{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/bayesian-framework-for-gradient-leakage-1","title":"Bayesian Framework for Gradient Leakage","arxiv_id":"2111.04706","date":"2021-11-08","proceeding":"ICLR 2022 4","authors":["Mislav Balunović","Dimitar I. Dimitrov","Robin Staab","Martin Vechev"],"abstract":"Federated learning is an established method for training machine learning models without sharing training data. However, recent work has shown that it cannot guarantee data privacy as shared gradients can still leak sensitive information. To formalize the problem of gradient leakage, we propose a theoretical framework that enables, for the first time, analysis of the Bayes optimal adversary phrased as an optimization problem. We demonstrate that existing leakage attacks can be seen as approximations of this optimal adversary with different assumptions on the probability distributions of the input data and gradients. Our experiments confirm the effectiveness of the Bayes optimal adversary when it has knowledge of the underlying distribution. Further, our experimental evaluation shows that several existing heuristic defenses are not effective against stronger attacks, especially early in the training process. Thus, our findings indicate that the construction of more effective defenses and their evaluation remains an open problem.","url_abs":"https://arxiv.org/abs/2111.04706v2","url_pdf":"https://arxiv.org/pdf/2111.04706v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"bayesian-framework-for-gradient-leakage-1","repo_url":"https://github.com/eth-sri/bayes-framework-leakage","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"jax","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"bayesian-framework-for-gradient-leakage-1","repo_url":"https://github.com/eth-sri/tableak","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2111.04706","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2111.04706"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/eth-sri/tableak","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/eth-sri/bayes-framework-leakage","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran_draft_wrong":1,"ran":1,"unverified":13},"by_repo_kind":{"official":{"samples":15,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7a8d40473bad4f08","entry":"aggregate_batch_metrics","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/train_fed.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/train_fed.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7a8d40473bad4f08"}},{"code_sha256_prefix":"b683ce54519b23b0","entry":"numpy_collate","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/datasets/common.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/datasets/common.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"b683ce54519b23b0"}},{"code_sha256_prefix":"25d27557c295f410","entry":"clip_prior","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/utils/flax_losses.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/utils/flax_losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"25d27557c295f410"}},{"code_sha256_prefix":"3f3c599d7fe199df","entry":"cos_sim","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/utils/flax_losses.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/utils/flax_losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3f3c599d7fe199df"}},{"code_sha256_prefix":"1983fcb2f9da6520","entry":"get_distribution","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/datasets/distributions.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/datasets/distributions.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"1983fcb2f9da6520"}},{"code_sha256_prefix":"fe68615417093add","entry":"get_flax_network","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/models/base_flax.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/models/base_flax.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fe68615417093add"}},{"code_sha256_prefix":"4458f214379338dd","entry":"get_network","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/models/base.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/models/base.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4458f214379338dd"}},{"code_sha256_prefix":"4e59ac519c076777","entry":"get_prior","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/datasets/distributions.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/datasets/distributions.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4e59ac519c076777"}},{"code_sha256_prefix":"edec3fc5a4c166ca","entry":"l2_dist","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/utils/flax_losses.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/utils/flax_losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"edec3fc5a4c166ca"}},{"code_sha256_prefix":"de11a821f432c229","entry":"l2_inner_gradient_matching_loss","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/utils/losses.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/utils/losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"de11a821f432c229"}},{"code_sha256_prefix":"85e8d399b0c6a236","entry":"l2_loss","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/utils/losses.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/utils/losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"85e8d399b0c6a236"}},{"code_sha256_prefix":"64c43772c9934bda","entry":"l2_outer_gradient_matching_loss","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/utils/losses.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/utils/losses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"64c43772c9934bda"}},{"code_sha256_prefix":"7c683413a2f8a345","entry":"slugify","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/tune_attacks_dp.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/tune_attacks_dp.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7c683413a2f8a345"}},{"code_sha256_prefix":"9db81cd4705c0a8e","entry":"softmax_cross_entropy","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/models/base.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/models/base.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"9db81cd4705c0a8e"}},{"code_sha256_prefix":"454c71689e31244d","entry":"split_data","repo":"eth-sri/bayes-framework-leakage","repo_kind":"official","path":"bayes_optimal_attack/datasets/common.py","file_url":"https://github.com/eth-sri/bayes-framework-leakage/blob/HEAD/bayes_optimal_attack/datasets/common.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"454c71689e31244d"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}