vol. 35, pp. 8130–8143, 2022

    2022

  17. [25]

    Lamp: Extracting text from gradients with language model priors,

    M. Balunovic, D. Dimitrov, N. Jovanovi ´c, and M. Vechev, “Lamp: Extracting text from gradients with language model priors,” Advances in Neural Information Processing Systems , vol. 35, pp. 7641–7654, 2022

    2022

  18. [26]

    A method to reveal speaker identity in distributed asr training, and how to counter it,

    T. Dang, O. Thakkar, S. Ramaswamy, R. Mathews, P. Chin, and F. Beau- fays, “A method to reveal speaker identity in distributed asr training, and how to counter it,” in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 20...

    2022

  19. [27]

    idlg: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” arXiv preprint arXiv:2001.02610 , 2020

    2001 arXiv

  20. [28]

    Instance-wise batch label restoration via gradients in federated learning,

    K. Ma, Y . Sun, J. Cui, D. Li, Z. Guan, and J. Liu, “Instance-wise batch label restoration via gradients in federated learning,” in The Eleventh International Conference on Learning Representations , 2023

    2023

  21. [29]

    Robbing the fed: Directly obtaining private data in federated learn- ing with modified models,

    L. H. Fowl, J. Geiping, W. Czaja, M. Goldblum, and T. Goldstein, “Robbing the fed: Directly obtaining private data in federated learn- ing with modified models,” in International Conference on Learning Representations, 2021

    2021

  22. [30]

    D. E. Rumelhart, G. E. Hinton, and R. J. Williams, “Learning internal representations by error propagation, parallel distributed processing, explorations in the microstructure of cognition, ed. de rumelhart and j. mcclelland. vol. 1. 1986,” Biometrika, vol. 71, no. 599-607, p. 6, 1986

    1986

  23. [31]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  24. [32]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” Advances in neural informa- tion processing systems , vol. 25, 2012

    2012

  25. [33]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  26. [34]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  27. [35]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, A. Y . Ng et al. , “Reading digits in natural images with unsupervised feature learning,” in NIPS workshop on deep learning and unsupervised feature learning , vol. 2011, no. 2. Granada, 2011, p. 4

    2011

  28. [36]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” Technical report, University of Toronto, 2009

    2009

  29. [37]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition . Ieee, 2009, pp. 248–255

    2009

  30. [38]

    Pytorch: An imperative style, high-performance deep learning library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al. , “Pytorch: An imperative style, high-performance deep learning library,” Advances in neural information processing systems , vol. 32, 2019

    2019

  31. [39]

    Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,

    K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” in Proceedings of the IEEE international conference on computer vision , 2015, pp. 1026–1034

    2015

  32. [2020]

    Springer, 2020, pp. 545–566

    2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.