SoK: Gradient Inversion Attacks in Federated Learning
summary
Systematization of 107 papers finds 107 papers reviewed (2016–2025), defines eight threat models (passive A–E to active variants), and classifies gradient inversion attacks into three attack categories: optimization-based, generative-model-based, and analytic/model-manipulation attacks. Results show Fed-style SGD with small batches and surrogate data makes optimization and latent-space attacks notably effective; defenses map to client/aggregation/server defenses (input/model/update masking, secure MPC, central/local DP) and evaluation splits into image-similarity vs recognition metrics; gaps include non-classification tasks, active-server stealth defenses, and surrogate-data distribution analysis.
AI-written summary · about
chapters (8)
- 0:00Federated learning intro
- 1:57Gradient inversion attacks
- 2:41Threat models
- 5:09Attack categories
- 8:00Defensive measures
- 14:17Attack evaluation
- 15:40Open challenges
- 16:41Q&A
related talks
02h 13mUnderstanding Security Threats Against Machine/Deep Learning Applications
21mAdversarial Attacks
36mAdversarial Attacks on Deep Learning
38mUsing adversarial samples to robustify your Neural Network Models
36mAdversarial Machine Learning: How Secure Is ML?
28mSecurity of Machine Learning
29mBalancing Thin Line Between Data Intelligence & Privacy
45mSchemes, Privacy, and Security