This repository hosts and maintains up-to-date systematization of Gradient Inversion Attacks and defenses in Federated Learning, following the categorization and threat model taxonomy introduced in our paper "SoK: Gradient Inversion Attacks in Federated Learning" published in USENIX Security 2025.

The tables are structured to provide a clear, comparative overview of the state-of-the-art, including:

• Attack techniques and their properties
• Defense mechanisms and their effectiveness
• Threat models with real-world applicability

Our goal is to offer a living resource for researchers and practitioners, reflecting the latest developments and evaluations in the field. Tables will be updated regularly as new works and insights emerge.

Feel free to open issues or pull requests to suggest updates or corrections.

For further information, please contact: [email protected]

If you find this repository useful for your research, please consider citing our work:

@inproceedings{carletti2025sok,
  title     = {SoK: Gradient Inversion Attacks in Federated Learning},
  author    = {Vincenzo Carletti and Pasquale Foggia and Carlo Mazzocca and Giuseppe Parrella and Mario Vento},
  booktitle = {34th USENIX Security Symposium (USENIX Security 25)},
  year      = {2025},
  pages={6439--6459},
  url       = {https://www.usenix.org/conference/usenixsecurity25/presentation/carletti},
  publisher = {USENIX Association},
}

Legend for Applicability:
★★★ = highly applicable and less detectable
★★☆ = potentially applicable (depends on specific configuration)
★☆☆ = less applicable and more detectable

Symbol legend:
🆕 = new label recovery method
◦ = assumes label knowledge
★ = optimization-based label reconstruction

• = no label restoration algorithm used
  ² = adds linear layers in the shared models (potentially detectable by clients)
  ³ = targets linear layers, extendable to full models by modifying preceding layers to transmit inputs
  "Batch Size" reflects the maximum used; attacks utilizing FedAVG are expressed as E×B, where E is the number of iterations/epochs.
  "Open Source" contains clickable links to available repositories.

References:
[1] Deep Leakage from Gradients. NeurIPS. paper

[2] iDLG: Improved Deep Leakage from Gradients. paper

[3] Inverting Gradients - How Easy is it to Break Privacy in Federated Learning? paper

[4] See Through Gradients: Image Batch Recovery via GradInversion. paper

[5] GradViT: Gradient Inversion of Vision Transformers. paper

[6] Data Leakage in Federated Averaging. paper

[7] Do Gradient Inversion Attacks Make Federated Learning Unsafe? paper

[8] Cocktail Party Attack: Breaking Aggregation-based Privacy in Federated Learning Using Independent Component Analysis. paper

[9] Usynin, D., et al. (2023). Beyond Gradients: Exploiting Adversarial Priors in Model Inversion Attacks. paper

[10] E2EGI: End-to-End Gradient Inversion in Federated Learning. paper

[11] High-Fidelity Gradient Inversion in Distributed Learning. paper

[12] Temporal Gradient Inversion Attacks with Robust Optimization. paper

[13] Using Highly Compressed Gradients in Federated Learning for Data Reconstruction Attacks. paper

[14] Gradient Obfuscation Gives a False Sense of Security in Federated Learning. paper

[15] GI-PIP: Do We Require Impractical Auxiliary Dataset for Gradient Inversion Attacks? paper

[16] Mjölnir: Breaking the Shield of Perturbation-Protected Gradients via Adaptive Diffusion. paper

[17] Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning. paper

[18] GRNN: Generative Regression Neural Network—A Data Leakage Attack for Federated Learning. paper

[19] Fast Generation-Based Gradient Leakage Attacks against Highly Compressed Gradients. paper

[20] Gradient Inversion with Generative Image Prior. NeurIPS. paper

[21] Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakage. paper

[22] GIFD: A Generative Gradient Inversion Method with Feature Domain Optimization. paper

[23] CGIR: Conditional Generative Instance Reconstruction Attacks Against Federated Learning. paper

[24] Federated Learning Vulnerabilities: Privacy Attacks with Denoising Diffusion Probabilistic Models. paper

[25] R-GAP: Recursive Gradient Attack on Privacy. paper

[26] APRIL: Finding the Achilles' Heel on Privacy for Vision Transformers. paper

[27] SPEAR: Exact Gradient Inversion of Batches in Federated Learning. paper [28] Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Models. paper

[29] Fishing for User Data in Large-Batch Federated Learning via Gradient Magnification. paper

[30] When the Curious Abandon Honesty: Federated Learning is Not Private. paper

[31] Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregation. paper

[32] The Resource Problem of Using Linear Layer Leakage Attack in Federated Learning. paper

[33] LOKI: Large-scale Data Reconstruction Attack Against Federated Learning Through Model Manipulation. paper

[34] Maximum Knowledge Orthogonality Reconstruction with Gradients in Federated Learning. paper

[35] Hiding in Plain Sight: Disguising Data Stealing Attacks in Federated Learning. paper

[36] Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction. paper

References:
[37] Learning Differentially Private Recurrent Language Models. paper

[38] FedCDP: Client-level Differential Privacy for Federated Learning. paper

[39] Does Differential Privacy Really Protect Federated Learning From Gradient Leakage Attacks? paper

[40] Sok: Secure aggregation based on cryptographic schemes for federated learning. paper

[41] Practical Secure Aggregation for Privacy-Preserving Machine Learning. paper

[42] Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attacks. paper

[43] Preserving data privacy in federated learning through large gradient pruning. paper

[44] Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakage paper

[45] Soteria: Provable Defense Against Privacy Leakage in Federated Learning. GitHub paper

[46] Protect Privacy from Gradient Leakage Attack in Federated Learning GitHub paper

[47] More Than Enough is Too Much: Adaptive Defenses Against Gradient Leakage in Production Federated Learning paper

[48] CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling. GitHub paper

[49] Digestive neural networks: A novel defense strategy against inference attacks in federated learning paper

[50] Enhanced Security and Privacy via Fragmented Federated Learning GitHub paper

[51] Enhancing Privacy Preservation in Federated Learning via Learning Rate Perturbation. paper

[52] Automatic Transformation Search Against Deep Leakage from Gradients GitHub paper

[53] Bayesian Framework for Gradient Leakage paper

[54] Privacy-Encoded Federated Learning Against Gradient-Based Data Reconstruction Attacks paper

[55] Gradient Inversion Attacks: Impact Factors Analyses and Privacy Enhancement GitHub paper

[56] Concealing Sensitive Samples against Gradient Leakage in Federated Learning GitHub paper

[57] Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attacks paper

[58] PRECODE - A Generic Model Extension To Prevent Deep Gradient Leakage GitHub paper

[59] Gradient Leakage Defense with Key-Lock Module for Federated Learning GitHub paper