Research map / Federated learning and privacy / Privacy attacks and secure learning
High-Fidelity Gradient Inversion in Distributed Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a two-stage gradient inversion attack that recovers batch labels via an evolutionary CV-based algorithm and reconstructs high-resolution (224x224) images via stepwise gradient matching with gradient dropout and image priors.
Problem
Gradient inversion attacks in distributed learning struggle with high-resolution images, large batch sizes, complex models, and batches containing repeated labels, leading to low-fidelity or failed reconstructions.
Approach
Infers batch labels by minimizing the coefficient of variation of sorted features from auxiliary data with an evolutionary search, then introduces ground-truth gradient layers stepwise from deep to shallow with gradient dropout to avoid spatial offset, and schedules TV and batch-norm priors.
Key results
- On batch size 8 with 224x224 ImageNet images on ResNet34, the method reaches LPIPS 0.33, PSNR 15.12, SSIM 0.49, versus 0.39 LPIPS for GradInversion.
- Evolutionary label inference recovers labels of all 64 tested images accurately, where GradInversion fails on repeated labels.
- Ablation shows the full pipeline with scheduling reaches LPIPS 0.23 and PSNR 15.99 at batch size 8.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use Ours instead of GradInversion | ResNet34 gradient inversion · ImageNet, batch size 8 | LPIPS: 0.39 -> 0.33 | Helped |
| use Ours instead of GradInversion | ResNet34 gradient inversion · ImageNet, batch size 8 | PSNR: 13.22 -> 15.12 | Helped |
| use Ours instead of GradInversion | ResNet34 gradient inversion · ImageNet, batch size 8 | SSIM: 0.44 -> 0.49 | Helped |
| add image prior Rimage to gradient matching only (ablation) | ResNet34 gradient inversion · ImageNet, batch size 8 | LPIPS: 0.80 -> 0.57 | Helped |
| add image prior Rimage to gradient matching only (ablation) | ResNet34 gradient inversion · ImageNet, batch size 8 | PSNR: 8.34 -> 10.79 | Helped |
| add image prior Rimage to gradient matching only (ablation) | ResNet34 gradient inversion · ImageNet, batch size 8 | SSIM: 0.27 -> 0.34 | Helped |
| replace `grad with stepwise objective ˜`grad (ablation) | ResNet34 gradient inversion with Rimage · ImageNet, batch size 8 | LPIPS: 0.57 -> 0.27 | Helped |
| replace `grad with stepwise objective ˜`grad (ablation) | ResNet34 gradient inversion with Rimage · ImageNet, batch size 8 | PSNR: 10.79 -> 14.71 | Helped |
| replace `grad with stepwise objective ˜`grad (ablation) | ResNet34 gradient inversion with Rimage · ImageNet, batch size 8 | SSIM: 0.34 -> 0.50 | Helped |
| add loss scheduling (ablation) | ResNet34 stepwise gradient inversion with Rimage · ImageNet, batch size 8 | LPIPS: 0.27 -> 0.23 | Helped |
| add loss scheduling (ablation) | ResNet34 stepwise gradient inversion with Rimage · ImageNet, batch size 8 | PSNR: 14.71 -> 15.99 | Helped |
| add loss scheduling (ablation) | ResNet34 stepwise gradient inversion with Rimage · ImageNet, batch size 8 | SSIM: 0.50 -> 0.55 | Helped |
Surprising findings
- Gradients from shallow block 1 degrade reconstruction quality when added, and the deepest block alone carries most of the information.
- Simple additive noise and 90% gradient pruning do not effectively resist the attack.
Limitations
- Assumes the number of training samples in the batch is known.
- Requires publicly available auxiliary data to be collected for label inference.
- Results shown mainly on ResNet34 and at batch sizes up to 32 in main experiments.
Experimental setup
Datasets: ImageNet ILSVRC 2012 Web images (40 auxiliary)
Benchmarks: ImageNet ILSVRC 2012 validation images
Metrics: LPIPS PSNR SSIM label inference accuracy
Baselines: Deep Leakage from Gradients Inverting Gradients GradInversion
Builds on: DLG Inverting Gradients GradInversion DeepInversion iDLG
Closest papers by meaning
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.88)
- Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attacks (AAAI 2024 · similarity 0.88)
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.88)
- Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks (ICLR 2024 · similarity 0.87)
- Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspective (AAAI 2024 · similarity 0.87)
- Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.