{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T23:33:48Z","timestamp":1780356828551,"version":"3.54.1"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,4,5]],"date-time":"2024-04-05T00:00:00Z","timestamp":1712275200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,4,5]],"date-time":"2024-04-05T00:00:00Z","timestamp":1712275200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100012165","name":"Key Technologies Research and Development Program","doi-asserted-by":"publisher","award":["2019YFB1005200"],"award-info":[{"award-number":["2019YFB1005200"]}],"id":[{"id":"10.13039\/501100012165","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>As a distributed learning paradigm, federated learning is supposed to protect data privacy without exchanging users\u2019 local data. Even so, the <jats:italic>gradient inversion attack<\/jats:italic>, in which the adversary can reconstruct the original data from shared training gradients, has been widely deemed as a severe threat. Nevertheless, most existing researches are confined to impractical assumptions and narrow range of applications. To mitigate these shortcomings, we propose a comprehensive framework for gradient inversion attack, with well-designed algorithms for image and label reconstruction. For image reconstruction, we fully utilize the generative image prior, which derives from wide-used generative models, to improve the reconstructed results, by additional means of iterative optimization on mixed spaces and gradient-free optimizer. For label reconstruction, we design an adaptive recovery algorithm regarding real data distribution, which can adjust previous attacks to more complex scenarios. Moreover, we incorporate a gradient approximation method to efficiently fit our attack for FedAvg scenario. We empirically verify our attack framework using benchmark datasets and ablation studies, considering loose assumptions and complicated circumstances. We hope this work can greatly reveal the necessity of privacy protection in federated learning, while urge more effective and robust defense mechanisms.<\/jats:p>","DOI":"10.1186\/s42400-024-00227-7","type":"journal-article","created":{"date-parts":[[2024,4,5]],"date-time":"2024-04-05T03:27:38Z","timestamp":1712287658000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Iterative and mixed-spaces image gradient inversion attack in federated learning"],"prefix":"10.1186","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-6037-3760","authenticated-orcid":false,"given":"Linwei","family":"Fang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Liming","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongjia","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,4,5]]},"reference":[{"issue":"5","key":"227_CR1","first-page":"1333","volume":"13","author":"Y Aono","year":"2017","unstructured":"Aono Y, Hayashi T, Wang L et al (2017) Privacy-preserving deep learning via additively homomorphic encryption. IEEE Trans Inf Forensics Secur 13(5):1333\u20131345","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"4","key":"227_CR2","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3306346.3323023","volume":"38","author":"D Bau","year":"2019","unstructured":"Bau D, Strobelt H, Peebles W et al (2019) Semantic photo manipulation with a generative image prior. ACM Trans Graph (TOG) 38(4):1\u201311","journal-title":"ACM Trans Graph (TOG)"},{"key":"227_CR3","doi-asserted-by":"crossref","unstructured":"Bau D, Zhu JY, Wulff J, et\u00a0al (2019b) Seeing what a gan cannot generate. In: Proceedings of the IEEE\/CVF international conference on computer vision, pp 4502\u20134511","DOI":"10.1109\/ICCV.2019.00460"},{"key":"227_CR4","doi-asserted-by":"crossref","unstructured":"Boenisch F, Dziedzic A, Schuster R, et\u00a0al (2023) When the curious abandon honesty: Federated learning is not private. In: 2023 IEEE 8th European symposium on security and privacy (EuroS &P), IEEE, pp 175\u2013199","DOI":"10.1109\/EuroSP57164.2023.00020"},{"key":"227_CR5","doi-asserted-by":"publisher","first-page":"63229","DOI":"10.1109\/ACCESS.2021.3075203","volume":"9","author":"N Bouacida","year":"2021","unstructured":"Bouacida N, Mohapatra P (2021) Vulnerabilities in federated learning. IEEE. Access 9:63229\u201363249","journal-title":"Access"},{"key":"227_CR6","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1016\/j.ijmedinf.2018.01.007","volume":"112","author":"TS Brisimi","year":"2018","unstructured":"Brisimi TS, Chen R, Mela T et al (2018) Federated learning of predictive models from federated electronic health records. Int J Med Inform 112:59\u201367","journal-title":"Int J Med Inform"},{"key":"227_CR7","unstructured":"Brock A, Donahue J, Simonyan K (2018) Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv:1809.11096"},{"issue":"7","key":"227_CR8","doi-asserted-by":"publisher","first-page":"1867","DOI":"10.1007\/s11263-020-01303-4","volume":"128","author":"U Dmitry","year":"2020","unstructured":"Dmitry U, Vedaldi A, Victor L (2020) Deep image prior. Int J Comput Vis 128(7):1867\u20131888","journal-title":"Int J Comput Vis"},{"key":"227_CR9","unstructured":"Fowl L, Geiping J, Czaja W, et\u00a0al (2021) Robbing the fed: Directly obtaining private data in federated learning with modified models. arXiv preprint arXiv:2110.13057"},{"key":"227_CR10","doi-asserted-by":"crossref","unstructured":"Fredrikson M, Jha S, Ristenpart T (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp 1322\u20131333","DOI":"10.1145\/2810103.2813677"},{"key":"227_CR11","first-page":"16937","volume":"33","author":"J Geiping","year":"2020","unstructured":"Geiping J, Bauermeister H, Dr\u00f6ge H et al (2020) Inverting gradients-how easy is it to break privacy in federated learning? Adv Neural Inf Process Syst 33:16937\u201316947","journal-title":"Adv Neural Inf Process Syst"},{"key":"227_CR12","unstructured":"Geng J, Mou Y, Li F, et\u00a0al (2021) Towards general deep leakage in federated learning. arXiv preprint arXiv:2110.09074"},{"key":"227_CR13","unstructured":"Hansen N (2016) The cma evolution strategy: a tutorial. arXiv preprint arXiv:1604.00772"},{"key":"227_CR14","unstructured":"Hard A, Rao K, Mathews R, et\u00a0al (2018) Federated learning for mobile keyboard prediction. arXiv preprint arXiv:1811.03604"},{"key":"227_CR15","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, et\u00a0al (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"key":"227_CR16","doi-asserted-by":"crossref","unstructured":"Hitaj B, Ateniese G, Perez-Cruz F (2017) Deep models under the gan: information leakage from collaborative deep learning. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp 603\u2013618","DOI":"10.1145\/3133956.3134012"},{"key":"227_CR17","doi-asserted-by":"crossref","unstructured":"Huh M, Zhang R, Zhu JY, et\u00a0al (2020) Transforming and projecting images into class-conditional generative networks. In: European conference on computer vision, pp 17\u201334","DOI":"10.1007\/978-3-030-58536-5_2"},{"key":"227_CR18","first-page":"29898","volume":"34","author":"J Jeon","year":"2021","unstructured":"Jeon J, Lee K, Oh S et al (2021) Gradient inversion with generative image prior. Adv Neural Inf Process Syst 34:29898\u201329908","journal-title":"Adv Neural Inf Process Syst"},{"key":"227_CR19","first-page":"994","volume":"34","author":"X Jin","year":"2021","unstructured":"Jin X, Chen PY, Hsu CY et al (2021) Cafe: Catastrophic data leakage in vertical federated learning. Adv Neural Inf Process Syst 34:994\u20131006","journal-title":"Adv Neural Inf Process Syst"},{"key":"227_CR20","doi-asserted-by":"crossref","unstructured":"Karras T, Laine S, Aila T (2019) A style-based generator architecture for generative adversarial networks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 4401\u20134410","DOI":"10.1109\/CVPR.2019.00453"},{"key":"227_CR21","unstructured":"Kingma DP, Ba J (2014) Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980"},{"key":"227_CR22","unstructured":"Krizhevsky A, Hinton G, et\u00a0al (2009) Learning multiple layers of features from tiny images. Technical report"},{"key":"227_CR23","doi-asserted-by":"crossref","unstructured":"Li Z, Zhang J, Liu L, et\u00a0al (2022) Auditing privacy defenses in federated learning via generative gradient leakage. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 10132\u201310142","DOI":"10.1109\/CVPR52688.2022.00989"},{"issue":"3","key":"227_CR24","doi-asserted-by":"publisher","first-page":"2031","DOI":"10.1109\/COMST.2020.2986024","volume":"22","author":"WYB Lim","year":"2020","unstructured":"Lim WYB, Luong NC, Hoang DT et al (2020) Federated learning in mobile edge networks: a comprehensive survey. IEEE Commun Surv Tutor 22(3):2031\u20132063","journal-title":"IEEE Commun Surv Tutor"},{"issue":"1\u20133","key":"227_CR25","doi-asserted-by":"publisher","first-page":"503","DOI":"10.1007\/BF01589116","volume":"45","author":"DC Liu","year":"1989","unstructured":"Liu DC, Nocedal J (1989) On the limited memory bfgs method for large scale optimization. Math Program 45(1\u20133):503\u2013528","journal-title":"Math Program"},{"key":"227_CR26","doi-asserted-by":"crossref","unstructured":"Lyu L, Yu H, Yang Q (2020) Threats to federated learning: a survey. arXiv preprint arXiv:2003.02133","DOI":"10.1007\/978-3-030-63076-8_1"},{"key":"227_CR27","unstructured":"McMahan B, Moore E, Ramage D, et\u00a0al (2017) Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics, PMLR, pp 1273\u20131282"},{"key":"227_CR28","doi-asserted-by":"crossref","unstructured":"Melis L, Song C, De\u00a0Cristofaro E, et\u00a0al (2019) Exploiting unintended feature leakage in collaborative learning. In: 2019 IEEE symposium on security and privacy (SP), IEEE, pp 691\u2013706","DOI":"10.1109\/SP.2019.00029"},{"key":"227_CR29","doi-asserted-by":"crossref","unstructured":"Nasr M, Shokri R, Houmansadr A (2019) Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In: 2019 IEEE symposium on security and privacy (SP), IEEE, pp 739\u2013753","DOI":"10.1109\/SP.2019.00065"},{"key":"227_CR30","unstructured":"Qian J, Nassar H, Hansen LK (2020) Minimal model structure analysis for input reconstruction in federated learning. arXiv preprint arXiv:2010.15718"},{"key":"227_CR31","unstructured":"Radford A, Metz L, Chintala S (2015) Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434"},{"key":"227_CR32","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","volume":"115","author":"O Russakovsky","year":"2015","unstructured":"Russakovsky O, Deng J, Su H et al (2015) Imagenet large scale visual recognition challenge. Int J Comput Vis 115:211\u2013252","journal-title":"Int J Comput Vis"},{"key":"227_CR33","doi-asserted-by":"crossref","unstructured":"Shokri R, Stronati M, Song C, et\u00a0al (2017) Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP), IEEE, pp 3\u201318","DOI":"10.1109\/SP.2017.41"},{"key":"227_CR34","doi-asserted-by":"crossref","unstructured":"Wang Z, Song M, Zhang Z, et\u00a0al (2019) Beyond inferring class representatives: user-level privacy leakage from federated learning. In: IEEE INFOCOM 2019-IEEE conference on computer communications, IEEE, pp 2512\u20132520","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"227_CR35","unstructured":"Wen Y, Geiping J, Fowl L, et\u00a0al (2022) Fishing for user data in large-batch federated learning via gradient magnification. arXiv preprint arXiv:2202.00580"},{"issue":"2","key":"227_CR36","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3298981","volume":"10","author":"Q Yang","year":"2019","unstructured":"Yang Q, Liu Y, Chen T et al (2019) Federated machine learning: concept and applications. ACM Trans Intell Syst Technol (TIST) 10(2):1\u201319","journal-title":"ACM Trans Intell Syst Technol (TIST)"},{"key":"227_CR37","doi-asserted-by":"crossref","unstructured":"Yin H, Mallya A, Vahdat A, et\u00a0al (2021) See through gradients: image batch recovery via gradinversion. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 16337\u201316346","DOI":"10.1109\/CVPR46437.2021.01607"},{"key":"227_CR38","doi-asserted-by":"crossref","unstructured":"Zhang R, Isola P, Efros AA, et\u00a0al (2018) The unreasonable effectiveness of deep features as a perceptual metric. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 586\u2013595","DOI":"10.1109\/CVPR.2018.00068"},{"key":"227_CR39","unstructured":"Zhao B, Mopuri KR, Bilen H (2020) idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610"},{"key":"227_CR40","unstructured":"Zhu J, Blaschko MB (2020) R-gap: Recursive gradient attack on privacy. In: International conference on learning representations"},{"key":"227_CR41","doi-asserted-by":"crossref","unstructured":"Zhu JY, Kr\u00e4henb\u00fchl P, Shechtman E, et\u00a0al (2016) Generative visual manipulation on the natural image manifold. In: Computer Vision\u2013ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11\u201314, 2016, Proceedings, Part V 14, Springer, pp 597\u2013613","DOI":"10.1007\/978-3-319-46454-1_36"},{"key":"227_CR42","unstructured":"Zhu L, Liu Z, Han S (2019) Deep leakage from gradients. Adv Neural Inf Process Syst 32"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00227-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00227-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00227-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,4,5]],"date-time":"2024-04-05T03:30:51Z","timestamp":1712287851000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00227-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,5]]},"references-count":42,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["227"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00227-7","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,5]]},"assertion":[{"value":"24 November 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 February 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 April 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"35"}}