Gradient Leakage

Federated learning sends gradients instead of data on the assumption that a gradient reveals little. It reveals a great deal: from a single update it is often possible to reconstruct the images or text that produced it, pixel by pixel, by optimising a fake input until its gradient matches. The assumption that made the design feel safe was never established.

Reconstruction quality falls with batch size, since a summed gradient over many examples is far more ambiguous than one over a few, and it falls with the noise differential privacy adds. This is why secure aggregation and DP are not optional extras on top of federated learning — they are what makes its central claim true rather than assumed.

Minimise ‖∇W(x̂, ŷ) − ∇W‖² over a candidate input x̂ initialised at random. The problem is badly determined for large batches, since many inputs produce a similar sum, which is why the practical defence is aggregating more before releasing rather than perturbing more within.