{"type":"ScholarlyArticle","title":"A Survey on Gradient Inversion: Attacks, Defenses and Future Directions","authors":[{"name":"Rui Zhang","slug":"rui-zhang","given":"Rui","family":"Zhang","affiliation":"The Hong Kong Polytechnic University"},{"name":"Song Guo","slug":"song-guo","given":"Song","family":"Guo","affiliation":"The Hong Kong Polytechnic University; The Hong Kong Polytechnic University Shenzhen Research Institute"},{"name":"Junxiao Wang","slug":"junxiao-wang","given":"Junxiao","family":"Wang","affiliation":"The Hong Kong Polytechnic University"},{"name":"Xin Xie","slug":"xin-xie","given":"Xin","family":"Xie","affiliation":"The Hong Kong Polytechnic University"},{"name":"Dacheng Tao","slug":"dacheng-tao","given":"Dacheng","family":"Tao","affiliation":"JD Explore Academy ,"}],"abstract":"Recent studies have shown that the training samples can be recovered from gradients, which are called Gradient Inversion (GradInv) attacks. However, there remains a lack of extensive surveys covering recent advances and thorough analysis of this issue. In this paper, we present a comprehensive survey on GradInv, aiming to summarize the cutting-edge research and broaden the horizons for different domains. Firstly, we propose a taxonomy of GradInv attacks by characterizing existing attacks into two paradigms: iteration- and recursion-based attacks. In particular, we dig out some critical ingredients from the iteration-based attacks, including data initialization, model training and gradient matching. Second, we summarize emerging defense strategies against GradInv attacks. We find these approaches focus on three perspectives covering data obscuration, model improvement and gradient protection. Finally, we discuss some promising directions and open problems for further research.","doi":"10.24963/ijcai.2022/791","url":"https://ijcai.org/proceedings/2022/791","pdf":"https://ijcai.org/proceedings/2022/0791.pdf","markdown":"https://ijcai.org/proceedings/2022/791.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/791","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Survey Track","track":"Survey Track","number":791,"pages":{"first":5678,"last":5685},"keywords":["Survey Track: AI Ethics, Trust, Fairness","Survey Track: Uncertainty in AI","Survey Track: Machine Learning"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38987288","length_sec":80,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985431","length_sec":645,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Balunović et al., 2022] Mislav Balunović, Dimitar Iliev Dimitrov, Robin Staab, and Martin Vechev. Bayesian framework for gradient leakage. In ICLR, 2022.","title":"Bayesian framework for gradient leakage","authors":"Mislav Balunović, Dimitar Iliev Dimitrov, Robin Staab, Martin Vechev","year":"2022","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bonawitz et al., 2017] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving ma- chine learning. In CCS, pages 1175-1191, 2017.","title":"Practical secure aggregation for privacy-preserving machine learning","authors":"Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, Brendan Mcmahan, Sarvar Patel, Daniel Ramage, Aaron Segal, Karn Seth","year":"2017","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bonawitz et al., 2019] Keith Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloe Kiddon, Jakub Konečnỳ, Stefano Mazzocchi, H Brendan McMahan, et al. Towards feder- ated learning at scale: System design. In MLSys, 2019.","title":"Towards federated learning at scale: System design","authors":"Keith Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloe Kiddon, Jakub Konečnỳ, Stefano Mazzocchi, H Brendan Mcmahan","year":"2019","venue":"MLSys","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bouacida and Mohapatra, 2021] Nader Bouacida and Pras- ant Mohapatra. Vulnerabilities in federated learning. IEEE Access, 9:63229-63249, 2021.","title":"Nader Bouacida and Prasant Mohapatra. Vulnerabilities in federated learning","authors":"Mohapatra Bouacida","year":"2021","venue":"IEEE Access","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen and Campbell, 2021] Cangxiong Chen and Neill D. F. Campbell. Understanding training-data leakage from gra- dients in neural networks for imageclassifications. In NeurIPS Workshop, 2021.","title":"Understanding training-data leakage from gradients in neural networks for imageclassifications","authors":"Chen, Campbell, Cangxiong Chen, D F Neill, Campbell","year":"2021","venue":"NeurIPS Workshop","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dang et al., 2021] Trung Dang, Om Thakkar, Swaroop Ra- maswamy, Rajiv Mathews, Peter Chin, and Franc ¸oise Bea- ufays. Revealing and protecting labels in distributed train- ing. In NeurIPS, 2021.","title":"Revealing and protecting labels in distributed training","authors":"Trung Dang, Om Thakkar, Swaroop Ramaswamy, Rajiv Mathews, Peter Chin, Franc, Beaufays","year":"2021","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Deng et al., 2009] Jia Deng, Wei Dong, Richard Socher, Li- Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.","title":"Imagenet: A large-scale hierarchical image database","authors":"Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, Li Fei-Fei","year":"2009","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Deng et al., 2021] Jieren Deng, Yijue Wang, Ji Li, Chenghong Wang, Chao Shang, Hang Liu, Sanguthevar Rajasekaran, and Caiwen Ding. Tag: Gradient attack on transformer-based language models. In EMNLP, 2021.","title":"Tag: Gradient attack on transformer-based language models","authors":"Deng","year":"2021","venue":"EMNLP","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Dosovitskiy et al., 2021] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Min- derer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Trans- formers for image recognition at scale. In ICLR, 2021.","title":"An image is worth 16x16 words: Transformers for image recognition at scale","authors":"Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, Neil Houlsby","year":"2021","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Fan et al., 2020] Lixin Fan, Kam Woh Ng, Ce Ju, Tianyu Zhang, Chang Liu, Chee Seng Chan, and Qiang Yang. Re- thinking privacy preserving deep learning: How to eval- uate and thwart privacy attacks. In Federated Learning, pages 32-50. Springer, 2020.","title":"Rethinking privacy preserving deep learning: How to evaluate and thwart privacy attacks","authors":"Lixin Fan, Kam Woh Ng, Ce Ju, Tianyu Zhang, Chang Liu, Chee Seng Chan, Qiang Yang","year":"2020","venue":"Federated Learning","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Fan, 2018] Liyue Fan. Image pixelization with differential privacy. In IFIP Annual Conference on Data and Applica- tions Security and Privacy, pages 148-162, 2018.","title":"Liyue Fan. Image pixelization with differential privacy","authors":"Fan","year":"2018","venue":"IFIP Annual Conference on Data and Applications Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Fan, 2019] Liyue Fan. Differential privacy for image pub- lication. In Theory and Practice of Differential Privacy (TPDP) Workshop, pages 1-6, 2019.","title":"Liyue Fan. Differential privacy for image publication","authors":"Fan","year":"2019","venue":"Theory and Practice of Differential Privacy (TPDP) Workshop","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Fereidooni et al., 2021] Hossein Fereidooni, Samuel Mar- chal, Markus Miettinen, Azalia Mirhoseini, Helen Möllering, Thien Duc Nguyen, Phillip Rieger, Ahmad- Reza Sadeghi, Thomas Schneider, Hossein Yalame, et al. Safelearn: Secure aggregation for private federated learn- ing. In IEEE S&P Workshops (SPW), pages 56-62, 2021.","title":"Safelearn: Secure aggregation for private federated learning","authors":"Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Helen Möllering, Thien Duc Nguyen, Phillip Rieger, Ahmad-Reza Sadeghi, Thomas Schneider, Hossein Yalame","year":"2021","venue":"IEEE S&P Workshops (SPW)","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Geiping et al., 2020] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients -how easy is it to break privacy in federated learning? In NeurIPS, pages 16937-16947, 2020.","title":"Inverting gradients -how easy is it to break privacy in federated learning?","authors":"Geiping","year":"2020","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[He et al., 2021] Fengxiang He, Bohan Wang, and Dacheng Tao. Tighter generalization bounds for iterative differen- tially private learning algorithms. In UAI, 2021.","title":"Tighter generalization bounds for iterative differentially private learning algorithms","authors":"Fengxiang He, Bohan Wang, Dacheng Tao","year":"2021","venue":"UAI","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Huang et al., 2020] Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora. Instahide: Instance-hiding schemes for private distributed learning. In ICML, 2020.","title":"Instahide: Instance-hiding schemes for private distributed learning","authors":"Huang","year":"2020","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Huang et al., 2021] Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and defenses in federated learning. In NeurIPS, 2021.","title":"Evaluating gradient inversion attacks and defenses in federated learning","authors":"Huang","year":"2021","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Jegorova et al., 2021] Marija Jegorova, Chaitanya Kaul, Charlie Mayor, Alison Q O'Neil, Alexander Weir, Rod- erick Murray-Smith, and Sotirios A Tsaftaris. Survey: Leakage and privacy at inference time. arXiv preprint arXiv:2107.01614, 2021.","title":"Survey: Leakage and privacy at inference time","authors":"Marija Jegorova, Chaitanya Kaul, Charlie Mayor, Q O' Alison, Alexander Neil, Roderick Weir, Sotirios A Murray-Smith, Tsaftaris","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Jeon et al., 2021] Jiwnoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al. Gradient inversion with genera- tive image prior. In NeurIPS, 2021.","title":"Gradient inversion with generative image prior","authors":"Jeon","year":"2021","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Jin et al., 2021] Xiao Jin, Pin-Yu Chen, Chia-Yi Hsu, Chia- Mu Yu, and Tianyi Chen. Catastrophic data leakage in vertical federated learning. In NeurIPS, 2021.","title":"Catastrophic data leakage in vertical federated learning","authors":"Xiao Jin, Pin-Yu Chen, Chia-Yi Hsu, Chia-Mu Yu, Tianyi Chen","year":"2021","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Karimireddy et al., 2019] Sai Praneeth Karimireddy, Quentin Rebjock, Sebastian Stich, and Martin Jaggi. Error feedback fixes signsgd and other gradient compression schemes. In ICML, pages 3252-3261, 2019.","title":"Error feedback fixes signsgd and other gradient compression schemes","authors":"Praneeth Sai, Quentin Karimireddy, Sebastian Rebjock, Martin Stich, Jaggi","year":"2019","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Kim et al., 2018] Jinsu Kim, Dongyoung Koo, Yuna Kim, Hyunsoo Yoon, Junbum Shin, and Sungwook Kim. Ef- ficient privacy-preserving matrix factorization for recom- mendation via fully homomorphic encryption. ACM Transactions on Privacy and Security, 21(4):1-30, 2018.","title":"Efficient privacy-preserving matrix factorization for recommendation via fully homomorphic encryption","authors":"Jinsu Kim, Dongyoung Koo, Yuna Kim, Hyunsoo Yoon, Junbum Shin, Sungwook Kim","year":"2018","venue":"ACM Transactions on Privacy and Security","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Lam et al., 2021] Maximilian Lam, Gu-Yeon Wei, David Brooks, Vijay Janapa Reddi, and Michael Mitzenmacher. Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix. In ICML, 2021.","title":"Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix","authors":"Maximilian Lam, Gu-Yeon, David Wei, Vijay Janapa Brooks, Michael Reddi, Mitzenmacher","year":"2021","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[LeCun, 1998] Yann LeCun. The mnist database of hand- written digits. http://yann.lecun.com/exdb/mnist/, 1998. Accessed: 2022-01-27.","title":"The mnist database of handwritten digits","authors":"Yann Lecun","year":"2022","venue":null,"doi":null,"url":"http://yann.lecun.com/exdb/mnist/,1998","internal_url":null},{"position":26,"raw":"[Lia and Togan, 2020] Dragos Lia and Mihai Togan. Privacy-preserving machine learning using federated learning and secure aggregation. In ECAI, 2020.","title":"Privacy-preserving machine learning using federated learning and secure aggregation","authors":"Dragos Lia, Mihai Togan","year":"2020","venue":"ECAI","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Liu et al., 2021] Yong Liu, Xinghua Zhu, Jianzong Wang, and Jing Xiao. A quantitative metric for privacy leakage in federated learning. In ICASSP, pages 3065-3069, 2021.","title":"A quantitative metric for privacy leakage in federated learning","authors":"Yong Liu, Xinghua Zhu, Jianzong Wang, Jing Xiao","year":"2021","venue":"ICASSP","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Lu et al., 2021] Jiahao Lu, Xi Sheryl Zhang, Tianli Zhao, Xiangyu He, and Jian Cheng. April: Finding the achilles' heel on privacy for vision transformers. arXiv preprint arXiv:2112.14087, 2021.","title":"April: Finding the achilles' heel on privacy for vision transformers","authors":"Jiahao Lu, Sheryl Xi, Tianli Zhang, Xiangyu Zhao, Jian He, Cheng","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Mahendran and Vedaldi, 2015] Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representa- tions by inverting them. In CVPR, pages 5188-5196, 2015.","title":"Understanding deep image representations by inverting them","authors":"Vedaldi Mahendran, Aravindh Mahendran, Andrea Vedaldi","year":"2015","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[McMahan et al., 2017] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Ar- cas. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics (AISTATS), pages 1273-1282, 2017.","title":"Communication-efficient learning of deep networks from decentralized data","authors":"Brendan Mcmahan, Eider Moore, Daniel Ramage, Seth Hampson, Blaise Aguera Y Arcas","year":"2017","venue":"Artificial Intelligence and Statistics (AISTATS)","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Mo et al., 2021] Fan Mo, Anastasia Borovykh, Mohammad Malekzadeh, Hamed Haddadi, and Soteris Demetriou. Layer-wise characterization of latent information leakage in federated learning. In ICLR Workshop, 2021.","title":"Layer-wise characterization of latent information leakage in federated learning","authors":"Fan Mo, Anastasia Borovykh, Mohammad Malekzadeh, Hamed Haddadi, Soteris Demetriou","year":"2021","venue":"ICLR Workshop","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Nasr et al., 2021] Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papemoti, and Nicholas Carlin. Adver- sary instantiation: Lower bounds for differentially private machine learning. In IEEE Symposium on Security and Privacy (SP), pages 866-882, 2021.","title":"Adversary instantiation: Lower bounds for differentially private machine learning","authors":"Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papemoti, Nicholas Carlin","year":"2021","venue":"IEEE Symposium on Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Nguyen et al., 2015] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High con- fidence predictions for unrecognizable images. In CVPR, pages 427-436, 2015.","title":"Deep neural networks are easily fooled: High confidence predictions for unrecognizable images","authors":"Anh Nguyen, Jason Yosinski, Jeff Clune","year":"2015","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Pang et al., 2020] Tianyu Pang, Kun Xu, and Jun Zhu. Mixup inference: Better exploiting mixup to defend ad- versarial attacks. In ICLR, 2020.","title":"Mixup inference: Better exploiting mixup to defend adversarial attacks","authors":"Tianyu Pang, Kun Xu, Jun Zhu","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Phong et al., 2018] Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy- preserving deep learning via additively homomorphic en- cryption. IEEE Transactions on Information Forensics and Security, 13(5):1333-1345, 2018.","title":"Privacypreserving deep learning via additively homomorphic encryption","authors":"Le Trieu, Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, Shiho Moriai","year":"2018","venue":"IEEE Transactions on Information Forensics and Security","doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Qian et al., 2021] Jia Qian, Hiba Nassar, and Lars Kai Hansen. Minimal model structure analysis for input re- construction in federated learning. In NeurIPS Workshop, 2021.","title":"Minimal model structure analysis for input reconstruction in federated learning","authors":"Jia Qian, Hiba Nassar, Lars Kai Hansen","year":"2021","venue":"NeurIPS Workshop","doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Sun et al., 2021] Jingwei Sun, Ang Li, Binghui Wang, Huanrui Yang, Hai Li, and Yiran Chen. Soteria: Prov- able defense against privacy leakage in federated learning from representation perspective. In CVPR, 2021.","title":"Soteria: Provable defense against privacy leakage in federated learning from representation perspective","authors":"Jingwei Sun, Ang Li, Binghui Wang, Huanrui Yang, Hai Li, Yiran Chen","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Truex et al., 2020] Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, and Wenqi Wei. Ldp-fed: Fed- erated learning with local differential privacy. In ACM International Workshop on Edge Systems, Analytics and Networking (EdgeSys), pages 61-66, 2020.","title":"Ldp-fed: Federated learning with local differential privacy","authors":"Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, Wenqi Wei","year":"2020","venue":"ACM International Workshop on Edge Systems, Analytics and Networking (EdgeSys)","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Vaswani et al., 2017] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In NeurIPS, 2017.","title":"Attention is all you need","authors":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, Illia Polosukhin","year":"2017","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Vogels et al., 2019] Thijs Vogels, Sai Praneeth Karim- ireddy, and Martin Jaggi. Powersgd: Practical low-rank gradient compression for distributed optimization. In NeurIPS, pages 14259-14268, 2019.","title":"Powersgd: Practical low-rank gradient compression for distributed optimization","authors":"Thijs Vogels, Sai Praneeth Karimireddy, Martin Jaggi","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":41,"raw":"[Wainakh et al., 2021a] Aidmar Wainakh, Fabrizio Ven- tola, Till Müßig, Jens Keim, Carlos Garcia Cordero, Ephraim Zimmer, Tim Grube, Kristian Kersting, and Max Mühlhäuser. User label leakage from gradients in feder- ated learning. arXiv preprint arXiv:2105.09369, 2021.","title":"User label leakage from gradients in federated learning","authors":"Wainakh","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":42,"raw":"[Wainakh et al., 2021b] Aidmar Wainakh, Ephraim Zimmer, Sandeep Subedi, Jens Keim, Tim Grube, Shankar Karup- payah, Alejandro Sanchez Guinea, and Max Mühlhäuser. Federated learning attacks revisited: A critical discus- sion of gaps, assumptions, and evaluation setups. arXiv preprint arXiv:2111.03363, 2021.","title":"Federated learning attacks revisited: A critical discussion of gaps, assumptions, and evaluation setups","authors":"Wainakh","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":43,"raw":"[Wang et al., 2020] Yijue Wang, Jieren Deng, Dan Guo, Chenghong Wang, Xianrui Meng, Hang Liu, Caiwen Ding, and Sanguthevar Rajasekaran. Sapag: A self- adaptive privacy attack from gradients. arXiv preprint arXiv:2009.06228, 2020.","title":"Sapag: A selfadaptive privacy attack from gradients","authors":"Wang","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":44,"raw":"[Wei et al., 2020a] Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. Federated learning with dif- ferential privacy: Algorithms and performance analysis. IEEE Transactions on Information Forensics and Security, 15:3454-3469, 2020.","title":"Federated learning with differential privacy: Algorithms and performance analysis","authors":"Wei","year":"2020","venue":"IEEE Transactions on Information Forensics and Security","doi":null,"url":null,"internal_url":null},{"position":45,"raw":"[Wei et al., 2020b] Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu. A framework for evaluating client privacy leakages in federated learning. In ESORICS, 2020.","title":"A framework for evaluating client privacy leakages in federated learning","authors":"Wei","year":"2020","venue":"ESORICS","doi":null,"url":null,"internal_url":null},{"position":46,"raw":"[Wei et al., 2021] Wenqi Wei, Ling Liu, Yanzhao Wut, Gong Su, and Arun Iyengar. Gradient-leakage resilient federated learning. In ICDCS, pages 797-807, 2021.","title":"Gradient-leakage resilient federated learning","authors":"Wenqi Wei, Ling Liu, Yanzhao Wut, Gong Su, Arun Iyengar","year":"2021","venue":"ICDCS","doi":null,"url":null,"internal_url":null},{"position":47,"raw":"[Xiao et al., 2017] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for bench- marking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.","title":"Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms","authors":"Han Xiao, Kashif Rasul, Roland Vollgraf","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":48,"raw":"[Yang, 2021] He Yang. H-fl: A hierarchical communication- efficient and privacy-protected architecture for federated learning. In IJCAI, 2021.","title":"H-fl: A hierarchical communicationefficient and privacy-protected architecture for federated learning","authors":"Yang ; He Yang","year":"2021","venue":"IJCAI","doi":null,"url":null,"internal_url":null},{"position":49,"raw":"[Yin et al., 2021] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinver- sion. In CVPR, pages 16337-16346, 2021.","title":"See through gradients: Image batch recovery via gradinversion","authors":"Arun Hongxu Yin, Arash Mallya, Jose M Vahdat, Jan Alvarez, Pavlo Kautz, Molchanov","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":50,"raw":"[Zhang et al., 2018] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In ICLR, 2018.","title":"mixup: Beyond empirical risk minimization","authors":"Hongyi Zhang, Moustapha Cisse, David Yann N Dauphin, Lopez-Paz","year":"2018","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":51,"raw":"[Zhang et al., 2020] Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning. In USENIX ATC, pages 493-506, 2020.","title":"Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning","authors":"Zhang","year":"2020","venue":"USENIX ATC","doi":null,"url":null,"internal_url":null},{"position":52,"raw":"[Zhao et al., 2020] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610, 2020.","title":"idlg: Improved deep leakage from gradients","authors":"Bo Zhao, Konda Reddy Mopuri, Hakan Bilen","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":53,"raw":"[Zheng, 2021] Yanchong Zheng. Dropout against deep leak- age from gradients. arXiv preprint arXiv:2108.11106, 2021.","title":"Dropout against deep leakage from gradients","authors":"Yanchong Zheng","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":54,"raw":"[Zhu and Blaschko, 2021] Junyi Zhu and Matthew B. Blaschko. R-gap: Recursive gradient attack on privacy. In ICLR, 2021.","title":"R-gap: Recursive gradient attack on privacy","authors":"Junyi Zhu, Matthew B Blaschko","year":"2021","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":55,"raw":"[Zhu et al., 2019] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS, 2019.","title":"Deep leakage from gradients","authors":"Ligeng Zhu, Zhijian Liu, Song Han","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}