{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,14]],"date-time":"2026-02-14T05:32:07Z","timestamp":1771047127721,"version":"3.50.1"},"reference-count":121,"publisher":"Springer Science and Business Media LLC","issue":"9","license":[{"start":{"date-parts":[[2025,7,17]],"date-time":"2025-07-17T00:00:00Z","timestamp":1752710400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"},{"start":{"date-parts":[[2025,7,17]],"date-time":"2025-07-17T00:00:00Z","timestamp":1752710400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"}],"funder":[{"name":"the National Science Foundation of China","award":["62406129"],"award-info":[{"award-number":["62406129"]}]},{"name":"the National Science Foundation of China","award":["62272201"],"award-info":[{"award-number":["62272201"]}]},{"name":"the Wuxi Science and Technology Development Fund Project","award":["K20231012"],"award-info":[{"award-number":["K20231012"]}]},{"name":"Basic Scientific Research Business Fund Project at Central Universities","award":["22520231033"],"award-info":[{"award-number":["22520231033"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Complex Intell. Syst."],"published-print":{"date-parts":[[2025,9]]},"DOI":"10.1007\/s40747-025-02009-1","type":"journal-article","created":{"date-parts":[[2025,7,17]],"date-time":"2025-07-17T16:51:20Z","timestamp":1752771080000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Privacy attack in federated learning is not easy: an experimental study"],"prefix":"10.1007","volume":"11","author":[{"given":"Hangyu","family":"Zhu","sequence":"first","affiliation":[]},{"given":"Liyuan","family":"Huang","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9481-9599","authenticated-orcid":false,"given":"Zhenping","family":"Xie","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,7,17]]},"reference":[{"key":"2009_CR1","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/7068349","author":"A Voulodimos","year":"2018","unstructured":"Voulodimos A, Doulamis N, Doulamis A, Protopapadakis E, Andina D (2018) Deep learning for computer vision: a brief review. Intell Neurosci. https:\/\/doi.org\/10.1155\/2018\/7068349","journal-title":"Intell Neurosci"},{"key":"2009_CR2","doi-asserted-by":"publisher","first-page":"603","DOI":"10.1007\/978-81-322-3972-7_19","volume-title":"Natural language processing","author":"KR Chowdhary","year":"2020","unstructured":"Chowdhary KR (2020) Natural language processing. Springer India, New Delhi, pp 603\u2013649. https:\/\/doi.org\/10.1007\/978-81-322-3972-7_19"},{"issue":"10","key":"2009_CR3","doi-asserted-by":"publisher","DOI":"10.1088\/1361-6501\/ad633d","volume":"35","author":"H Tao","year":"2024","unstructured":"Tao H, Zheng Y, Wang Y, Qiu J, Stojanovic V (2024) Enhanced feature extraction yolo industrial small object detection algorithm based on receptive-field attention and multi-scale features. Measur Sci Technol 35(10):105023. https:\/\/doi.org\/10.1088\/1361-6501\/ad633d","journal-title":"Measur Sci Technol"},{"issue":"10","key":"2009_CR4","doi-asserted-by":"publisher","first-page":"3473","DOI":"10.1002\/acs.3885","volume":"38","author":"Z Peng","year":"2024","unstructured":"Peng Z, Song X, Song S, Stojanovic V (2024) Spatiotemporal fault estimation for switched nonlinear reaction diffusion systems via adaptive iterative learning. Int J Adapt Control Signal Process 38(10):3473\u20133483. https:\/\/doi.org\/10.1002\/acs.3885","journal-title":"Int J Adapt Control Signal Process"},{"issue":"16","key":"2009_CR5","doi-asserted-by":"publisher","first-page":"10990","DOI":"10.1002\/rnc.7553","volume":"34","author":"X Song","year":"2024","unstructured":"Song X, Peng Z, Song S, Stojanovic V (2024) Interval observer design for unobservable switched nonlinear partial differential equation systems and its application. Int J Robust Nonlinear Control 34(16):10990\u201311009","journal-title":"Int J Robust Nonlinear Control"},{"issue":"7553","key":"2009_CR6","doi-asserted-by":"publisher","first-page":"436","DOI":"10.1038\/nature14539","volume":"521","author":"Y LeCun","year":"2015","unstructured":"LeCun Y, Bengio Y, Hinton G (2015) Deep learning. Nature 521(7553):436\u2013444","journal-title":"Nature"},{"issue":"6","key":"2009_CR7","doi-asserted-by":"publisher","first-page":"305","DOI":"10.1038\/s42256-020-0186-1","volume":"2","author":"GA Kaissis","year":"2020","unstructured":"Kaissis GA, Makowski MR, R\u00fcckert D, Braren RF (2020) Secure, privacy-preserving and federated machine learning in medical imaging. Nat Mach Intell 2(6):305\u2013311","journal-title":"Nat Mach Intell"},{"key":"2009_CR8","unstructured":"Fredrikson M, Lantz E, Jha S, Lin S, Page D, Ristenpart T (2014) Privacy in pharmacogenetics: An $$\\{$$End-to-End$$\\}$$ case study of personalized warfarin dosing. In: 23rd USENIX security symposium (USENIX Security 14), pp 17\u201332"},{"key":"2009_CR9","unstructured":"McPherson R, Shokri R, Shmatikov V (2016) Defeating image obfuscation with deep learning. arXiv preprint arXiv:1609.00408"},{"key":"2009_CR10","unstructured":"Regulation P (2016) Regulation (eu) 2016\/679 of the European parliament and of the council. Regulation (eu) 679:2016"},{"key":"2009_CR11","unstructured":"McMahan B, Moore E, Ramage D, Hampson S, y\u00a0Arcas BA (2017) Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics, PMLR, pp 1273\u20131282"},{"issue":"2","key":"2009_CR12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3298981","volume":"10","author":"Q Yang","year":"2019","unstructured":"Yang Q, Liu Y, Chen T, Tong Y (2019) Federated machine learning: concept and applications. ACM Trans Intell Syst Technol (TIST) 10(2):1\u201319","journal-title":"ACM Trans Intell Syst Technol (TIST)"},{"key":"2009_CR13","unstructured":"Hard A, Rao K, Mathews R, Ramaswamy S, Beaufays F, Augenstein S, Eichner H, Kiddon C, Ramage D (2018) Federated learning for mobile keyboard prediction. arXiv preprint arXiv:1811.03604"},{"key":"2009_CR14","doi-asserted-by":"crossref","unstructured":"Liu Y, Huang A, Luo Y, Huang H, Liu Y, Chen Y, Feng L, Chen T, Yu H, Yang Q (2020) Fedvision: an online visual object detection platform powered by federated learning. In: Proceedings of the AAAI Conference on artificial intelligence 34:13172\u201313179","DOI":"10.1609\/aaai.v34i08.7021"},{"key":"2009_CR15","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3550025","author":"Y Liu","year":"2025","unstructured":"Liu Y, Liu Y, Zhang W, Zheng C, Jiang W, Luo D, Qiao Q, Meng L, Zhao H, Yang S (2025) Symbiosis rather than aggregation: towards generalized federated learning via model symbiosis. IEEE Internet of Things J. https:\/\/doi.org\/10.1109\/JIOT.2025.3550025","journal-title":"IEEE Internet of Things J"},{"key":"2009_CR16","doi-asserted-by":"publisher","unstructured":"Kang Y, He Y, Luo J, Fan T, Liu Y, Yang Q (2024) Privacy-preserving federated adversarial domain adaptation over feature groups for interpretability. IEEE Trans Big Data 10(6):879\u2013890. https:\/\/doi.org\/10.1109\/TBDATA.2022.318829252","DOI":"10.1109\/TBDATA.2022.318829252"},{"key":"2009_CR17","unstructured":"Fang M, Cao X, Jia J, Gong N (2020) Local model poisoning attacks to $$\\{$$Byzantine-Robust$$\\}$$ federated learning. In: 29th USENIX Security Symposium (USENIX Security 20), pp 1605\u20131622"},{"key":"2009_CR18","unstructured":"Bhagoji AN, Chakraborty S, Mittal P, Calo S (2019) Analyzing federated learning through an adversarial lens. In: International Conference on machine learning, PMLR, pp 634\u2013643"},{"key":"2009_CR19","doi-asserted-by":"crossref","unstructured":"Cao X, Gong NZ (2022) Mpaf: Model poisoning attacks to federated learning based on fake clients. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pp 3396\u20133404","DOI":"10.1109\/CVPRW56347.2022.00383"},{"key":"2009_CR20","doi-asserted-by":"publisher","unstructured":"Zhou X, Xu M, Wu Y, Zheng N (2021) Deep model poisoning attack on federated learning. Future Internet 13(3). https:\/\/doi.org\/10.3390\/fi13030073, https:\/\/www.mdpi.com\/1999-5903\/13\/3\/73. Accessed 14 Mar 2021","DOI":"10.3390\/fi13030073"},{"key":"2009_CR21","doi-asserted-by":"publisher","unstructured":"Cao D, Chang S, Lin Z, Liu G, Sun D (2019) Understanding distributed poisoning attack in federated learning. In: 2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS), pp 233\u2013239, https:\/\/doi.org\/10.1109\/ICPADS47876.2019.00042","DOI":"10.1109\/ICPADS47876.2019.00042"},{"key":"2009_CR22","first-page":"12613","volume-title":"Advances in neural information processing systems","author":"J Sun","year":"2021","unstructured":"Sun J, Li A, DiValentin L, Hassanzadeh A, Chen Y, Li H (2021) Fl-wbc: enhancing robustness against model poisoning attacks in federated learning from a client perspective. In: Ranzato M, Beygelzimer A, Dauphin Y, Liang P, Vaughan JW (eds) Advances in neural information processing systems, vol 34. Curran Associates Inc., Berlin, pp 12613\u201312624"},{"key":"2009_CR23","unstructured":"Panda A, Mahloujifar S, Nitin\u00a0Bhagoji A, Chakraborty S, Mittal P (2022) Sparsefed: Mitigating model poisoning attacks in federated learning with sparsification. In: Camps-Valls G, Ruiz FJR, Valera I (eds) Proceedings of The 25th International Conference on Artificial Intelligence and Statistics, PMLR, Proceedings of Machine Learning Research, vol 151, pp 7587\u20137624, https:\/\/proceedings.mlr.press\/v151\/panda22a.html"},{"key":"2009_CR24","doi-asserted-by":"crossref","unstructured":"Shejwalkar V, Houmansadr A (2021) Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In: Proceedings 2021 Network and Distributed System Security Symposium https:\/\/api.semanticscholar.org\/CorpusID:231861235. Accessed 25 Feb 2021","DOI":"10.14722\/ndss.2021.24498"},{"key":"2009_CR25","first-page":"16070","volume":"33","author":"H Wang","year":"2020","unstructured":"Wang H, Sreenivasan K, Rajput S, Vishwakarma H, Agarwal S, Jy S, Lee K, Papailiopoulos D (2020) Attack of the tails: yes, you really can backdoor federated learning. Adv Neural Inf Process Syst 33:16070\u201316084","journal-title":"Adv Neural Inf Process Syst"},{"key":"2009_CR26","unstructured":"Bagdasaryan E, Veit A, Hua Y, Estrin D, Shmatikov V (2020) How to backdoor federated learning. In: International Conference on artificial intelligence and statistics, PMLR, pp 2938\u20132948"},{"key":"2009_CR27","unstructured":"Orekondy T, Oh SJ, Zhang Y, Schiele B, Fritz M (2018) Gradient-leaks: Understanding and controlling deanonymization in federated learning. arXiv preprint arXiv:1805.05838"},{"key":"2009_CR28","doi-asserted-by":"crossref","unstructured":"Nasr M, Shokri R, Houmansadr A (2019) Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In: 2019 IEEE symposium on security and privacy (SP), IEEE, pp 739\u2013753","DOI":"10.1109\/SP.2019.00065"},{"key":"2009_CR29","doi-asserted-by":"crossref","unstructured":"Luo X, Wu Y, Xiao X, Ooi BC (2021) Feature inference attack on model predictions in vertical federated learning. In: 2021 IEEE 37th International Conference on Data Engineering (ICDE), IEEE, pp 181\u2013192","DOI":"10.1109\/ICDE51399.2021.00023"},{"key":"2009_CR30","doi-asserted-by":"crossref","unstructured":"Pustozerova A, Mayer R (2020) Information leaks in federated learning. In: Proceedings of the Network and Distributed System Security Symposium, vol\u00a010, p 122","DOI":"10.14722\/diss.2020.23004"},{"key":"2009_CR31","unstructured":"Carlini N, Tramer F, Wallace E, Jagielski M, Herbert-Voss A, Lee K, Roberts A, Brown T, Song D, Erlingsson U, et\u00a0al. (2021) Extracting training data from large language models. In: 30th USENIX Security Symposium (USENIX Security 21), pp 2633\u20132650"},{"key":"2009_CR32","first-page":"994","volume":"34","author":"X Jin","year":"2021","unstructured":"Jin X, Chen PY, Hsu CY, Yu CM, Chen T (2021) Cafe: catastrophic data leakage in vertical federated learning. Adv Neural Inf Process Syst 34:994\u20131006","journal-title":"Adv Neural Inf Process Syst"},{"key":"2009_CR33","unstructured":"Wu R, Chen X, Guo C, Weinberger KQ (2023) Learning to invert: Simple adaptive attacks for gradient inversion in federated learning. In: Uncertainty in Artificial Intelligence, PMLR, pp 2293\u20132303"},{"key":"2009_CR34","first-page":"16937","volume":"33","author":"J Geiping","year":"2020","unstructured":"Geiping J, Bauermeister H, Dr\u00f6ge H, Moeller M (2020) Inverting gradients-how easy is it to break privacy in federated learning? Adv Neural Inf Process Syst 33:16937\u201316947","journal-title":"Adv Neural Inf Process Syst"},{"key":"2009_CR35","unstructured":"Kariyappa S, Guo C, Maeng K, Xiong W, Suh GE, Qureshi MK, Lee HHS (2023) Cocktail party attack: breaking aggregation-based privacy in federated learning using independent component analysis. In: International Conference on Machine Learning, PMLR, pp 15884\u201315899"},{"key":"2009_CR36","doi-asserted-by":"crossref","unstructured":"Yin H, Mallya A, Vahdat A, Alvarez JM, Kautz J, Molchanov P (2021) See through gradients: image batch recovery via gradinversion. In: Proceedings of the IEEE\/CVF Conference on computer vision and pattern recognition, pp 16337\u201316346","DOI":"10.1109\/CVPR46437.2021.01607"},{"key":"2009_CR37","unstructured":"Zhao JC, Sharma A, Elkordy AR, Ezzeldin YH, Avestimehr S, Bagchi S (2023) Secure aggregation in federated learning is not private: leaking user data at large scale through model modification. arXiv preprint arXiv:2303.12233"},{"key":"2009_CR38","unstructured":"Zhu L, Liu Z, Han S (2019) Deep leakage from gradients. In: Wallach H, Larochelle H, Beygelzimer A, d\u2019Alch\u00e9-Buc F, Fox E, Garnett R (eds) Advances in Neural Information Processing Systems, Curran Associates, Inc., vol\u00a032, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2019\/file\/60a6c4002cc7b29142def8871531281a-Paper.pdf. Accessed 8 Dec 2019"},{"key":"2009_CR39","unstructured":"Zhao B, Mopuri KR, Bilen H (2020) idlg: improved deep leakage from gradients. arXiv preprint arXiv:2001.02610"},{"key":"2009_CR40","doi-asserted-by":"crossref","unstructured":"Li Z, Zhang J, Liu L, Liu J (2022) Auditing privacy defenses in federated learning via generative gradient leakage. In: Proceedings of the IEEE\/CVF Conference on computer vision and pattern recognition, pp 10132\u201310142","DOI":"10.1109\/CVPR52688.2022.00989"},{"issue":"4","key":"2009_CR41","first-page":"1","volume":"13","author":"H Ren","year":"2022","unstructured":"Ren H, Deng J, Xie X (2022) Grnn: generative regression neural network a data leakage attack for federated learning. ACM Trans Intell Syst Technol (TIST) 13(4):1\u201324","journal-title":"ACM Trans Intell Syst Technol (TIST)"},{"key":"2009_CR42","unstructured":"Geng J, Mou Y, Li F, Li Q, Beyan O, Decker S, Rong C (2021) Towards general deep leakage in federated learning. arXiv preprint arXiv:2110.09074"},{"key":"2009_CR43","unstructured":"Fowl LH, Geiping J, Czaja W, Goldblum M, Goldstein T (2022) Robbing the fed: Directly obtaining private data in federated learning with modified models. In: International Conference on Learning Representations, https:\/\/openreview.net\/forum?id=fwzUgo0FM9v"},{"key":"2009_CR44","doi-asserted-by":"crossref","unstructured":"Hitaj B, Ateniese G, Perez-Cruz F (2017) Deep models under the gan: information leakage from collaborative deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on computer and communications security, pp 603\u2013618","DOI":"10.1145\/3133956.3134012"},{"key":"2009_CR45","doi-asserted-by":"crossref","unstructured":"Li Z, Wang L, Chen G, Shafq M, et\u00a0al. (2022) A survey of image gradient inversion against federated learning. Authorea Preprints","DOI":"10.36227\/techrxiv.18254723.v1"},{"issue":"7","key":"2009_CR46","doi-asserted-by":"publisher","first-page":"2044","DOI":"10.1109\/TMI.2023.3239391","volume":"42","author":"A Hatamizadeh","year":"2023","unstructured":"Hatamizadeh A, Yin H, Molchanov P, Myronenko A, Li W, Dogra P, Feng A, Flores MG, Kautz J, Xu D et al (2023) Do gradient inversion attacks make federated learning unsafe? IEEE Trans Med Imaging 42(7):2044\u20132056","journal-title":"IEEE Trans Med Imaging"},{"key":"2009_CR47","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2023.127225","volume":"573","author":"X Xie","year":"2024","unstructured":"Xie X, Hu C, Ren H, Deng J (2024) A survey on vulnerability of federated learning: a learning algorithm perspective. Neurocomputing 573:127225","journal-title":"Neurocomputing"},{"issue":"4","key":"2009_CR48","doi-asserted-by":"publisher","first-page":"70","DOI":"10.1109\/MIS.2020.2988525","volume":"35","author":"Y Liu","year":"2020","unstructured":"Liu Y, Kang Y, Xing C, Chen T, Yang Q (2020) A secure federated transfer learning framework. IEEE Intell Syst 35(4):70\u201382. https:\/\/doi.org\/10.1109\/MIS.2020.2988525","journal-title":"IEEE Intell Syst"},{"issue":"1","key":"2009_CR49","doi-asserted-by":"publisher","first-page":"35","DOI":"10.3233\/IA-200075","volume":"15","author":"S Saha","year":"2021","unstructured":"Saha S, Ahmad T (2021) Federated transfer learning: concept and applications. Intelligenza Artificiale 15(1):35\u201344","journal-title":"Intelligenza Artificiale"},{"key":"2009_CR50","unstructured":"Li O, Sun J, Yang X, Gao W, Zhang H, Xie J, Smith V, Wang C (2021) Label leakage and protection in two-party split learning. arXiv preprint arXiv:2102.08504"},{"key":"2009_CR51","doi-asserted-by":"publisher","first-page":"227","DOI":"10.2478\/popets-2022-0043","volume":"2","author":"A Wainakh","year":"2022","unstructured":"Wainakh A, Ventola F, M\u00fc\u00dfig T, Keim J, Cordero CG, Zimmer E, Grube T, Kersting K, M\u00fchlh\u00e4user M (2022) User-level label leakage from gradients in federated learning. Proc Privacy Enhanc Technol 2:227\u2013244","journal-title":"Proc Privacy Enhanc Technol"},{"key":"2009_CR52","unstructured":"Dimitrov DI, Balunovic M, Konstantinov N, Vechev M (2022) Data leakage in federated averaging. Trans Mach Learn Res. https:\/\/openreview.net\/forum?id=e7A0B99zJf"},{"key":"2009_CR53","unstructured":"Ma K, Sun Y, Cui J, Li D, Guan Z, Liu J (2022) Instance-wise batch label restoration via gradients in federated learning. In: The Eleventh International Conference on learning representations"},{"key":"2009_CR54","unstructured":"Chen H, Vikalo H (2024) Recovering labels from local updates in federated learning. arXiv preprint arXiv:2405.00955"},{"key":"2009_CR55","doi-asserted-by":"crossref","unstructured":"Ganju K, Wang Q, Yang W, Gunter CA, Borisov N (2018) Property inference attacks on fully connected neural networks using permutation invariant representations. In: Proceedings of the 2018 ACM SIGSAC Conference on computer and communications security, pp 619\u2013633","DOI":"10.1145\/3243734.3243834"},{"key":"2009_CR56","doi-asserted-by":"publisher","first-page":"143","DOI":"10.1016\/j.aiopen.2021.07.002","volume":"2","author":"R Cartuyvels","year":"2021","unstructured":"Cartuyvels R, Spinks G, Moens MF (2021) Discrete and continuous representations and processing in deep learning: looking forward. AI Open 2:143\u2013159. https:\/\/doi.org\/10.1016\/j.aiopen.2021.07.002","journal-title":"AI Open"},{"key":"2009_CR57","doi-asserted-by":"crossref","unstructured":"Melis L, Song C, De\u00a0Cristofaro E, Shmatikov V (2019) Exploiting unintended feature leakage in collaborative learning. In: 2019 IEEE symposium on security and privacy (SP), IEEE, pp 691\u2013706","DOI":"10.1109\/SP.2019.00029"},{"key":"2009_CR58","first-page":"8130","volume":"35","author":"S Gupta","year":"2022","unstructured":"Gupta S, Huang Y, Zhong Z, Gao T, Li K, Chen D (2022) Recovering private text in federated learning of language models. Adv Neural Inf Process Syst 35:8130\u20138143","journal-title":"Adv Neural Inf Process Syst"},{"key":"2009_CR59","doi-asserted-by":"crossref","unstructured":"Song C, Raghunathan A (2020) Information leakage in embedding models. In: Proceedings of the 2020 ACM SIGSAC Conference on computer and communications security, pp 377\u2013390","DOI":"10.1145\/3372297.3417270"},{"key":"2009_CR60","unstructured":"Lyu L, Chen C (2021) A novel attribute reconstruction attack in federated learning. arXiv preprint arXiv:2108.06910"},{"issue":"11","key":"2009_CR61","doi-asserted-by":"publisher","first-page":"139","DOI":"10.1145\/3422622","volume":"63","author":"I Goodfellow","year":"2020","unstructured":"Goodfellow I, Pouget-Abadie J, Mirza M, Xu B, Warde-Farley D, Ozair S, Courville A, Bengio Y (2020) Generative adversarial networks. Commun ACM 63(11):139\u2013144. https:\/\/doi.org\/10.1145\/3422622","journal-title":"Commun ACM"},{"key":"2009_CR62","doi-asserted-by":"publisher","unstructured":"Deng J, Wang Y, Li J, Wang C, Shang C, Liu H, Rajasekaran S, Ding C (2021) TAG: Gradient attack on transformer-based language models. In: Moens MF, Huang X, Specia L, Yih SWt (eds) Findings of the Association for Computational Linguistics: EMNLP 2021, Association for Computational Linguistics, Punta Cana, Dominican Republic, pp 3600\u20133610, https:\/\/doi.org\/10.18653\/v1\/2021.findings-emnlp.305, https:\/\/aclanthology.org\/2021.findings-emnlp.305","DOI":"10.18653\/v1\/2021.findings-emnlp.305"},{"key":"2009_CR63","unstructured":"Pan X, Zhang M, Yan Y, Zhu J, Yang M (2020) Theory-oriented deep leakage from gradients via linear equation solver. arXiv preprint arXiv:2010.13356 1"},{"key":"2009_CR64","doi-asserted-by":"crossref","unstructured":"Li Z, Hubchak M, Zhu Y (2021) Deep leakage from gradients in multiple-label medical image classification. In: 2021 IEEE 9th International Conference on Healthcare Informatics (ICHI), IEEE, pp 447\u2013448","DOI":"10.1109\/ICHI52183.2021.00078"},{"issue":"11","key":"2009_CR65","doi-asserted-by":"publisher","first-page":"9373","DOI":"10.1002\/int.22997","volume":"37","author":"Z Luo","year":"2022","unstructured":"Luo Z, Zhu C, Fang L, Kou G, Hou R, Wang X (2022) An effective and practical gradient inversion attack. Int J Intell Syst 37(11):9373\u20139389","journal-title":"Int J Intell Syst"},{"key":"2009_CR66","unstructured":"Qian J, Hansen LK (2020) What can we learn from gradients? Withdrawn 13 November 2020"},{"key":"2009_CR67","unstructured":"Krizhevsky A, Hinton G, et\u00a0al. (2009) Learning multiple layers of features from tiny images"},{"key":"2009_CR68","unstructured":"Wang Y, Deng J, Guo D, Wang C, Meng X, Liu H, Ding C, Rajasekaran S (2020) Sapag: A self-adaptive privacy attack from gradients. arXiv preprint arXiv:2009.06228"},{"issue":"1","key":"2009_CR69","doi-asserted-by":"publisher","first-page":"259","DOI":"10.1016\/0167-2789(92)90242-F","volume":"60","author":"LI Rudin","year":"1992","unstructured":"Rudin LI, Osher S, Fatemi E (1992) Nonlinear total variation based noise removal algorithms. Phys D 60(1):259\u2013268. https:\/\/doi.org\/10.1016\/0167-2789(92)90242-F","journal-title":"Phys D"},{"key":"2009_CR70","doi-asserted-by":"publisher","first-page":"5510329","DOI":"10.1155\/2023\/5510329","volume":"1","author":"X He","year":"2023","unstructured":"He X, Peng C, Tan W (2023) Fast and accurate deep leakage from gradients based on Wasserstein distance. Int J Intell Syst 1:5510329","journal-title":"Int J Intell Syst"},{"issue":"3","key":"2009_CR71","first-page":"64","volume":"5","author":"LN Vaserstein","year":"1969","unstructured":"Vaserstein LN (1969) Markov processes over denumerable products of spaces, describing large systems of automata. Problemy Peredachi Informatsii 5(3):64\u201372","journal-title":"Problemy Peredachi Informatsii"},{"key":"2009_CR72","first-page":"29898","volume":"34","author":"J Jeon","year":"2021","unstructured":"Jeon J, Lee K, Oh S, Ok J et al (2021) Gradient inversion with generative image prior. Adv Neural Inf Process Syst 34:29898\u201329908","journal-title":"Adv Neural Inf Process Syst"},{"key":"2009_CR73","doi-asserted-by":"crossref","unstructured":"Hatamizadeh A, Yin H, Roth HR, Li W, Kautz J, Xu D, Molchanov P (2022) Gradvit: Gradient inversion of vision transformers. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp 10021\u201310030","DOI":"10.1109\/CVPR52688.2022.00978"},{"key":"2009_CR74","unstructured":"Bachman P, Alsharif O, Precup D (2014) Learning with pseudo-ensembles. In: Proceedings of the 27th International Conference on Neural Information Processing Systems - Volume 2, MIT Press, Cambridge, MA, USA, NIPS\u201914, p 3365 3373"},{"key":"2009_CR75","doi-asserted-by":"publisher","first-page":"818","DOI":"10.1109\/TIFS.2022.3227761","volume":"18","author":"H Yang","year":"2022","unstructured":"Yang H, Ge M, Xiang K, Li J (2022) Using highly compressed gradients in federated learning for data reconstruction attacks. IEEE Trans Inf Forensics Secur 18:818\u2013830","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"2009_CR76","unstructured":"Wei W, Liu L, Loper M, Chow KH, Gursoy ME, Truex S, Wu Y (2020) A framework for evaluating gradient leakage attacks in federated learning. arXiv preprint arXiv:2004.10397"},{"key":"2009_CR77","unstructured":"Zhao Z, Luo M, Ding W (2024) Deep leakage from model in federated learning. In: Chi Y, Dziugaite GK, Qu Q, Wang AW, Zhu Z (eds) Conference on Parsimony and Learning, PMLR, Proceedings of Machine Learning Research, vol 234, pp 324\u2013340, https:\/\/proceedings.mlr.press\/v234\/zhao24b.html"},{"key":"2009_CR78","doi-asserted-by":"publisher","unstructured":"Sun Y, Xiong G, Yao X, Ma K, Cui J (2024) Gi-pip: Do we require impractical auxiliary dataset for gradient inversion attacks? In: ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp 4675\u20134679, https:\/\/doi.org\/10.1109\/ICASSP48485.2024.10445924","DOI":"10.1109\/ICASSP48485.2024.10445924"},{"key":"2009_CR79","doi-asserted-by":"crossref","unstructured":"Yin H, Molchanov P, Alvarez JM, Li Z, Mallya A, Hoiem D, Jha NK, Kautz J (2020) Dreaming to distill: data-free knowledge transfer via deepinversion. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp 8715\u20138724","DOI":"10.1109\/CVPR42600.2020.00874"},{"key":"2009_CR80","doi-asserted-by":"publisher","unstructured":"Hyv rinen A, Oja E, (2000) Independent component analysis: algorithms and applications. Neural Netw 13(4):411\u2013430. https:\/\/doi.org\/10.1016\/S0893-6080(00)00026-5","DOI":"10.1016\/S0893-6080(00)00026-5"},{"key":"2009_CR81","unstructured":"Le Y, Yang X (2015) Tiny imagenet visual recognition challenge. CS 231N 7(7):3"},{"key":"2009_CR82","doi-asserted-by":"crossref","unstructured":"Mahendran A, Vedaldi A (2015) Understanding deep image representations by inverting them. In: Proceedings of the IEEE Conference on computer vision and pattern recognition, pp 5188\u20135196","DOI":"10.1109\/CVPR.2015.7299155"},{"key":"2009_CR83","doi-asserted-by":"crossref","unstructured":"Ulyanov D, Vedaldi A, Lempitsky V (2018) Deep image prior. In: Proceedings of the IEEE Conference on computer vision and pattern recognition, pp 9446\u20139454","DOI":"10.1109\/CVPR.2018.00984"},{"key":"2009_CR84","unstructured":"Simonyan K, Zisserman A (2014) Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556"},{"key":"2009_CR85","doi-asserted-by":"crossref","unstructured":"Phong LT, Aono Y, Hayashi T, Wang L, Moriai S (2017) Privacy-preserving deep learning: Revisited and enhanced. In: Applications and Techniques in Information Security: 8th International Conference, ATIS 2017, Auckland, New Zealand, July 6\u20137, 2017, Proceedings, Springer, pp 100\u2013110","DOI":"10.1007\/978-981-10-5421-1_9"},{"key":"2009_CR86","doi-asserted-by":"crossref","unstructured":"Enthoven D, Al-Ars Z (2022) Fidel: Reconstructing private training samples from weight updates in federated learning. In: 2022 9th International Conference on Internet of Things: systems. IEEE, Management and Security (IOTSMS), pp 1\u20138","DOI":"10.1109\/IOTSMS58070.2022.10062088"},{"key":"2009_CR87","unstructured":"Qian J, Nassar H, Hansen LK (2020) Minimal model structure analysis for input reconstruction in federated learning. arXiv preprint arXiv:2010.15718"},{"key":"2009_CR88","doi-asserted-by":"crossref","unstructured":"Fan L, Ng KW, Ju C, Zhang T, Liu C, Chan CS, Yang Q (2020) Rethinking privacy preserving deep learning: how to evaluate and thwart privacy attacks. Privacy and incentive, federated learning, pp 32\u201350","DOI":"10.1007\/978-3-030-63076-8_3"},{"key":"2009_CR89","unstructured":"Zhu J, Blaschko M (2020) R-gap: Recursive gradient attack on privacy. arXiv preprint arXiv:2010.07733"},{"key":"2009_CR90","unstructured":"Wen Y, Geiping JA, Fowl L, Goldblum M, Goldstein T (2022) Fishing for user data in large-batch federated learning via gradient magnification. In: International Conference on machine learning, PMLR, pp 23668\u201323684"},{"key":"2009_CR91","unstructured":"Fowl L, Geiping J, Reich S, Wen Y, Czaja W, Goldblum M, Goldstein T (2022) Decepticons: Corrupted transformers breach privacy in federated learning for language models. arXiv preprint arXiv:2201.12675"},{"key":"2009_CR92","doi-asserted-by":"crossref","unstructured":"Zhao JC, Sharma A, Elkordy AR, Ezzeldin YH, Avestimehr S, Bagchi S (2023) Loki: Large-scale data reconstruction attack against federated learning through model manipulation. In: 2024 IEEE Symposium on Security and Privacy (SP), IEEE Computer Society, pp 30\u201330","DOI":"10.1109\/SP54263.2024.00030"},{"key":"2009_CR93","doi-asserted-by":"crossref","unstructured":"Boenisch F, Dziedzic A, Schuster R, Shamsabadi AS, Shumailov I, Papernot N (2023) When the curious abandon honesty: federated learning is not private. In: 2023 IEEE 8th European Symposium on Security and Privacy (EuroS &P), IEEE, pp 175\u2013199","DOI":"10.1109\/EuroSP57164.2023.00020"},{"key":"2009_CR94","unstructured":"Lam M, Wei GY, Brooks D, Reddi VJ, Mitzenmacher M (2021) Gradient disaggregation: breaking privacy in federated learning by reconstructing the user participant matrix. In: International Conference on machine learning, PMLR, pp 5959\u20135968"},{"key":"2009_CR95","doi-asserted-by":"crossref","unstructured":"Pasquini D, Francati D, Ateniese G (2022) Eluding secure aggregation in federated learning via model inconsistency. In: Proceedings of the 2022 ACM SIGSAC Conference on computer and communications security, pp 2429\u20132443","DOI":"10.1145\/3548606.3560557"},{"key":"2009_CR96","unstructured":"Hayes J, Melis L, Danezis G, De\u00a0Cristofaro E (2017) Logan: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 pp 506\u2013519"},{"issue":"2\/3","key":"2009_CR97","first-page":"117","volume":"18","author":"T Ha","year":"2022","unstructured":"Ha T, Dang TK (2022) Inference attacks based on gan in federated learning. Int J Web Inform Syst 18(2\/3):117\u2013136","journal-title":"Int J Web Inform Syst"},{"key":"2009_CR98","unstructured":"Yang Z, Chang EC, Liang Z (2019) Adversarial neural network inversion via auxiliary knowledge alignment. arXiv preprint arXiv:1902.08552"},{"key":"2009_CR99","doi-asserted-by":"crossref","unstructured":"Zhang Y, Jia R, Pei H, Wang W, Li B, Song D (2020) The secret revealer: Generative model-inversion attacks against deep neural networks. In: Proceedings of the IEEE\/CVF Conference on computer vision and pattern recognition, pp 253\u2013261","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"2009_CR100","unstructured":"Salem A, Bhattacharya A, Backes M, Fritz M, Zhang Y (2020) $$\\{$$Updates-Leak$$\\}$$: Data set inference and reconstruction attacks in online learning. In: 29th USENIX Security Symposium (USENIX Security 20), pp 1291\u20131308"},{"key":"2009_CR101","doi-asserted-by":"crossref","unstructured":"Wang Z, Song M, Zhang Z, Song Y, Wang Q, Qi H (2019) Beyond inferring class representatives: user-level privacy leakage from federated learning. In: IEEE INFOCOM 2019-IEEE Conference on computer communications, IEEE, pp 2512\u20132520","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"2009_CR102","unstructured":"Hansen N (2016) The cma evolution strategy: a tutorial. arXiv preprint arXiv:1604.00772"},{"key":"2009_CR103","unstructured":"Eriksson D, Pearce M, Gardner J, Turner RD, Poloczek M (2019) Scalable global optimization via local bayesian optimization. In: Wallach H, Larochelle H, Beygelzimer A, d\u2019Alch\u00e9-Buc F, Fox E, Garnett R (eds) Advances in neural information processing systems. Curran Associates, Inc., vol\u00a032, https:\/\/proceedings.neurips.cc\/paper_files\/paper\/2019\/file\/6c990b7aca7bc7058f5e98ea909e924b-Paper.pdf"},{"key":"2009_CR104","doi-asserted-by":"publisher","DOI":"10.1145\/3214303","author":"A Acar","year":"2018","unstructured":"Acar A, Aksu H, Uluagac AS, Conti M (2018) A survey on homomorphic encryption schemes: theory and implementation. ACM Comput Surv. https:\/\/doi.org\/10.1145\/3214303","journal-title":"ACM Comput Surv"},{"key":"2009_CR105","doi-asserted-by":"publisher","unstructured":"Du W, Atallah MJ (2001) Secure multi-party computation problems and their applications: a review and open problems. In: Proceedings of the 2001 Workshop on New Security Paradigms, Association for Computing Machinery, New York, NY, USA, NSPW \u201901, p 13 22, https:\/\/doi.org\/10.1145\/508171.508174,","DOI":"10.1145\/508171.508174"},{"key":"2009_CR106","first-page":"1","volume-title":"Automata, languages and programming","author":"C Dwork","year":"2006","unstructured":"Dwork C (2006) Differential privacy. In: Bugliesi M, Preneel B, Sassone V, Wegener I (eds) Automata, languages and programming. Springer Berlin Heidelberg, Berlin, pp 1\u201312"},{"key":"2009_CR107","doi-asserted-by":"publisher","unstructured":"Zhang X, Fu A, Wang H, Zhou C, Chen Z (2020) A privacy-preserving and verifiable federated learning scheme. In: ICC 2020\u20142020 IEEE International Conference on Communications (ICC), pp 1\u20136, https:\/\/doi.org\/10.1109\/ICC40277.2020.9148628","DOI":"10.1109\/ICC40277.2020.9148628"},{"issue":"9","key":"2009_CR108","doi-asserted-by":"publisher","first-page":"5880","DOI":"10.1002\/int.22818","volume":"37","author":"J Ma","year":"2022","unstructured":"Ma J, Naas SA, Sigg S, Lyu X (2022) Privacy-preserving federated learning based on multi-key homomorphic encryption. Int J Intell Syst 37(9):5880\u20135901","journal-title":"Int J Intell Syst"},{"issue":"2","key":"2009_CR109","doi-asserted-by":"publisher","first-page":"734","DOI":"10.3390\/app12020734","volume":"12","author":"J Park","year":"2022","unstructured":"Park J, Lim H (2022) Privacy-preserving federated learning using homomorphic encryption. Appl Sci 12(2):734","journal-title":"Appl Sci"},{"key":"2009_CR110","doi-asserted-by":"publisher","unstructured":"Bonawitz K, Ivanov V, Kreuter B, Marcedone A, McMahan HB, Patel S, Ramage D, Segal A, Seth K (2017) Practical secure aggregation for privacy-preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Association for Computing Machinery, New York, NY, USA, CCS \u201917, p 1175 1191, https:\/\/doi.org\/10.1145\/3133956.3133982,","DOI":"10.1145\/3133956.3133982"},{"key":"2009_CR111","doi-asserted-by":"publisher","unstructured":"Truex S, Baracaldo N, Anwar A, Steinke T, Ludwig H, Zhang R, Zhou Y (2019) A hybrid approach to privacy-preserving federated learning. In: Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, Association for Computing Machinery, New York, NY, USA, AISec\u201919, p 1 11, https:\/\/doi.org\/10.1145\/3338501.3357370,","DOI":"10.1145\/3338501.3357370"},{"key":"2009_CR112","doi-asserted-by":"publisher","first-page":"198275","DOI":"10.1109\/ACCESS.2020.3034602","volume":"8","author":"H Zhu","year":"2020","unstructured":"Zhu H, Mong Goh RS, Ng WK (2020) Privacy-preserving weighted federated learning within the secret sharing framework. IEEE Access 8:198275\u2013198284. https:\/\/doi.org\/10.1109\/ACCESS.2020.3034602","journal-title":"IEEE Access"},{"key":"2009_CR113","doi-asserted-by":"publisher","unstructured":"Xu Y, Peng C, Tan W, Tian Y, Ma M, Niu K (2022) Non-interactive verifiable privacy-preserving federated learning. Future Generation Computer Systems 128:365\u2013380, https:\/\/doi.org\/10.1016\/j.future.2021.10.017, https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167739X21004131. Accessed Mar 2022","DOI":"10.1016\/j.future.2021.10.017"},{"key":"2009_CR114","doi-asserted-by":"crossref","unstructured":"So J, Ali E, R, G ler B, Jiao J, Avestimehr AS (2023) Securing secure aggregation: mitigating multi-round privacy leakage in federated learning. In: Proceedings of the AAAI Conference on Artificial Intelligence 37(8):9864\u20139873","DOI":"10.1609\/aaai.v37i8.26177"},{"key":"2009_CR115","unstructured":"Geyer RC, Klein T, Nabi M (2017) Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557"},{"issue":"2","key":"2009_CR116","doi-asserted-by":"publisher","first-page":"1310","DOI":"10.1109\/TII.2021.3073925","volume":"18","author":"Z Xiong","year":"2022","unstructured":"Xiong Z, Cai Z, Takabi D, Li W (2022) Privacy threat and defense for federated learning with non-i.i.d. data in aiot. IEEE Trans Ind Inform 18(2):1310\u20131321. https:\/\/doi.org\/10.1109\/TII.2021.3073925","journal-title":"IEEE Trans Ind Inform"},{"issue":"20","key":"2009_CR117","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.6367","volume":"33","author":"T Fan","year":"2021","unstructured":"Fan T, Cui Z (2021) Adaptive differential privacy preserving based on multi-objective optimization in deep neural networks. Concurr Comput Pract Exp 33(20):e6367","journal-title":"Concurr Comput Pract Exp"},{"issue":"6","key":"2009_CR118","doi-asserted-by":"publisher","first-page":"141","DOI":"10.1109\/MSP.2012.2211477","volume":"29","author":"L Deng","year":"2012","unstructured":"Deng L (2012) The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE Signal Process Mag 29(6):141\u2013142","journal-title":"IEEE Signal Process Mag"},{"issue":"3","key":"2009_CR119","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","volume":"115","author":"O Russakovsky","year":"2015","unstructured":"Russakovsky O, Deng J, Su H, Krause J, Satheesh S, Ma S, Huang Z, Karpathy A, Khosla A, Bernstein M, Berg AC, Fei-Fei L (2015) ImageNet large scale visual recognition challenge. Int J Comput Vis (IJCV) 115(3):211\u2013252. https:\/\/doi.org\/10.1007\/s11263-015-0816-y","journal-title":"Int J Comput Vis (IJCV)"},{"key":"2009_CR120","doi-asserted-by":"publisher","DOI":"10.1002\/9781118723203","volume-title":"Practical methods of optimization","author":"R Fletcher","year":"2000","unstructured":"Fletcher R (2000) Practical methods of optimization. Wiley"},{"key":"2009_CR121","unstructured":"Dauphin YN, Fan A, Auli M, Grangier D (2017) Language modeling with gated convolutional networks. In: International Conference on machine learning, PMLR, pp 933\u2013941"}],"container-title":["Complex & Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-025-02009-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s40747-025-02009-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-025-02009-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,7]],"date-time":"2025-09-07T13:23:16Z","timestamp":1757251396000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s40747-025-02009-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,17]]},"references-count":121,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2025,9]]}},"alternative-id":["2009"],"URL":"https:\/\/doi.org\/10.1007\/s40747-025-02009-1","relation":{},"ISSN":["2199-4536","2198-6053"],"issn-type":[{"value":"2199-4536","type":"print"},{"value":"2198-6053","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,17]]},"assertion":[{"value":"3 April 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 June 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 July 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"On behalf of all authors, the corresponding author states that there is no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"391"}}