{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/see-through-gradients-image-batch-recovery","title":"See through Gradients: Image Batch Recovery via GradInversion","arxiv_id":"2104.07586","date":"2021-04-15","proceeding":"CVPR 2021 1","authors":["Hongxu Yin","Arun Mallya","Arash Vahdat","Jose M. Alvarez","Jan Kautz","Pavlo Molchanov"],"abstract":"Training deep neural networks requires gradient estimation from data batches to update parameters. Gradients per parameter are averaged over a set of data and this has been presumed to be safe for privacy-preserving training in joint, collaborative, and federated learning applications. Prior work only showed the possibility of recovering input data given gradients under very restrictive conditions - a single input point, or a network with no non-linearities, or a small 32x32 px input batch. Therefore, averaging gradients over larger batches was thought to be safe. In this work, we introduce GradInversion, using which input images from a larger batch (8 - 48 images) can also be recovered for large networks such as ResNets (50 layers), on complex datasets such as ImageNet (1000 classes, 224x224 px). We formulate an optimization task that converts random noise into natural images, matching gradients while regularizing image fidelity. We also propose an algorithm for target class label recovery given gradients. We further propose a group consistency regularization framework, where multiple agents starting from different random seeds work together to find an enhanced reconstruction of original data batch. We show that gradients encode a surprisingly large amount of information, such that all the individual images can be recovered with high fidelity via GradInversion, even for complex datasets, deep networks, and large batch sizes.","url_abs":"https://arxiv.org/abs/2104.07586v1","url_pdf":"https://arxiv.org/pdf/2104.07586v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"see-through-gradients-image-batch-recovery","repo_url":"https://github.com/Koukyosyumei/AIJack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"},{"task_slug":"inference-attack","task_name":"Inference Attack"},{"task_slug":"privacy-preserving","task_name":"Privacy Preserving"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2104.07586","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2104.07586"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Koukyosyumei/AIJack","reach":null}],"summary":{"ran":1,"ran_honours":4,"ran_draft_wrong":5,"ran_fixture":2,"unverified":1},"by_repo_kind":{"listed":{"samples":13,"ran":12,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"43eac078002859a1","entry":"GradientInversion_Attack","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"43eac078002859a1"}},{"code_sha256_prefix":"3e673521a479b4c5","entry":"_estimate_label","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3e673521a479b4c5"}},{"code_sha256_prefix":"62842ce458b4bca3","entry":"_generate_fake_gradients","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"62842ce458b4bca3"}},{"code_sha256_prefix":"5fddb208f8e79e5b","entry":"_initialize_label","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5fddb208f8e79e5b"}},{"code_sha256_prefix":"85031c58ca1b7e1d","entry":"_initialize_x","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"85031c58ca1b7e1d"}},{"code_sha256_prefix":"fa414f2616dd1ff3","entry":"_setup_attack","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fa414f2616dd1ff3"}},{"code_sha256_prefix":"58dd085b9a1909a7","entry":"bn_regularizer","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"58dd085b9a1909a7"}},{"code_sha256_prefix":"ff0da84104d8589d","entry":"cossim","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ff0da84104d8589d"}},{"code_sha256_prefix":"8557fa1f6c82b641","entry":"group_consistency","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8557fa1f6c82b641"}},{"code_sha256_prefix":"e66bd74de6c3b8c6","entry":"l2","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"e66bd74de6c3b8c6"}},{"code_sha256_prefix":"6db1e32b9e1e74be","entry":"label_matching","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6db1e32b9e1e74be"}},{"code_sha256_prefix":"170794b3b26fc341","entry":"total_variance","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"170794b3b26fc341"}},{"code_sha256_prefix":"1e266e3624ce2cae","entry":"BaseAttacker","repo":"Koukyosyumei/AIJack","repo_kind":"listed","path":"src/aijack/attack/inversion/gradientinversion.py","file_url":"https://github.com/Koukyosyumei/AIJack/blob/HEAD/src/aijack/attack/inversion/gradientinversion.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"1e266e3624ce2cae"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}