{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,24]],"date-time":"2026-06-24T15:56:46Z","timestamp":1782316606106,"version":"3.54.5"},"reference-count":86,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,5,20]],"date-time":"2025-05-20T00:00:00Z","timestamp":1747699200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,5,20]],"date-time":"2025-05-20T00:00:00Z","timestamp":1747699200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100010959","name":"Th\u00fcringer Ministerium f\u00fcr Wirtschaft, Wissenschaft und Digitale Gesellschaft","doi-asserted-by":"publisher","award":["5575\/10-3"],"award-info":[{"award-number":["5575\/10-3"]}],"id":[{"id":"10.13039\/501100010959","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010959","name":"Th\u00fcringer Ministerium f\u00fcr Wirtschaft, Wissenschaft und Digitale Gesellschaft","doi-asserted-by":"publisher","award":["5575\/10-3"],"award-info":[{"award-number":["5575\/10-3"]}],"id":[{"id":"10.13039\/501100010959","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010959","name":"Th\u00fcringer Ministerium f\u00fcr Wirtschaft, Wissenschaft und Digitale Gesellschaft","doi-asserted-by":"publisher","award":["5575\/10-3"],"award-info":[{"award-number":["5575\/10-3"]}],"id":[{"id":"10.13039\/501100010959","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>Gradient Inversion\u00a0(GI) attacks are a ubiquitous threat in Federated Learning as they exploit gradient leakage to reconstruct supposedly private training data. Recent work has proposed to prevent gradient leakage without loss of model utility by incorporating a <jats:italic>PRivacy EnhanCing mODulE<\/jats:italic> (PRECODE) based on variational modeling. Without further analysis, it was shown that PRECODE successfully protects against GI attacks. In this paper, we make multiple contributions. First, we investigate the effect of PRECODE on GI attacks to reveal its underlying working principle. We show that variational modeling introduces stochasticity into the gradients of PRECODE and the subsequent layers in a neural network. The stochastic gradients of these layers prevent iterative GI attacks from converging. Second, we formulate an attack that disables the privacy preserving effect of PRECODE by purposefully omitting stochastic gradients during attack optimization. To preserve the privacy preserving effect of PRECODE, our analysis reveals that variational modeling must be placed early in the network. However, early placement of PRECODE is typically not feasible due to reduced model utility and the exploding number of additional model parameters. Therefore, as a third contribution, we propose a novel privacy module\u2014the Convolutional Variational Bottleneck (CVB)\u2014that can be placed early in a neural network without suffering from these drawbacks. We conduct an extensive empirical study on three seminal model architectures and six image classification datasets. We find that all architectures are susceptible to GI attacks, which can be prevented by our proposed CVB. Compared to PRECODE, we show that our novel privacy module requires fewer trainable parameters, and thus computational and communication costs, to effectively preserve privacy.<\/jats:p>","DOI":"10.1186\/s42400-024-00295-9","type":"journal-article","created":{"date-parts":[[2025,5,20]],"date-time":"2025-05-20T02:01:32Z","timestamp":1747706492000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Privacy preserving federated learning with convolutional variational bottlenecks"],"prefix":"10.1186","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6469-7068","authenticated-orcid":false,"given":"Daniel","family":"Scheliga","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6871-2707","authenticated-orcid":false,"given":"Patrick","family":"M\u00e4der","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7204-3972","authenticated-orcid":false,"given":"Marco","family":"Seeland","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,5,20]]},"reference":[{"key":"295_CR1","unstructured":"Abadi M, Chu A, Goodfellow I, McMahan HB, Mironov I, Talwar K, Zhang L (2016) Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp 308\u2013318"},{"key":"295_CR2","unstructured":"Alemi AA, Fischer I, Dillon JV, Murphy K (2016) Deep variational information bottleneck. arXiv preprint arXiv:1612.00410"},{"issue":"5","key":"295_CR3","first-page":"1333","volume":"13","author":"Y Aono","year":"2017","unstructured":"Aono Y, Hayashi T, Wang L, Moriai S et al (2017) Privacy-preserving deep learning via additively homomorphic encryption. IEEE Trans Inf Forensics Secur 13(5):1333\u20131345","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"295_CR4","unstructured":"Bagdasaryan E, Veit A, Hua Y, Estrin D, Shmatikov V (2020) How to backdoor federated learning. In: International conference on artificial intelligence and statistics. PMLR, pp 2938\u20132948"},{"key":"295_CR5","unstructured":"Balunovi\u0107 M, Dimitrov DI, Staab R, Vechev M (2021) Bayesian framework for gradient leakage. arXiv preprint arXiv:2111.04706"},{"key":"295_CR6","unstructured":"Bonawitz K, Ivanov V, Kreuter B, Marcedone A, McMahan HB, Patel S, Ramage D, Segal A, Seth K (2017) Practical secure aggregation for privacy-preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp 1175\u20131191"},{"issue":"4","key":"295_CR7","doi-asserted-by":"publisher","first-page":"485","DOI":"10.1109\/JPROC.2020.2976475","volume":"108","author":"L Deng","year":"2020","unstructured":"Deng L, Li G, Han S, Shi L, Xie Y (2020) Model compression and hardware acceleration for neural networks: a comprehensive survey. Proc IEEE 108(4):485\u2013532","journal-title":"Proc IEEE"},{"key":"295_CR8","unstructured":"Dosovitskiy A, Beyer L, Kolesnikov A, Weissenborn D, Zhai X, Unterthiner T, Dehghani M, Minderer M, Heigold G, Gelly S et al (2020) An image is worth 16x16 words: transformers for image recognition at scale. arXiv preprint arXiv:2010.11929"},{"issue":"1","key":"295_CR9","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1109\/TPDS.2020.3009406","volume":"32","author":"M Duan","year":"2020","unstructured":"Duan M, Liu D, Chen X, Liu R, Tan Y, Liang L (2020) Self-balancing federated learning with global imbalanced data in mobile systems. IEEE Trans Parallel Distrib Syst 32(1):59\u201371","journal-title":"IEEE Trans Parallel Distrib Syst"},{"issue":"3\u20134","key":"295_CR10","first-page":"211","volume":"9","author":"C Dwork","year":"2014","unstructured":"Dwork C, Roth A et al (2014) The algorithmic foundations of differential privacy. Found Trends\u00ae Theor Comput Sci 9(3\u20134):211\u2013407","journal-title":"Found Trends\u00ae Theor Comput Sci"},{"key":"295_CR11","doi-asserted-by":"publisher","first-page":"22359","DOI":"10.1109\/ACCESS.2022.3151670","volume":"10","author":"A El Ouadrhiri","year":"2022","unstructured":"El Ouadrhiri A, Abdelhadi A (2022) Differential privacy for deep and federated learning: a survey. IEEE access 10:22359\u201322380","journal-title":"IEEE access"},{"key":"295_CR12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_3","author":"L Fan","year":"2020","unstructured":"Fan L, Ng KW, Ju C, Zhang T, Liu C, Chan CS, Yang Q (2020) Rethinking privacy preserving deep learning: how to evaluate and thwart privacy attacks. Fed Learn Priv Incent. https:\/\/doi.org\/10.1007\/978-3-030-63076-8_3","journal-title":"Fed Learn Priv Incent"},{"key":"295_CR13","unstructured":"Fredrikson M, Jha S, Ristenpart T (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp 1322\u20131333"},{"key":"295_CR14","unstructured":"Fredrikson M, Lantz E, Jha S, Lin S, Page D, Ristenpart T (2014) Privacy in pharmacogenetics: an $$\\{$$End-to-End$$\\}$$ case study of personalized warfarin dosing. In: 23rd USENIX security symposium (USENIX security 14), pp 17\u201332"},{"key":"295_CR15","first-page":"16937","volume":"33","author":"J Geiping","year":"2020","unstructured":"Geiping J, Bauermeister H, Dr\u00f6ge H, Moeller M (2020) Inverting gradients-how easy is it to break privacy in federated learning? Adv Neural Inf Process Syst 33:16937\u201316947","journal-title":"Adv Neural Inf Process Syst"},{"key":"295_CR16","unstructured":"Gentry C (2009) Fully homomorphic encryption using ideal lattices. In: Proceedings of the forty-first annual ACM symposium on theory of computing, pp 169\u2013178"},{"key":"295_CR17","unstructured":"Hatamizadeh A, Yin H, Roth HR, Li W, Kautz J, Xu D, Molchanov P (2022) GradViT: gradient inversion of vision transformers. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 10021\u201310030"},{"key":"295_CR18","unstructured":"Hendrycks D, Gimpel K (2016) Gaussian error linear units (GELUs). arXiv preprint arXiv:1606.08415"},{"key":"295_CR19","unstructured":"He K, Zhang X, Ren S, Sun J (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770\u2013778"},{"key":"295_CR20","unstructured":"Hidano S, Murakami T, Katsumata S, Kiyomoto S, Hanaoka G (2017) Model inversion attacks for prediction systems: without knowledge of non-sensitive attributes. In: 2017 15th annual conference on privacy, security and trust (PST). IEEE, pp 115\u201311509"},{"key":"295_CR21","unstructured":"Hidano S, Murakami T, Kawamoto Y (2021) TransMIA: membership inference attacks using transfer shadow training. In: 2021 International joint conference on neural networks (IJCNN). IEEE, pp 1\u201310"},{"issue":"7","key":"295_CR22","doi-asserted-by":"publisher","first-page":"3094","DOI":"10.1109\/TNNLS.2021.3050422","volume":"33","author":"M Hofmann","year":"2021","unstructured":"Hofmann M, M\u00e4der P (2021) Synaptic scaling-an artificial neural network regularization inspired by nature. IEEE Trans Neural Netw Learn Syst 33(7):3094\u20133108","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"issue":"11s","key":"295_CR23","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3523273","volume":"54","author":"H Hu","year":"2022","unstructured":"Hu H, Salcic Z, Sun L, Dobbie G, Yu PS, Zhang X (2022) Membership inference attacks on machine learning: a survey. ACM Comput Surv (CSUR) 54(11s):1\u201337","journal-title":"ACM Comput Surv (CSUR)"},{"key":"295_CR24","first-page":"7232","volume":"34","author":"Y Huang","year":"2021","unstructured":"Huang Y, Gupta S, Song Z, Li K, Arora S (2021) Evaluating gradient inversion attacks and defenses in federated learning. Adv Neural Inf Process Syst 34:7232\u20137241","journal-title":"Adv Neural Inf Process Syst"},{"key":"295_CR25","unstructured":"Hui B, Yang Y, Yuan H, Burlina P, Gong NZ, Cao Y (2021) Practical blind membership inference attack via differential comparisons. arXiv preprint arXiv:2101.01341"},{"key":"295_CR26","unstructured":"Jayaraman B, Evans D (2019) Evaluating differentially private machine learning in practice. In: 28th USENIX security symposium (USENIX security 19), pp 1895\u20131912"},{"key":"295_CR27","first-page":"29898","volume":"34","author":"J Jeon","year":"2021","unstructured":"Jeon J, Lee K, Oh S, Ok J et al (2021) Gradient inversion with generative image prior. Adv Neural Inf Process Syst 34:29898\u201329908","journal-title":"Adv Neural Inf Process Syst"},{"key":"295_CR28","first-page":"994","volume":"34","author":"X Jin","year":"2021","unstructured":"Jin X, Chen P-Y, Hsu C-Y, Yu C-M, Chen T (2021) Cafe: catastrophic data leakage in vertical federated learning. Adv Neural Inf Process Syst 34:994\u20131006","journal-title":"Adv Neural Inf Process Syst"},{"key":"295_CR29","unstructured":"Jin R, Huang Y, He X, Dai H, Wu T (2020) Stochastic-sign SGD for federated learning with theoretical guarantees. arXiv preprint arXiv:2002.10940"},{"issue":"1\u20132","key":"295_CR30","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1561\/2200000083","volume":"14","author":"P Kairouz","year":"2021","unstructured":"Kairouz P, McMahan HB, Avent B, Bellet A, Bennis M, Bhagoji AN, Bonawitz K, Charles Z, Cormode G, Cummings R et al (2021) Advances and open problems in federated learning. Found Trends\u00ae Mach Learn 14(1\u20132):1\u2013210","journal-title":"Found Trends\u00ae Mach Learn"},{"key":"295_CR31","unstructured":"Kingma DP, Ba J (2014) Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980"},{"key":"295_CR32","unstructured":"Kingma DP, Welling M (2013) Auto-encoding variational Bayes. arXiv preprint arXiv:1312.6114"},{"key":"295_CR33","unstructured":"Kone\u010dn\u1ef3 J, McMahan HB, Yu FX, Richt\u00e1rik P, Suresh AT, Bacon D (2016) Federated learning: strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492"},{"key":"295_CR34","unstructured":"Krizhevsky A, Hinton G et al (2009) Learning multiple layers of features from tiny images"},{"issue":"11","key":"295_CR35","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun Y, Bottou L, Bengio Y, Haffner P (1998) Gradient-based learning applied to document recognition. Proc IEEE 86(11):2278\u20132324","journal-title":"Proc IEEE"},{"key":"295_CR36","unstructured":"Lee J-w, Oh J, Lim S, Yun S-Y, Lee J-G (2020) Tornadoaggregate: accurate and scalable federated learning via the ring-based architecture. arXiv preprint arXiv:2012.03214"},{"key":"295_CR37","unstructured":"Li W, Milletar\u00ec F, Xu D, Rieke N, Hancox J, Zhu W, Baust M, Cheng Y, Ourselin S, Cardoso MJ, et al (2019) Privacy-preserving federated brain tumour segmentation. In: Machine learning in medical imaging: 10th international workshop, MLMI 2019, held in conjunction with MICCAI 2019, Shenzhen, China, October 13, 2019, proceedings 10. Springer, pp 133\u2013141"},{"key":"295_CR38","unstructured":"Lin Y, Han S, Mao H, Wang Y, Dally WJ (2017) Deep gradient compression: reducing the communication bandwidth for distributed training. arXiv preprint arXiv:1712.01887"},{"issue":"1\u20133","key":"295_CR39","doi-asserted-by":"publisher","first-page":"503","DOI":"10.1007\/BF01589116","volume":"45","author":"DC Liu","year":"1989","unstructured":"Liu DC, Nocedal J (1989) On the limited memory BFGS method for large scale optimization. Math Program 45(1\u20133):503\u2013528","journal-title":"Math Program"},{"key":"295_CR40","unstructured":"Li Z, Wang L, Chen G, Shafq M et al (2022) A survey of image gradient inversion against federated learning"},{"key":"295_CR41","unstructured":"Li Z, Zhang J, Liu L, Liu J (2022) Auditing privacy defenses in federated learning via generative gradient leakage. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 10132\u201310142"},{"key":"295_CR42","unstructured":"Lu J, Zhang XS, Zhao T, He X, Cheng J (2022) April: finding the Achilles\u2019 heel on privacy for vision transformers. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 10051\u201310060"},{"key":"295_CR43","unstructured":"Mahloujifar S, Ghosh E, Chase M (2022) Property inference from poisoning. In: 2022 IEEE symposium on security and privacy (SP). IEEE, pp 1120\u20131137"},{"key":"295_CR44","unstructured":"McMahan B, Moore E, Ramage D, Hampson S, Arcas BA (2017) Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. PMLR, pp 1273\u20131282"},{"key":"295_CR45","unstructured":"Melis L, Song C, De Cristofaro E, Shmatikov V (2019) Exploiting unintended feature leakage in collaborative learning. In: 2019 IEEE symposium on security and privacy (SP). IEEE, pp 691\u2013706"},{"key":"295_CR46","doi-asserted-by":"publisher","first-page":"619","DOI":"10.1016\/j.future.2020.10.007","volume":"115","author":"V Mothukuri","year":"2021","unstructured":"Mothukuri V, Parizi RM, Pouriyeh S, Huang Y, Dehghantanha A, Srivastava G (2021) A survey on security and privacy of federated learning. Future Gener Comput Syst 115:619\u2013640","journal-title":"Future Gener Comput Syst"},{"key":"295_CR47","unstructured":"Pan X, Zhang M, Yan Y, Zhu J, Yang Z (2022) Exploring the security boundary of data reconstruction via neuron exclusivity analysis. In: 31st USENIX security symposium (USENIX Security 22), pp 3989\u20134006"},{"key":"295_CR48","unstructured":"Papernot N, Thakurta A, Song S, Chien S, Erlingsson \u00da (2021) Tempered sigmoid activations for deep learning with differential privacy. In: Proceedings of the AAAI conference on artificial intelligence, vol 35, pp 9312\u20139321"},{"key":"295_CR49","unstructured":"Pasquini D, Francati D, Ateniese G (2022) Eluding secure aggregation in federated learning via model inconsistency. In: Proceedings of the 2022 ACM SIGSAC conference on computer and communications security, pp 2429\u20132443"},{"key":"295_CR50","doi-asserted-by":"publisher","first-page":"1113","DOI":"10.1613\/jair.1.14649","volume":"77","author":"N Ponomareva","year":"2023","unstructured":"Ponomareva N, Hazimeh H, Kurakin A, Xu Z, Denison C, McMahan HB, Vassilvitskii S, Chien S, Thakurta AG (2023) How to DP-fy ML: a practical guide to machine learning with differential privacy. J Artif Intell Res 77:1113\u20131201","journal-title":"J Artif Intell Res"},{"key":"295_CR51","doi-asserted-by":"publisher","DOI":"10.1109\/TAI.2024.3363670","author":"B Rao","year":"2024","unstructured":"Rao B, Zhang J, Wu D, Zhu C, Sun X, Chen B (2024) Privacy inference attack and defense in centralized and federated learning: a comprehensive survey. IEEE Trans Artif Intell. https:\/\/doi.org\/10.1109\/TAI.2024.3363670","journal-title":"IEEE Trans Artif Intell"},{"key":"295_CR52","unstructured":"Rezaei S, Liu X (2021) On the difficulty of membership inference attacks. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 7892\u20137900"},{"key":"295_CR53","doi-asserted-by":"publisher","first-page":"148","DOI":"10.1016\/j.inffus.2022.09.011","volume":"90","author":"N Rodr\u00edguez-Barroso","year":"2023","unstructured":"Rodr\u00edguez-Barroso N, Jim\u00e9nez-L\u00f3pez D, Luz\u00f3n MV, Herrera F, Mart\u00ednez-C\u00e1mara E (2023) Survey on federated learning threats: concepts, taxonomy on attacks and defences, experimental study and challenges. Inf Fus 90:148\u2013173","journal-title":"Inf Fus"},{"key":"295_CR54","unstructured":"Roy AG, Siddiqui S, P\u00f6lsterl S, Navab N, Wachinger C (2019) Braintorrent: a peer-to-peer environment for decentralized federated learning. arXiv preprint arXiv:1905.06731"},{"issue":"1\u20134","key":"295_CR55","doi-asserted-by":"publisher","first-page":"259","DOI":"10.1016\/0167-2789(92)90242-F","volume":"60","author":"LI Rudin","year":"1992","unstructured":"Rudin LI, Osher S, Fatemi E (1992) Nonlinear total variation based noise removal algorithms. Physica D 60(1\u20134):259\u2013268","journal-title":"Physica D"},{"key":"295_CR56","unstructured":"Saha A, Subramanya A, Pirsiavash H (2020) Hidden trigger backdoor attacks. In: Proceedings of the AAAI conference on artificial intelligence, vol 34, pp 11957\u201311965"},{"issue":"9","key":"295_CR57","doi-asserted-by":"publisher","first-page":"3400","DOI":"10.1109\/TNNLS.2019.2944481","volume":"31","author":"F Sattler","year":"2019","unstructured":"Sattler F, Wiedemann S, M\u00fcller K-R, Samek W (2019) Robust and communication-efficient federated learning from non-iid data. IEEE Trans Neural Netw Learn Syst 31(9):3400\u20133413","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"key":"295_CR58","unstructured":"Scheliga D, M\u00e4der P, Seeland M (2022) PRECODE\u2014a generic model extension to prevent deep gradient leakage. In: Proceedings of the IEEE\/CVF winter conference on applications of computer vision, pp 1849\u20131858"},{"key":"295_CR59","unstructured":"Scheliga D, M\u00e4der P, Seeland M (2023) Dropout is not all you need to prevent gradient leakage. In: Proceedings of the AAAI conference on artificial intelligence, vol 37, pp 9733\u20139741"},{"key":"295_CR100","doi-asserted-by":"publisher","DOI":"10.1080\/08839514.2024.2394756","author":"D Scheliga","year":"2024","unstructured":"Scheliga D, M\u00e4der P, Seeland M (2024) Feature-based dataset fingerprinting for clustered federated learning on medical image data. Appl Art Intel. https:\/\/doi.org\/10.1080\/08839514.2024.2394756","journal-title":"Appl Art Intel"},{"key":"295_CR60","unstructured":"Sharma A, Marchang N (2024) A review on client-server attacks and defenses in federated learning. Computers & Security, 103801"},{"key":"295_CR61","unstructured":"Shokri R, Stronati M, Song C, Shmatikov V (2017) Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP). IEEE, pp 3\u201318"},{"key":"295_CR62","unstructured":"Song L, Mittal P (2021) Systematic evaluation of privacy risks of machine learning models. In: 30th USENIX security symposium (USENIX security 21), pp 2615\u20132632"},{"issue":"13","key":"295_CR63","doi-asserted-by":"publisher","first-page":"11365","DOI":"10.1109\/JIOT.2021.3128646","volume":"9","author":"G Sun","year":"2021","unstructured":"Sun G, Cong Y, Dong J, Wang Q, Lyu L, Liu J (2021) Data poisoning attacks on federated machine learning. IEEE Internet Things J 9(13):11365\u201311375","journal-title":"IEEE Internet Things J"},{"key":"295_CR64","unstructured":"Sun J, Li A, Wang B, Yang H, Li H, Chen Y (2021) Soteria: provable defense against privacy leakage in federated learning from representation perspective. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 9311\u20139319"},{"key":"295_CR65","unstructured":"Tsuzuku Y, Imachi H, Akiba T (2018) Variance-based gradient compression for efficient distributed deep learning. arXiv preprint arXiv:1802.06058"},{"issue":"3","key":"295_CR66","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3168389","volume":"51","author":"I Wagner","year":"2018","unstructured":"Wagner I, Eckhoff D (2018) Technical privacy metrics: a systematic survey. ACM Comput Surv (CSUR) 51(3):1\u201338","journal-title":"ACM Comput Surv (CSUR)"},{"issue":"4","key":"295_CR67","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang Z, Bovik AC, Sheikh HR, Simoncelli EP (2004) Image quality assessment: from error visibility to structural similarity. IEEE Trans Image Process 13(4):600\u2013612","journal-title":"IEEE Trans Image Process"},{"key":"295_CR68","first-page":"29026","volume":"35","author":"J Wang","year":"2022","unstructured":"Wang J, Schuster R, Shumailov I, Lie D, Papernot N (2022) In differential privacy, there is truth: on vote-histogram leakage in ensemble private learning. Adv Neural Inf Process Syst 35:29026\u201329037","journal-title":"Adv Neural Inf Process Syst"},{"key":"295_CR69","unstructured":"Wang Y, Deng J, Guo D, Wang C, Meng X, Liu H, Ding C, Rajasekaran S (2020) Sapag: a self-adaptive privacy attack from gradients. arXiv preprint arXiv:2009.06228"},{"key":"295_CR70","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1109\/TIFS.2021.3139777","volume":"17","author":"W Wei","year":"2021","unstructured":"Wei W, Liu L (2021) Gradient leakage attack resilient deep learning. IEEE Trans Inf Forensics Secur 17:303\u2013316","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"295_CR71","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2023.3273490","author":"W Wei","year":"2023","unstructured":"Wei W, Liu L, Zhou J, Chow K-H, Wu Y (2023) Securing distributed SGD against gradient leakage threats. IEEE Trans Parallel Distrib Syst. https:\/\/doi.org\/10.1109\/TPDS.2023.3273490","journal-title":"IEEE Trans Parallel Distrib Syst"},{"key":"295_CR72","unstructured":"Wei W, Liu L, Loper M, Chow K-H, Gursoy ME, Truex S, Wu Y (2020) A framework for evaluating client privacy leakages in federated learning. In: Computer security\u2013ESORICS 2020: 25th European symposium on research in computer security, ESORICS 2020, Guildford, UK, September 14\u201318, 2020, proceedings, part I 25. Springer, pp 545\u2013566"},{"key":"295_CR73","doi-asserted-by":"publisher","first-page":"818","DOI":"10.1109\/TIFS.2022.3227761","volume":"18","author":"H Yang","year":"2022","unstructured":"Yang H, Ge M, Xiang K, Li J (2022) Using highly compressed gradients in federated learning for data reconstruction attacks. IEEE Trans Inf Forensics Secur 18:818\u2013830","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"1","key":"295_CR74","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1038\/s41597-022-01721-8","volume":"10","author":"J Yang","year":"2023","unstructured":"Yang J, Shi R, Wei D, Liu Z, Zhao L, Ke B, Pfister H, Ni B (2023) MedMNIST v2-a large-scale lightweight benchmark for 2D and 3D biomedical image classification. Sci Data 10(1):41","journal-title":"Sci Data"},{"key":"295_CR75","unstructured":"Yao AC (1982) Protocols for secure computations. In: 23rd Annual symposium on foundations of computer science (SFCS 1982). IEEE, pp 160\u2013164"},{"key":"295_CR76","unstructured":"Yeom S, Giacomelli I, Fredrikson M, Jha S (2018) Privacy risk in machine learning: analyzing the connection to overfitting. In: 2018 IEEE 31st computer security foundations symposium (CSF). IEEE, pp 268\u2013282"},{"key":"295_CR77","unstructured":"Yin H, Mallya A, Vahdat A, Alvarez JM, Kautz J, Molchanov P (2021) See through gradients: image batch recovery via gradinversion. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 16337\u201316346"},{"key":"295_CR78","unstructured":"Yousefpour A, Shilov I, Sablayrolles A, Testuggine D, Prasad K, Malek M, Nguyen J, Ghosh S, Bharadwaj A, Zhao J et al (2021) Opacus: User-friendly differential privacy library in PyTorch. arXiv preprint arXiv:2109.12298"},{"key":"295_CR79","unstructured":"Zhang R, Guo S, Wang J, Xie X, Tao D (2022) A survey on gradient inversion: attacks, defenses and future directions. arXiv preprint arXiv:2206.07284"},{"key":"295_CR80","unstructured":"Zhang R, Isola P, Efros AA, Shechtman E, Wang O (2018) The unreasonable effectiveness of deep features as a perceptual metric. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 586\u2013595"},{"key":"295_CR81","unstructured":"Zhang C, Li S, Xia J, Wang W, Yan F, Liu Y (2020) $$\\{$$BatchCrypt$$\\}$$: efficient homomorphic encryption for $$\\{$$Cross-Silo$$\\}$$ federated learning. In: 2020 USENIX annual technical conference (USENIX ATC 20), pp 493\u2013506"},{"key":"295_CR82","unstructured":"Zhao B, Mopuri KR, Bilen H (2020) iDLG: improved deep leakage from gradients. arXiv preprint arXiv:2001.02610"},{"issue":"3","key":"295_CR83","doi-asserted-by":"publisher","first-page":"73","DOI":"10.3390\/fi13030073","volume":"13","author":"X Zhou","year":"2021","unstructured":"Zhou X, Xu M, Wu Y, Zheng N (2021) Deep model poisoning attack on federated learning. Future Internet 13(3):73","journal-title":"Future Internet"},{"key":"295_CR84","unstructured":"Zhu J, Blaschko M (2020) R-gap: recursive gradient attack on privacy. arXiv preprint arXiv:2010.07733"},{"key":"295_CR85","unstructured":"Zhu L, Liu Z, Han S (2019) Deep leakage from gradients. Adv Neural Inf Process Syst 32"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00295-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00295-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00295-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,20]],"date-time":"2025-05-20T02:02:33Z","timestamp":1747706553000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00295-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,20]]},"references-count":86,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["295"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00295-9","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,5,20]]},"assertion":[{"value":"30 April 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"18 September 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 May 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"33"}}