Gradient Leakage in Federated Learning: Extracting Training Data from Model Updates
For executives
Federated learning was designed to enable collaborative AI training without sharing raw data. Gradient leakage is the research result that shows this privacy guarantee is weaker than expected: under certain conditions, an attacker who observes the gradients shared by a participant can reconstruct the original training data those gradients were computed from. This is not a software vulnerability — it is a mathematical property of how gradients encode information about training data.
How gradients encode training data
When a model processes a training batch, it computes gradients of the loss function with respect to all model parameters. These gradients indicate how each parameter should change to reduce the loss on that batch. They are specific to the batch that was processed — different batches produce different gradients. Because gradients are specific to the training batch, they contain information about that batch.
The reconstruction result
Research published from 2019 onwards ("Deep Leakage from Gradients" by Zhu et al.) demonstrated that given the gradients from a training step and the model's current parameters, an attacker can solve an optimisation problem to find the input data that would produce those gradients. For image data with small batches, this reconstruction can produce visually recognisable images.
The NVFLARE relevance
The NVFLARE security vulnerabilities in this library — CVE-2022-34668 (deserialization RCE), CVE-2026-24186 (FOBS deserialization), CVE-2026-24178 (authentication bypass) — all provide pathways to compromise the NVFLARE server. A compromised NVFLARE server receives gradients from every client before aggregating them. An attacker who exploits CVE-2026-24178 to gain admin access has credentials to monitor gradient flows in active federations.
Mitigations
Differential privacy: adding calibrated noise to gradients before sharing reduces gradient leakage at the cost of model accuracy. Secure aggregation: cryptographic protocols that allow the server to compute the aggregate gradient without seeing individual gradients eliminate the malicious server attack. Large batch sizes: sharing gradients computed over larger batches reduces the per-example information content.