Gradient Leakage Attack on Federated Learning

Attack Controls

Attacker learning rate η 0.30

DP noise σ (on leaked gradient) 0.00

Gradient clip norm C ∞

Live Readouts

Iteration

Grad-match loss D

—

Reconstruction MSE

—

Leaked ‖∇W‖

—

How it works

In federated learning a client never uploads its private data — only the gradient of the shared model's loss, computed on that data. This is Deep Leakage from Gradients (DLG): an honest-looking gradient can be inverted to recover the data that produced it.

The model here is one linear unit, the smallest case where the leak is exact: a frozen weight vector W and bias b map a private image (flattened pixels x, 8×8 = 64 values) to a scalar prediction, trained toward target y:

o = W·x + b
L = ½(o − y)²
∇W L = (o − y)·x        (the leaked gradient — proportional to x!)
∇b L = (o − y)

The attacker never sees x — only ∇W and ∇b. Starting from a random dummy image x̂, it computes the same gradient formula on x̂ and runs gradient descent to minimize the matching distance:

D(x̂) = ‖∇W(x̂) − ∇W(x)‖² + (∇b(x̂) − ∇b(x))²
x̂ ← x̂ − η · ∂D/∂x̂

Because ∇W is (nearly) linear in x, this optimization converges fast and x̂ visibly turns into x — the private image is stolen from gradients alone, exactly the mechanism DLG (Zhu et al., 2019) demonstrated against real deep networks.

η — attacker's step size; too high overshoots, too low crawls.
DP noise σ — Gaussian noise added to the leaked gradient before the attacker ever sees it (differential privacy's core defense); push it up and reconstruction stalls at high MSE.
Clip norm C — caps ‖∇W‖ before noise is added (gradient clipping, DP-SGD's other half); a small C also starves the attack of signal.

The two grids below are for demonstration only: in reality the server/attacker never sees the left grid — it is shown here so you can watch the right one converge onto it.

Private image x (hidden from server) Attacker reconstruction x̂ (evolving)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.