{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T01:49:33Z","timestamp":1782784173040,"version":"3.54.5"},"reference-count":112,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62306253"],"award-info":[{"award-number":["62306253"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["T2522030"],"award-info":[{"award-number":["T2522030"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Early Career Scheme from the Research Grants Council of Hong Kong SAR","award":["27207025"],"award-info":[{"award-number":["27207025"]}]},{"name":"Early Career Scheme from the Research Grants Council of Hong Kong SAR","award":["27204623"],"award-info":[{"award-number":["27204623"]}]},{"name":"Guangdong Natural Science Fund-General Program","award":["2024A1515010233"],"award-info":[{"award-number":["2024A1515010233"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,4]]},"DOI":"10.1109\/tpami.2025.3646639","type":"journal-article","created":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T18:41:22Z","timestamp":1766428882000},"page":"4810-4826","source":"Crossref","is-referenced-by-count":5,"title":["Exploring the Vulnerabilities of Federated Learning: A Deep Dive Into Gradient Inversion Attacks"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-4042-795X","authenticated-orcid":false,"given":"Pengxin","family":"Guo","sequence":"first","affiliation":[{"name":"School of Computing and Data Science, The University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-5956-1150","authenticated-orcid":false,"given":"Runxi","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computing and Data Science, The University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shuang","family":"Zeng","sequence":"additional","affiliation":[{"name":"Department of Mathematics, The University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jinjing","family":"Zhu","sequence":"additional","affiliation":[{"name":"Thrust of Artificial Intelligence, The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-9000-6930","authenticated-orcid":false,"given":"Haoning","family":"Jiang","sequence":"additional","affiliation":[{"name":"Department of Electronic and Electrical Engineering, Southern University of Science and Technology, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanran","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Biomedical Data Science, Stanford University, Stanford, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuyin","family":"Zhou","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, University of California, Santa Cruz, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Feifei","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Electrical and Electronic Engineering, The University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6016-6465","authenticated-orcid":false,"given":"Hui","family":"Xiong","sequence":"additional","affiliation":[{"name":"Thrust of Artificial Intelligence, The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8235-7852","authenticated-orcid":false,"given":"Liangqiong","family":"Qu","sequence":"additional","affiliation":[{"name":"School of Computing and Data Science, The University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","volume-title":"Proc. Int. Conf. Artif. Intell. Stat.","author":"McMahan","year":"2017"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.05.003"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01150"},{"key":"ref4","article-title":"Exploring federated pruning for large language models","author":"Guo","year":"2025"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-021-00489-2"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TMI.2022.3233574"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72117-5_66"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_17"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TCE.2023.3339702"},{"key":"ref10","first-page":"14747","article-title":"Deep leakage from gradients","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"32","author":"Zhu","year":"2019"},{"key":"ref11","first-page":"7232","article-title":"Evaluating gradient inversion attacks and defenses in federated learning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"34","author":"Huang","year":"2021"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref13","article-title":"Efficient passive membership inference attack in federated learning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst. Workshops","author":"Zari","year":"2021"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3196646"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00023"},{"key":"ref16","first-page":"16937","article-title":"Inverting gradients-how easy is it to break privacy in federated learning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"33","author":"Geiping","year":"2020"},{"key":"ref17","article-title":"Robbing the fed: Directly obtaining private data in federated learning with modified models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Fowl","year":"2022"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00020"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00030"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.10.007"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3322785"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2021.106775"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/791"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-022-01647-y"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3352628"},{"key":"ref26","article-title":"Dealing doubt: Unveiling threat models in gradient inversion attacks under federated learning, a survey and taxonomy","author":"Shi","year":"2024"},{"key":"ref27","first-page":"6439","article-title":"$\\lbrace${SoK$\\rbrace$}: Gradient inversion attacks in federated learning","volume-title":"Proc. USENIX Secur. Symp.","author":"Carletti","year":"2025"},{"key":"ref28","first-page":"3045","article-title":"SoK: On gradient leakage in federated learning","volume-title":"Proc. USENIX Secur. Symp.","author":"Du","year":"2025"},{"key":"ref29","article-title":"Fedlad: Federated evaluation of deep leakage attacks and defenses","author":"Baglin","year":"2024"},{"key":"ref30","article-title":"iDLG: Improved deep leakage from gradients","author":"Zhao","year":"2020"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01607"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00978"},{"key":"ref33","first-page":"15884","article-title":"Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Kariyappa","year":"2023"},{"key":"ref34","first-page":"6381","article-title":"Gradient obfuscation gives a false sense of security in federated learning","volume-title":"Proc. USENIX Secur. Symp.","author":"Yue","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3430533"},{"key":"ref36","first-page":"29898","article-title":"Gradient inversion with generative image prior","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"34","author":"Jeon","year":"2021"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00989"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00458"},{"issue":"4","key":"ref39","first-page":"1","volume":"13","author":"Ren","year":"2022","journal-title":"ACM Trans. Intell. Syst. Technol."},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3228302"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00473"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3383722"},{"key":"ref43","first-page":"2293","article-title":"Learning to invert: Simple adaptive attacks for gradient inversion in federated learning","volume-title":"Proc. Uncertain. Artif. Intell.","author":"Wu","year":"2023"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM53939.2023.10229091"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645514"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00387"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560557"},{"key":"ref48","first-page":"23668","article-title":"Fishing for user data in large-batch federated learning via gradient magnification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wen","year":"2022"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/WACV57701.2024.00384"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240644"},{"key":"ref51","article-title":"Improving LoRA in privacy-preserving federated learning","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Sun","year":"2024"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1245"},{"key":"ref53","article-title":"Selective aggregation for low-rank adaptation in federated learning","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Guo","year":"2025"},{"key":"ref54","article-title":"Fedvlmbench: Benchmarking federated fine-tuning of vision-language models","author":"Zheng","year":"2025"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1017\/cbo9780511721656"},{"key":"ref56","article-title":"SAPAG: A self-adaptive privacy attack from gradients","author":"Wang","year":"2020"},{"key":"ref57","article-title":"Towards general deep leakage in federated learning","author":"Geng","year":"2021"},{"key":"ref58","first-page":"994","article-title":"Cafe: Catastrophic data leakage in vertical federated learning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"34","author":"Jin","year":"2021"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00981"},{"key":"ref60","article-title":"Data leakage in federated averaging","author":"Dimitrov","year":"2022","journal-title":"Tran. Mach. Learn. Res."},{"key":"ref61","article-title":"Instance-wise batch label restoration via gradients in federated learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ma","year":"2023"},{"key":"ref62","article-title":"Towards eliminating hard label constraints in gradient inversion attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang","year":"2024"},{"key":"ref63","article-title":"Hiding in plain sight: Disguising data stealing attacks in federated learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Garov","year":"2024"},{"key":"ref64","article-title":"MGIC: A multi-label gradient inversion attack based on canny edge detection on federated learning","author":"Liu","year":"2024"},{"key":"ref65","article-title":"RAF-GI: Towards robust, accurate and fast-convergent gradient inversion attack in federated learning","author":"Liu","year":"2024"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-5603-2_36"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3589127"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.5753\/sbseg.2024.241680"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i18.29975"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP48485.2024.10445924"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2025.3532339"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i25.34829"},{"key":"ref73","article-title":"Non-linear trajectory modeling for multi-step gradient inversion attacks in federated learning","author":"Xia","year":"2025"},{"key":"ref74","article-title":"R-gap: Recursive gradient attack on privacy","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Zhu","year":"2021"},{"key":"ref75","first-page":"1727","article-title":"Revealing and protecting labels in distributed training","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"34","author":"Dang","year":"2021"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-5421-1_9"},{"key":"ref77","first-page":"106768","article-title":"Spear: Exact gradient inversion of batches in federated learning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Dimitrov","year":"2024"},{"key":"ref78","article-title":"LoRA: Low-rank adaptation of large language models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Hu","year":"2022"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM53939.2023.10228919"},{"key":"ref80","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref85","first-page":"1106","article-title":"Imagenet classification with deep convolutional neural networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","volume":"25","author":"Krizhevsky","year":"2012"},{"key":"ref86","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.4324\/9781410605337-29"},{"key":"ref88","article-title":"Adam: A method for stochastic optimization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Kingma","year":"2015"},{"key":"ref89","article-title":"Large scale gan training for high fidelity natural image synthesis","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Brock","year":"2019"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-32494-1_4"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR.2010.579"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/TMI.2023.3239391"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-50871-6"},{"key":"ref96","article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dosovitskiy","year":"2021"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i16.33865"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1982.38"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2021.10.017"},{"key":"ref101","volume-title":"A Fully Homomorphic Encryption Scheme","author":"Gentry","year":"2009"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/ICC40277.2020.9148628"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.3390\/app12020734"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1007\/11787006_1"},{"key":"ref105","article-title":"Differentially private federated learning: A client level perspective","author":"Geyer","year":"2017"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS51616.2021.00081"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3595533"},{"key":"ref108","article-title":"Learning differentially private recurrent language models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"McMahan","year":"2018"},{"key":"ref109","article-title":"A framework for evaluating gradient leakage attacks in federated learning","author":"Wei","year":"2020"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2024.3377655"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30171"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00366"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11424231\/11311346.pdf?arnumber=11311346","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T01:34:12Z","timestamp":1773106452000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11311346\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4]]},"references-count":112,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2025.3646639","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4]]}}}