attack 2025

MAGIA: Sensing Per-Image Signals from Single-Round Averaged Gradients for Label-Inference-Free Gradient Inversion

Zhanting Zhou , Jinbo Wang , Zeqin Wu , Fengli Zhang

University of Electronic Science and Technology of China

0 citations · 21 references · arXiv
α

Published on arXiv

2509.18170

Model Inversion Attack

OWASP ML Top 10 — ML03

Key Finding

MAGIA achieves high-fidelity multi-image reconstruction in large-batch federated learning scenarios where prior gradient inversion methods fail, without requiring label inference or auxiliary information

MAGIA

Novel technique introduced

We study gradient inversion in the challenging single round averaged gradient SAG regime where per sample cues are entangled within a single batch mean gradient. We introduce MAGIA a momentum based adaptive correction on gradient inversion attack a novel label inference free framework that senses latent per image signals by probing random data subsets. MAGIA objective integrates two core innovations 1 a closed form combinatorial rescaling that creates a provably tighter optimization bound and 2 a momentum based mixing of whole batch and subset losses to ensure reconstruction robustness. Extensive experiments demonstrate that MAGIA significantly outperforms advanced methods achieving high fidelity multi image reconstruction in large batch scenarios where prior works fail. This is all accomplished with a computational footprint comparable to standard solvers and without requiring any auxiliary information.

Key Contributions

  • Label-inference-free gradient inversion framework using random subset probing to sense per-image signals from batch-averaged gradients
  • Closed-form combinatorial rescaling that creates a provably tighter optimization bound consistent across subset sizes
  • Momentum-based mixing of whole-batch and subset losses for robust multi-image reconstruction in large-batch SAG regimes

🛡️ Threat Analysis

Model Inversion Attack

MAGIA is a gradient inversion attack where an honest-but-curious server reconstructs private client training images from observed batch-mean gradients — the core ML03 threat of adversarially recovering training data from model updates in federated learning.

Details

Domains
visionfederated-learning
Model Types
cnnfederated
Threat Tags
white_boxtraining_timetargeted
Applications
federated learningimage reconstruction from gradients
Read PDF arXiv DOI Code

Similar Papers

attack

MAUI: Reconstructing Private Client Data in Federated Transfer Learning

2025 0 cit.
Model Inversion Attack
93%
attack

Non-Linear Trajectory Modeling for Multi-Step Gradient Inversion Attacks in Federated Learning

2025 2 cit.
Model Inversion Attack
92%
attack

Uncovering Privacy Vulnerabilities through Analytical Gradient Inversion Attacks

2025 0 cit.
Model Inversion Attack
92%
attack

ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery

2026 0 cit.
Model Inversion Attack
86%
attack

Enhanced Privacy Leakage from Noise-Perturbed Gradients via Gradient-Guided Conditional Diffusion Models

2025 0 cit.
Model Inversion Attack
86%
attack

GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Models

2025 1 cit.
Model Inversion Attack
86%
attack

Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization

2026 0 cit.
Model Inversion Attack
86%
attack

Deep Leakage with Generative Flow Matching Denoiser

2026 0 cit.
Model Inversion Attack
80%