{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/deep-leakage-from-gradients","title":"Deep Leakage from Gradients","arxiv_id":"1906.08935","date":"2019-06-21","proceeding":"NeurIPS 2019 12","authors":["Ligeng Zhu","Zhijian Liu","Song Han"],"abstract":"Exchanging gradients is a widely used method in modern multi-node machine learning system (e.g., distributed training, collaborative learning). For a long time, people believed that gradients are safe to share: i.e., the training data will not be leaked by gradient exchange. However, we show that it is possible to obtain the private training data from the publicly shared gradients. We name this leakage as Deep Leakage from Gradient and empirically validate the effectiveness on both computer vision and natural language processing tasks. Experimental results show that our attack is much stronger than previous approaches: the recovery is pixel-wise accurate for images and token-wise matching for texts. We want to raise people's awareness to rethink the gradient's safety. Finally, we discuss several possible strategies to prevent such deep leakage. The most effective defense method is gradient pruning.","url_abs":"https://arxiv.org/abs/1906.08935v2","url_pdf":"https://arxiv.org/pdf/1906.08935v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/FaisalAhmed0/Deep-Leakage-from-Gradients","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/MiscCoding/AddGausianNoise","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/Mishuni/ViT_Inversion","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"gone","observed_at":"2026-09-17","how":"tree_404+repo_404"}},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/kei773/CSED199_Freshman_Research_Participation","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/mit-han-lab/deep-leakage-from-gradients","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/mit-han-lab/dlg","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/ytingma/ppidsg","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"deep-leakage-from-gradients","repo_url":"https://github.com/JonasGeiping/breaching","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1906.08935","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1906.08935"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/mit-han-lab/deep-leakage-from-gradients","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MiscCoding/AddGausianNoise","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Mishuni/ViT_Inversion","reach":{"status":"gone","observed_at":"2026-09-17","how":"tree_404+repo_404"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ytingma/ppidsg","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/FaisalAhmed0/Deep-Leakage-from-Gradients","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/mit-han-lab/dlg","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/JonasGeiping/breaching","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/kei773/CSED199_Freshman_Research_Participation","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":2,"ran_honours":1,"unverified":1},"by_repo_kind":{"listed":{"samples":4,"ran":3,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":2,"samples":[{"code_sha256_prefix":"e4df01238c9e5ba5","entry":"cross_entropy_for_onehot","repo":"mit-han-lab/dlg","repo_kind":"listed","path":"utils.py","file_url":"https://github.com/mit-han-lab/dlg/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e4df01238c9e5ba5"}},{"code_sha256_prefix":"dad4aff9c124d59f","entry":"cross_entropy_onehot","repo":"FaisalAhmed0/Deep-Leakage-from-Gradients","repo_kind":"listed","path":"src/utils.py","file_url":"https://github.com/FaisalAhmed0/Deep-Leakage-from-Gradients/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dad4aff9c124d59f"}},{"code_sha256_prefix":"076a7c8d2aedc9a6","entry":"onehot","repo":"FaisalAhmed0/Deep-Leakage-from-Gradients","repo_kind":"listed","path":"src/utils.py","file_url":"https://github.com/FaisalAhmed0/Deep-Leakage-from-Gradients/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"076a7c8d2aedc9a6"}},{"code_sha256_prefix":"4535c79f8dfff634","entry":"label_to_onehot","repo":"mit-han-lab/dlg","repo_kind":"listed","path":"utils.py","file_url":"https://github.com/mit-han-lab/dlg/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4535c79f8dfff634"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}