Tsinghua's GIFD Reconstructs Private Images From Federated Learning Gradients

Takeaways

GIFD, accepted to TPAMI 2026, reconstructs client images from federated learning gradients at pixel-level fidelity.
It dissects a pre-trained GAN into 12 (BigGAN) or 7 (StyleGAN2) intermediate feature layers and optimizes them successively.
An l_1 ball constraint enforced via PGD keeps intermediate features inside realistic ranges.
A new label mapping technique handles out-of-distribution scenarios where attacker and victim label spaces differ.
Outperforms GGL, GIAS and other baselines against defenses like DP noise, clipping, Soteria, and CENSOR.
Code and FL simulator available at github.com/ffhibnese/GIFD_Gradient_Inversion_Attack .

Federated learning keeps raw records on clients, but the gradients sent to a coordinating server can still encode individual training samples. A paper accepted to TPAMI in 2026 describes an attack that searches the internal feature maps of a pretrained generative adversarial network, or GAN, to reconstruct high-fidelity versions of the images that produced those gradients.

The method, Gradient Inversion over Feature Domains (GIFD), comes from Hao Fang and collaborators at Tsinghua University and Harbin Institute of Technology. It extends their ICCV 2023 paper with label mapping for cases where the victim’s classifier and the attacker’s GAN use different label sets.

How an update becomes an image

When a server receives a client gradient g , an attacker can initialize a dummy image x′ , run it through the shared model, and optimize it until its gradient ∇θL(x′) resembles g . A close match indicates that the dummy image triggers the model in much the same way as the private sample.

Label information can also leak through the final classification layer. Many gradient-inversion attacks infer the target label first, then optimize the image using both the inferred label and the observed gradient. The resulting reconstruction may expose identity, medical imagery, documents, or other visual details without direct access to the client’s files.

Earlier GAN-assisted attacks such as GGL and GIAS use a generator as an image prior. A generator maps a compact latent vector z into an image, so searching over z limits the attack to outputs the GAN can render cleanly. That constraint works best when the private image resembles the generator’s training data. Distribution shifts can leave the required image outside the latent space, while optimizing every generator weight introduces a much larger and less stable search problem.