Research map / Federated learning and privacy / Privacy attacks and secure learning

A New Federated Learning Framework Against Gradient Inversion Attacks

AAAI 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Gradient inversion attacks · 12 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes HyperFL, a federated learning framework where each client's feature extractor is generated by a local hypernetwork from a private client embedding, so only hypernetwork parameters are shared, defending against gradient inversion attacks without SMC/HE/DP.

Problem

Gradient inversion attacks can reconstruct private training images from gradients shared in federated learning, and existing defenses (SMC, HE, DP) incur substantial privacy-utility or computation trade-offs.

Approach

Break the direct connection between shared parameters and private data: each client's feature extractor is produced by a hypernetwork from a private trainable client embedding, classifiers and embeddings stay local, and only hypernetwork parameters are averaged on the server; an HyperFL-LPM variant generates adapters for frozen pre-trained ViT/ResNet.

Key results

• HyperFL reaches 76.29% on EMNIST (20 clients) and 73.03% on CIFAR-10 (20 clients), above FedAvg (72.77%, 70.02%) and all listed DP-based methods, though pFedHN is higher on EMNIST with 20 clients (80.86%).
• Against Inverting Gradients (IG) attack on EMNIST, HyperFL yields PSNR 7.85 and LPIPS 0.7147 versus FedAvg's PSNR 32.64 and LPIPS 0.0526.
• Per-round training time on EMNIST with 20 clients is 37 s for HyperFL versus 23 s for FedAvg and 194–223 s for DP-based methods.

Measured effects reported in the paper

Surprising findings

• DP-based baselines and CENTAUR/PPSGD were adapted to the ISRL-DP setting, and HyperFL's reconstruction quality is similar to DP methods' while accuracy is higher.

Limitations

• Privacy evaluation is empirical (IG, ROG, and a tailored attack) and no formal privacy guarantee is provided.
• pFedHN outperforms HyperFL on EMNIST with 20 clients and CIFAR-10 with 100 clients.
• Convergence analysis relies on smoothness, bounded-variance and bounded-gradient assumptions, and the PL extension is an additional assumption.

Experimental setup

Datasets: EMNIST Fashion-MNIST CIFAR-10 CINIC-10

Benchmarks: EMNIST Fashion-MNIST CIFAR-10 CINIC-10

Metrics: test accuracy PSNR SSIM LPIPS

Baselines: Local-only FedAvg pFedHN DP-FedAvg PPSGD CENTAUR

Builds on: FedAvg pFedHN hypernetworks adapter tuning

Closest papers by meaning

• Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.89)
• Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning (CVPR 2025 · similarity 0.89)
• Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.88)
• DictPFL: Efficient and Private Federated Learning on Encrypted Gradients (NeurIPS 2025 · similarity 0.88)
• Privacy-Preserving Federated Convex Optimization: Balancing Partial-Participation and Efficiency via Noise Cancellation (ICML 2025 · similarity 0.88)
• Clients Collaborate: Flexible Differentially Private Federated Learning with Guaranteed Improvement of Utility-Privacy Trade-off (ICML 2025 · similarity 0.87)