Research map / Federated learning and privacy / Privacy attacks and secure learning
Gradient inversion attacks
Reconstruct training data from shared gradients and defend against such leakage.
47 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2020–2026) · an approach in Privacy attacks and secure learning, keyword cluster “attack · defense · backdoor”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
19 papers in 2023–24 and 12 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 14.5% to 8.5%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2020 · Inverting Gradients - How easy is it to break privacy in federated learning? (NeurIPS 2020 · 206 citations)
- 2021 · Soteria: Provable Defense Against Privacy Leakage in Federated Learning From Representation Perspective (CVPR 2021 · 168 citations)
- 2022 · Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakage (CVPR 2022 · 131 citations)
- 2023 · Dropout Is NOT All You Need to Prevent Gradient Leakage (AAAI 2023 · 18 citations)
- 2024 · Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · 23 citations)
- 2025 · A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · 12 citations)
- 2026 · Temporal Gradient Inversion for Private Trajectory Reconstruction in Embodied Reinforcement Learning (NeurIPS 2026 · 0 citations)
Earliest papers here
- Inverting Gradients - How easy is it to break privacy in federated learning? (NeurIPS 2020 · 206 citations)
- Soteria: Provable Defense Against Privacy Leakage in Federated Learning From Representation Perspective (CVPR 2021 · 168 citations)
- Evaluating Gradient Inversion Attacks and Defenses in Federated Learning (NeurIPS 2021 · 122 citations)
What has been tried
39 papers here report 421 measured changes (a component added, removed or swapped, compared with a baseline): helped 57%, no clear effect 9%, hurt 27%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add image prior Rimage to gradient matching only | ImageNet, batch size 8 · LPIPS | 0.80 -> 0.57 | Helped | High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · 16 citations) |
| increase λg from 0.5 to 1.0 | TinyImageNet, Imprint attack · SSIM | 0.80 -> 0.78 | Helped | Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · 13 citations) |
| increase k1+k2 from 48% to 80% | CIFAR10, Rob attack · LPIPS | 0.426 -> 0.527 | Helped | Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attacks (AAAI 2024 · 10 citations) |
| Apply rank-threshold heuristic when gradients are full rank | CoLA, B=128 · ROUGE-1 | 0 -> 30.3 | Helped | DAGER: Exact Gradient Inversion for Large Language Models (NeurIPS 2024 · 10 citations) |
| Increase Inverting Gradients batch size from 4 to 16 | CIFAR-10 test · accuracy | 90.34% -> 76.83% | Hurt | Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · 7 citations) |
| Increase batch size | CIFAR-100 · patch recovery rate | Hurt | Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning (CVPR 2025 · 6 citations) | |
| Add the M-Adaptive Process | MNIST, ε=10 · PSNR_i | 32.98 -> 33.09 | Helped | Mjölnir: Breaking the Shield of Perturbation-Protected Gradients via Adaptive Diffusion (AAAI 2025 · 5 citations) |
| Add the second stage of the greedy reconstruction algorithm | Image reconstruction across batch sizes · accuracy | Helped | SPEAR: Exact Gradient Inversion of Batches in Federated Learning (NeurIPS 2024 · 4 citations) | |
| Train critical parameters rather than all parameters | CIFAR10, non-IID, FedAvg · MSE | 0.0069 -> 0.0123 | Hurt | DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans (NeurIPS 2024 · 3 citations) |
| Vary the STRIKE attack-strength parameter ν | ImageNet-12 · accuracy | Mixed | Exploit Gradient Skewness to Circumvent Byzantine Defenses for Federated Learning (AAAI 2025 · 2 citations) | |
| Reduce the auxiliary dataset to 5 samples per class | SVHN and Tiny-ImageNet · iAcc | No clear effect | Recovering Labels from Local Updates in Federated Learning (ICML 2024 · 1 citation) | |
| Use histogram statistics rather than KMeans cluster centers or a fitted Gaussian to characterize conformity-score distributions | Federated conformal prediction Byzantine setting · performance | Helped | Certifiably Byzantine-Robust Federated Conformal Prediction (ICML 2024 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 7 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 4 of 7 papers
- Fashion-MNIST · 3 of 7 papers
- CIFAR-100 · 3 of 7 papers
- CINIC-10 · 2 of 7 papers
- TinyImageNet · 2 of 7 papers
Baselines
- DLG · 3 of 7 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 31 papers; from OpenAlex and the papers' affiliations).
- Harbin Institute of Technology · 2 papers
- Tsinghua University · 2 papers
- Zhejiang University · 2 papers
- Purdue University · 2 papers
- Swiss Federal Institute of Technology · 2 papers
- ETH Zurich · 2 papers
Use it
Download BibTeX of 35 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Defending federated learning against poisoning (76 papers)
- Membership inference and auditing (47 papers)
Elsewhere in the topic
- Encryption-based private learning (105 papers)
- Private federated aggregation (50 papers)
- Visual privacy and face de-identification (39 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).