Scaling Limits of the Dropout Inversion Attack: An Empirical Analysis Under Increasing Input Dimensionality

• Eduardo Silva UFOP
• Rodrigo Silva UFOP

DOI: https://doi.org/10.5753/eniac.2026.31046

Resumo

Ataques de inversão de gradientes exploram gradientes compartilhados no aprendizado federado para reconstruir amostras privadas de treinamento. O Dropout Inversion Attack (DIA) contorna defesas baseadas em dropout ao otimizar conjuntamente a entrada sintética, os rótulos e as máscaras de dropout. Aqui, caracterizamos os limites de escalabilidade do DIA por meio de um experimento fatorial com CIFAR-10, quatro arquiteturas e três taxas de dropout. No MLP, a qualidade de reconstrução decresce monotonicamente com a resolução (56,1 ± 15,0 dB a 32×32 para 27,2 ± 6,3 dB a 224×224) enquanto o tempo de execução cresce de forma supralinear. A LeNet mantém qualidade alta em toda a faixa testada sem decaimento monotônico. As ResNets falham independentemente da resolução, efeito atribuído ao batch normalization. A escalabilidade do DIA é dependente de arquitetura: para MLPs a barreira prática em alta resolução é computacional, não de qualidade.

Referências

Carletti, V., Foggia, P., Mazzocca, C., Parrella, G., and Vento, M. (2025). {SoK}: Gradient inversion attacks in federated learning. In 34th USENIX Security Symposium (USENIX Security 25), pages 6439–6459.

Geiping, J., Bauermeister, H., Dröge, H., and Moeller, M. (2020). Inverting Gradients – How easy is it to break privacy in federated learning? In Advances in Neural Information Processing Systems, pages 16937–16947, Vancouver, Canada.

Guo, P., Wang, R., Zeng, S., Zhu, J., Jiang, H., Wang, Y., Zhou, Y., Wang, F., Xiong, H., and Qu, L. (2025). Exploring the vulnerabilities of federated learning: A deep dive into gradient inversion attacks. IEEE Transactions on Pattern Analysis and Machine Intelligence.

McMahan, H. B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B. A. (2017). Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the International Conference on Artificial Intelligence and Statistics, pages 1273–1282, Fort Lauderdale, FL, USA.

Scheliga, D., Mäder, P., and Seeland, M. (2023). Dropout Is NOT All You Need to Prevent Gradient Leakage. In Proceedings of the National Conference on Artificial Intelligence, pages 9934–9942, Washington, DC, USA.

Sotthiwat, E., Zhang, C., Xiao, X., and Zhen, L. (2026). Safeguarding federated learning from data reconstruction attacks via gradient dropout. IEEE Transactions on Information Forensics and Security, 21:1874–1888.

Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I., and Salakhutdinov, R. (2014). Dropout: A Simple Way to Prevent Neural Networks from Overfitting. Journal of Machine Learning Research, 15(1):1929–1958.

Sun, L., Qian, J., and Chen, X. (2021). Soteria: Provable Defense Against Privacy Leakage in Federated Learning from Representation Perspective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9311–9319, Nashville, TN, USA.

Zhang, R., Guo, S., Wang, J., Xie, X., and Tao, D. (2022). A survey on gradient inversion: Attacks, defenses and future directions. In Raedt, L. D., editor, Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22, pages 5678–5685. International Joint Conferences on Artificial Intelligence Organization. Survey Track.

Zheng, Y. (2021). Dropout against deep leakage from gradients. arXiv preprint arXiv:2108.11106.

Zhu, L., Liu, Z., and Han, S. (2019). Deep Leakage from Gradients. In Advances in Neural Information Processing Systems, pages 14774–14784, Vancouver, Canada.

Zhu, R., Cao, D., Zheng, W., and Cao, J. (2021). R-GAP: Recursive Gradient Attack on Privacy. In Proceedings of the International Conference on Learning Representations, Virtual.