benchmark 2025

Differential Privacy: Gradient Leakage Attacks in Federated Learning Environments

Miguel Fernandez-de-Retana 1,2, Unai Zulaika 2, Rubén Sánchez-Corcuera 2, Aitor Almeida 2

1 Basque Center for Applied Mathematics

2 University of Deusto

0 citations · 31 references · arXiv
α

Published on arXiv

2510.23931

Model Inversion Attack

OWASP ML Top 10 — ML03

Key Finding

DP-SGD significantly mitigates gradient leakage-based training data reconstruction at a moderate utility cost, while PDP-SGD maintains accuracy but fails to prevent private data reconstruction in federated learning.

Federated Learning (FL) allows for the training of Machine Learning models in a collaborative manner without the need to share sensitive data. However, it remains vulnerable to Gradient Leakage Attacks (GLAs), which can reveal private information from the shared model updates. In this work, we investigate the effectiveness of Differential Privacy (DP) mechanisms - specifically, DP-SGD and a variant based on explicit regularization (PDP-SGD) - as defenses against GLAs. To this end, we evaluate the performance of several computer vision models trained under varying privacy levels on a simple classification task, and then analyze the quality of private data reconstructions obtained from the intercepted gradients in a simulated FL environment. Our results demonstrate that DP-SGD significantly mitigates the risk of gradient leakage attacks, albeit with a moderate trade-off in model utility. In contrast, PDP-SGD maintains strong classification performance but proves ineffective as a practical defense against reconstruction attacks. These findings highlight the importance of empirically evaluating privacy mechanisms beyond their theoretical guarantees, particularly in distributed learning scenarios where information leakage may represent an unassumable critical threat to data security and privacy.

Key Contributions

  • Empirical evaluation of DP-SGD and PDP-SGD as defenses against gradient leakage attacks in a simulated federated learning environment
  • Demonstrates DP-SGD significantly mitigates private data reconstruction risk at a moderate classification accuracy cost
  • Shows PDP-SGD preserves model utility but is ineffective as a practical defense against gradient inversion reconstruction

🛡️ Threat Analysis

Model Inversion Attack

The core threat is gradient leakage: an adversary intercepts FL gradient updates and reconstructs participants' private training data. The paper simulates this reconstruction attack and evaluates DP-SGD and PDP-SGD specifically as defenses against it — passing the 'adversary test' for ML03 with a concrete data reconstruction threat model.

Details

Domains
visionfederated-learning
Model Types
cnnfederated
Threat Tags
white_boxtraining_timedigital
Applications
image classificationfederated learning
Read PDF arXiv DOI Code

Similar Papers

benchmark

Privacy in Federated Learning with Spiking Neural Networks

2025 0 cit.
Model Inversion Attack
92%
defense

From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learning

2025 1 cit.
Model Inversion Attack
86%
defense

TIP: Resisting Gradient Inversion via Targeted Interpretable Perturbation in Federated Learning

2026 0 cit.
Model Inversion Attack
86%
attack

Uncovering Privacy Vulnerabilities through Analytical Gradient Inversion Attacks

2025 0 cit.
Model Inversion Attack
79%
defense

Towards Privacy-Preserving and Heterogeneity-aware Split Federated Learning via Probabilistic Masking

2025 0 cit.
Model Inversion Attack
79%
defense

Guarding the Middle: Protecting Intermediate Representations in Federated Split Learning

2026 0 cit.
Model Inversion Attack
79%
survey

Decentralized Privacy-Preserving Federal Learning of Computer Vision Models on Edge Devices

2026 0 cit.
Model Inversion Attack
79%
attack

Non-Linear Trajectory Modeling for Multi-Step Gradient Inversion Attacks in Federated Learning

2025 2 cit.
Model Inversion Attack
79%