Evaluation of Model Sensitivity to Gradient Inversion Attacks in Federated Learning

• João Pedro Camargo Batista UFES
• Vinicius F. S. Mota UFES
• Rodolfo S. Villaça UFES

DOI: https://doi.org/10.5753/sbseg_estendido.2026.29883

Abstract

Federated Learning (FL) enables distributed model training while keeping local data private. However, FL remains vulnerable to Gradient Inversion Attacks (GIA), in which malicious agents reconstruct clients’ private data from shared gradients. This work evaluates the sensitivity of local models to GIA across individual layers and investigates the effectiveness of Differential Privacy (DP) as a mitigation strategy. Experiments conducted on the LFW facial dataset show that convolutional layers are more susceptible to GIA, especially in early training stages, and that relatively low noise levels are sufficient to degrade attack reconstruction quality.

References

Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. (2016). Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, page 308–318, New York, NY, USA. Association for Computing Machinery.

Dwork, C. (2006). Differential privacy. In Bugliesi, M., Preneel, B., Sassone, V., and Wegener, I., editors, Automata, Languages and Programming, pages 1–12, Berlin, Heidelberg. Springer Berlin Heidelberg.

Leite, L., Santo, Y., Dalmazo, B., and Riker, A. (2024). Federated learning under attack: Improving gradient inversion for batch of images. In Anais do XXIV Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais, pages 794–800, Porto Alegre, RS, Brasil. SBC.

Mammen, P. M. (2021). Federated learning: Opportunities and challenges.

McMahan, B., Moore, E., Ramage, D., Hampson, S., and Arcas, B. A. y. (2017). Communication-Efficient Learning of Deep Networks from Decentralized Data. In Singh, A. and Zhu, J., editors, Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54 of Proceedings of Machine Learning Research, pages 1273–1282. PMLR.

McMahan, H. B., Andrew, G., Erlingsson, U., Chien, S., Mironov, I., Papernot, N., and Kairouz, P. (2019). A general approach to adding differential privacy to iterative training procedures.

Mo, F., Borovykh, A., Malekzadeh, M., Haddadi, H., and Demetriou, S. (2021). Layer-wise characterization of latent information leakage in federated learning.

Novak, R., Bahri, Y., Abolafia, D. A., Pennington, J., and Sohl-Dickstein, J. (2018). Sensitivity and generalization in neural networks: an empirical study.

Wang, Z., Peng, C., He, X., and Tan, W. (2023). Wasserstein distance-based deep leakage from gradients. Entropy, 25(5).

Zhao, B., Mopuri, K. R., and Bilen, H. (2020). idlg: Improved deep leakage from gradients. ArXiv, abs/2001.02610.

Zhu, L., Liu, Z., and Han, S. (2019). Deep leakage from gradients. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc.