# From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learning Source: [From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learning]() Collection index: [llms.txt]() Data updated: 2025-12-19T05:00:04.527Z Authors: Xiangrui Xu, Zhize Li, Yufei Han, Bin Wang, Jiqiang Liu, Wei Wang Published: 2025-12-17T14:01:29.000Z ## Abstract Data Reconstruction Attacks (DRA) pose a significant threat to Federated Learning (FL) systems by enabling adversaries to infer sensitive training data from local clients. Despite extensive research, the question of how to characterize and assess the risk of DRAs in FL systems remains unresolved due to the lack of a theoretically-grounded risk quantification framework. In this work, we address this gap by introducing Invertibility Loss (InvLoss) to quantify the maximum achievable effectiveness of DRAs for a given data instance and FL model. We derive a tight and computable upper bound for InvLoss and explore its implications from three perspectives. First, we show that DRA risk is governed by the spectral properties of the Jacobian matrix of exchanged model updates or feature embeddings, providing a unified explanation for the effectiveness of defense methods. Second, we develop InvRE, an InvLoss-based DRA risk estimator that offers attack method-agnostic, comprehensive risk evaluation across data instances and model architectures. Third, we propose two adaptive noise perturbation defenses that enhance FL privacy without harming classification accuracy. Extensive experiments on real-world datasets validate our framework, demonstrating its potential for systematic DRA risk evaluation and mitigation in FL systems. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Defense against Data Reconstruction Attack on STL10 (first 100 samples)](): Defense against Data Reconstruction Attack; STL10 (first 100 samples); MSE: 0.012. - [Defense against Data Reconstruction Attack on CIFAR10 (test)](): Defense against Data Reconstruction Attack; CIFAR10 (test); MSE: 0.014. - [Image Classification on STL10 (test) with Quality Metrics (MSE, PSNR, SSIM)](): Image Classification; STL10 (test); MSE: 0.026. - [Defense against Data Reconstruction Attack on STL10 (test)](): Defense against Data Reconstruction Attack; STL10 (test); MSE: 0.024. - [Image Classification on CIFAR10 (test) (Classification & Quality Metrics)](): Image Classification; CIFAR10 (test); MSE: 0.036. - [Image Classification on STL10 (Accuracy)](): Image Classification; STL10; Accuracy: 84. ## Original sources and implementation [Original paper]() [PDF]()