{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2603-17623","title":"ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery","arxiv_id":"2603.17623","date":"2026-03-18","proceeding":null,"authors":["Zirui Gong","Leo Yu Zhang","Yanjun Zhang","Viet Vo","Tianqing Zhu","Shirui Pan","Cong Wang"],"abstract":"Federated Learning (FL) enables collaborative model training by sharing model updates instead of raw data, aiming to protect user privacy. However, recent studies reveal that these shared updates can inadvertently leak sensitive training data through gradient inversion attacks (GIAs). Among them, active GIAs are particularly powerful, enabling high-fidelity reconstruction of individual samples even under large batch sizes. Nevertheless, existing approaches often require architectural modifications, which limit their practical applicability. In this work, we bridge this gap by introducing the Activation REcovery via Sparse inversion (ARES) attack, an active GIA designed to reconstruct training samples from large training batches without requiring architectural modifications. Specifically, we formulate the recovery problem as a noisy sparse recovery task and solve it using the generalized Least Absolute Shrinkage and Selection Operator (Lasso). To extend the attack to multi-sample recovery, ARES incorporates the imprint method to disentangle activations, enabling scalable per-sample reconstruction. We further establish the expected recovery rate and derive an upper bound on the reconstruction error, providing theoretical guarantees for the ARES attack. Extensive experiments on CNNs and MLPs demonstrate that ARES achieves high-fidelity reconstruction across diverse datasets, significantly outperforming prior GIAs under large batch sizes and realistic FL settings. Our results highlight that intermediate activations pose a serious and underestimated privacy risk in FL, underscoring the urgent need for stronger defenses.","url_abs":"https://arxiv.org/abs/2603.17623","url_pdf":"https://arxiv.org/pdf/2603.17623","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2603.17623","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2603.17623"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/lhfowl/robbing","reach":{"status":"gone","observed_at":"2026-09-16","how":"tree_404+repo_404"}},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/unknown123489/Scale-MIA","reach":{"status":"ok","spdx":"NOASSERTION"}},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/gaow0007/ATSPrivacy","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/gongzir1/ARES","reach":null}],"summary":{"ran":2,"ran_draft_wrong":1,"unverified":14},"by_repo_kind":{"found_in_text":{"samples":17,"ran":3,"repositories":3}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"25c34c54d9ce5f56","entry":"GradualWarmupScheduler","repo":"gongzir1/ARES","repo_kind":"found_in_text","path":"attacks/analytic_attack.py","file_url":"https://github.com/gongzir1/ARES/blob/HEAD/attacks/analytic_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"25c34c54d9ce5f56"}},{"code_sha256_prefix":"d5378222c82c7a79","entry":"PSNR_cal","repo":"unknown123489/Scale-MIA","repo_kind":"found_in_text","path":"fedavg-cifar/multimodel-recover-attack.py","file_url":"https://github.com/unknown123489/Scale-MIA/blob/HEAD/fedavg-cifar/multimodel-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"d5378222c82c7a79"}},{"code_sha256_prefix":"8c70be05071f1bc6","entry":"optimizer_lookup","repo":"gongzir1/ARES","repo_kind":"found_in_text","path":"attacks/analytic_attack.py","file_url":"https://github.com/gongzir1/ARES/blob/HEAD/attacks/analytic_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8c70be05071f1bc6"}},{"code_sha256_prefix":"049502ce90fbd732","entry":"AnalyticAttacker","repo":"gongzir1/ARES","repo_kind":"found_in_text","path":"attacks/analytic_attack.py","file_url":"https://github.com/gongzir1/ARES/blob/HEAD/attacks/analytic_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"049502ce90fbd732"}},{"code_sha256_prefix":"e1517f98c825492d","entry":"ImprintAttacker","repo":"gongzir1/ARES","repo_kind":"found_in_text","path":"attacks/analytic_attack.py","file_url":"https://github.com/gongzir1/ARES/blob/HEAD/attacks/analytic_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e1517f98c825492d"}},{"code_sha256_prefix":"21ec4dad73960b79","entry":"_BaseAttacker","repo":"gongzir1/ARES","repo_kind":"found_in_text","path":"attacks/analytic_attack.py","file_url":"https://github.com/gongzir1/ARES/blob/HEAD/attacks/analytic_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"21ec4dad73960b79"}},{"code_sha256_prefix":"e551d62ffffcfda9","entry":"activation_errors","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"inversefed/metrics.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/inversefed/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e551d62ffffcfda9"}},{"code_sha256_prefix":"f5c2f5be766751a1","entry":"attack","repo":"unknown123489/Scale-MIA","repo_kind":"found_in_text","path":"fedavg-cifar/multimodel-recover-attack.py","file_url":"https://github.com/unknown123489/Scale-MIA/blob/HEAD/fedavg-cifar/multimodel-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"f5c2f5be766751a1"}},{"code_sha256_prefix":"50b843f4577cb9e7","entry":"collate_fn","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"benchmark/cifar100_attack.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/benchmark/cifar100_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"50b843f4577cb9e7"}},{"code_sha256_prefix":"d990a0f24d4e3d84","entry":"eval_score","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"benchmark/search_transform_attack.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/benchmark/search_transform_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d990a0f24d4e3d84"}},{"code_sha256_prefix":"a111b516b74dd7b0","entry":"img_warp","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"autoaugment.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/autoaugment.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a111b516b74dd7b0"}},{"code_sha256_prefix":"f52f54936f6ed88e","entry":"img_zoom","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"autoaugment.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/autoaugment.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f52f54936f6ed88e"}},{"code_sha256_prefix":"e42861ff4d8806ea","entry":"input_retrival","repo":"unknown123489/Scale-MIA","repo_kind":"found_in_text","path":"fedavg-cifar/multimodel-recover-attack.py","file_url":"https://github.com/unknown123489/Scale-MIA/blob/HEAD/fedavg-cifar/multimodel-recover-attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"e42861ff4d8806ea"}},{"code_sha256_prefix":"5ef2f520281c0bdf","entry":"psnr","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"inversefed/metrics.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/inversefed/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5ef2f520281c0bdf"}},{"code_sha256_prefix":"b0291b9e998a5906","entry":"reconstruction_costs","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"inversefed/reconstruction_algorithms.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/inversefed/reconstruction_algorithms.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b0291b9e998a5906"}},{"code_sha256_prefix":"cd8cc2a4392baf95","entry":"similarity_measures","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"benchmark/search_transform_attack.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/benchmark/search_transform_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cd8cc2a4392baf95"}},{"code_sha256_prefix":"3d23162c75564e01","entry":"total_variation","repo":"gaow0007/ATSPrivacy","repo_kind":"found_in_text","path":"inversefed/metrics.py","file_url":"https://github.com/gaow0007/ATSPrivacy/blob/HEAD/inversefed/metrics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3d23162c75564e01"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}