# On the Detectability of Active Gradient Inversion Attacks in Federated Learning Source: [On the Detectability of Active Gradient Inversion Attacks in Federated Learning]() Collection index: [llms.txt]() Data updated: 2026-05-27T05:00:21.000Z Authors: Vincenzo Carletti, Pasquale Foggia, Carlo Mazzocca, Giuseppe Parrella, Mario Vento Published: 2025-11-13T17:06:57.000Z ## Abstract One of the key advantages of Federated Learning (FL) is its ability to collaboratively train a Machine Learning (ML) model while keeping clients' data on-site. However, this can create a false sense of security. Despite not sharing private data increases the overall privacy, prior studies have shown that gradients exchanged during the FL training remain vulnerable to Gradient Inversion Attacks (GIAs). These attacks allow reconstructing the clients' local data, breaking the privacy promise of FL. GIAs can be launched by either a passive or an active server. In the latter case, a malicious server manipulates the global model to facilitate data reconstruction. While effective, earlier attacks falling under this category have been demonstrated to be detectable by clients, limiting their real-world applicability. Recently, novel active GIAs have emerged, claiming to be far stealthier than previous approaches. This work provides the first comprehensive analysis of these claims, investigating four state-of-the-art GIAs. We propose novel lightweight client-side detection techniques, based on statistically improbable weight structures and anomalous loss and gradient dynamics. Extensive evaluation across several configurations demonstrates that our methods enable clients to effectively detect active GIAs without any modifications to the FL training protocol. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Active GIA Detection on CIFAR-10 Cross-Silo (10 clients)](): Active GIA Detection; CIFAR-10 Cross-Silo, 10 clients; Average True Positive Rate: 100. - [Active GIA Detection on Tiny-ImageNet Cross-Silo 10 clients](): Active GIA Detection; Tiny-ImageNet Cross-Silo 10 clients; Average TPR: 100. - [Active GIA Detection on CIFAR-10 Cross-Device (100 clients)](): Active GIA Detection; CIFAR-10 Cross-Device, 100 clients; Average TPR: 100. - [Active GIA Detection on Tiny-ImageNet Cross-Device (100 clients)](): Active GIA Detection; Tiny-ImageNet Cross-Device, 100 clients; Average TPR: 1. - [Active GIA Detection on FMNIST Cross-Silo, 10 clients](): Active GIA Detection; FMNIST Cross-Silo, 10 clients; Average TPR: 100. - [Active GIA Detection on CIFAR-100 Cross-Silo (10 clients)](): Active GIA Detection; CIFAR-100 Cross-Silo 10 clients; Average TPR: 100. - [Active GIA Detection on FMNIST Cross-Device, 100 clients](): Active GIA Detection; FMNIST Cross-Device, 100 clients; Average TPR: 100. - [Active GIA Detection on CIFAR-100 Cross-Device 100 clients](): Active GIA Detection; CIFAR-100 Cross-Device 100 clients; Average TPR: 1. - [Active GIA Detection on MNIST Cross-Silo, 10 clients](): Active GIA Detection; MNIST Cross-Silo, 10 clients; Average TPR: 100. - [Active GIA Detection on MNIST Cross-Device (100 clients)](): Active GIA Detection; MNIST Cross-Device 100 clients; Average TPR: 1. ## Original sources and implementation [Original paper]() [PDF]()