In federated learning a client never uploads its private data — only the gradient of the shared model's loss, averaged over its local mini-batch. This is Deep Leakage from Gradients (DLG): an honest-looking averaged gradient can still be inverted to recover the data behind it.
The model is one linear unit — the smallest case where the leak is exact: a frozen weight vector W and bias b map each private image (flattened pixels x, 8×8 = 64 values) to a scalar prediction, and the client's shared update is the batch-averaged gradient over its B local samples:
o_j = W·x_j + b
∇W = (1/B) Σ_j (o_j − y_j)·x_j (leaked — a blend of every x_j in the batch)
∇b = (1/B) Σ_j (o_j − y_j)
The attacker never sees any x_j — only ∇W and ∇b. Starting from B random dummy images, it runs the same forward pass on its guesses and does gradient descent to minimize the matching distance between its own averaged gradient and the leaked one, jointly over every dummy image at once:
D(x̂₁…x̂_B) = ‖∇W(x̂) − ∇W(x)‖² + (∇b(x̂) − ∇b(x))²
x̂_j ← x̂_j − η · ∂D/∂x̂_j
With B = 1 this converges fast and the reconstruction visibly locks onto the original — exactly the mechanism DLG (Zhu et al., 2019) demonstrated against real deep networks. Raise batch size and the single averaged gradient now has to explain several images at once: the attack has to disentangle a blend, convergence slows sharply and reconstructions blur together — batching is itself a mild, free defense real federated systems get almost for free.
- η — attacker's step size; too high overshoots, too low crawls.
- Batch size B — how many private samples the client averages into one shared gradient before it leaks; higher B = harder disentanglement for the attacker.
- DP noise σ — Gaussian noise added to the leaked gradient before the attacker ever sees it (differential privacy's core defense); push it up and reconstruction stalls at high MSE.
- Clip norm C — caps ‖∇W‖ before noise is added (gradient clipping, DP-SGD's other half); a small C also starves the attack of signal.
Each column below is one batch sample: top row is the private image (hidden from the server in reality — shown here so you can watch the bottom row converge onto it), bottom row is the attacker's evolving reconstruction.