Gradient Inversion Attack on CIFAR-10
92.27PSNRARES
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| ARESGlobal batch size=32, Architecture=CNN2026.03 | 92.27 | — | — | |
| ARESBatch size=322026.03 | 92.27 | — | — | |
| ARESGlobal batch size=64, Architecture=CNN2026.03 | 90.47 | — | — | |
| ARESBatch size=642026.03 | 90.47 | — | — | |
| ARESGlobal batch size=128, Architecture=CNN2026.03 | 85.01 | — | — | |
| ARESGlobal batch size=256, Architecture=CNN2026.03 | 37.08 | — | — | |
| ARESBatch size=2562026.03 | 37.08 | — | — | |
| Scale-MIAGlobal batch size=64, Architecture=CNN2026.03 | 28.53 | — | — | |
| Scale-MIAGlobal batch size=32, Architecture=CNN2026.03 | 28.52 | — | — | |
| Scale-MIAGlobal batch size=128, Architecture=CNN2026.03 | 28.26 | — | — | |
| Scale-MIAGlobal batch size=256, Architecture=CNN2026.03 | 27.06 | — | — | |
| FedLeakBatch size=322026.03 | 21.33 | — | — | |
| No DPAttack Method=GIFD2026.02 | 20.4 | 0.57 | — | |
| RtFBatch size=322026.03 | 17.35 | — | — | |
| FedLeakBatch size=642026.03 | 17.2 | — | — | |
| RtFBatch size=642026.03 | 17.2 | — | — | |
| RtFBatch size=2562026.03 | 15.08 | — | — | |
| No DPAttack Method=IG2026.02 | 14.58 | 0.37 | — | |
| TWBatch size=322026.03 | 13.55 | — | — | |
| TWBatch size=2562026.03 | 13.51 | — | — | |
| TWBatch size=642026.03 | 13.03 | — | — | |
| FishingBatch size=642026.03 | 12.36 | — | — | |
| FishingBatch size=2562026.03 | 12.36 | — | — | |
| ND-CGNetwork Topology=Ring, Number of nodes (N)=102026.06 | 12.13 | 0.0892 | 0.9 | |
| FishingBatch size=322026.03 | 12.08 | — | — | |
| IGBatch size=322026.03 | 11.28 | — | — | |
| ND-MMNetwork Topology=Ring, Number of nodes (N)=302026.06 | 11.25 | 0.0787 | 1.85 | |
| TIPAttack Method=GIFD2026.02 | 11.15 | 0.04 | — | |
| ND-CGNetwork Topology=Fully connected, Number of nodes (N)=102026.06 | 11.1 | 0.0915 | 1.2 | |
| ND-CGNetwork Topology=Ring, Number of nodes (N)=302026.06 | 11.06 | 0.1041 | 0.96 | |
| GIBatch size=322026.03 | 10.59 | — | — | |
| DPAttack Method=GIFD2026.02 | 10.33 | 0.05 | — | |
| AGPAttack Method=GIFD2026.02 | 10.3 | 0.04 | — | |
| ND-MMNetwork Topology=Fully connected, Number of nodes (N)=102026.06 | 10.27 | 0.1 | 1.85 | |
| ND-MMNetwork Topology=Ring, Number of nodes (N)=202026.06 | 10.21 | 0.1415 | 1.35 | |
| ND-CGNetwork Topology=Ring, Number of nodes (N)=202026.06 | 10.2 | 0.1189 | 1.16 | |
| ND-CGNetwork Topology=Bipartite, Number of nodes (N)=202026.06 | 10.19 | 0.1006 | 1.23 | |
| ND-MMNetwork Topology=Fully connected, Number of nodes (N)=302026.06 | 10.1 | 0.1027 | 1.95 | |
| ND-CGNetwork Topology=Bipartite, Number of nodes (N)=302026.06 | 10.05 | 0.1156 | 0.97 | |
| ND-MMNetwork Topology=Bipartite, Number of nodes (N)=302026.06 | 10.03 | 0.0781 | 1.84 | |
| GIBatch size=642026.03 | 10.01 | — | — | |
| ND-CGNetwork Topology=Bipartite, Number of nodes (N)=102026.06 | 10 | 0.121 | 0.91 | |
| ND-CGNetwork Topology=Fully connected, Number of nodes (N)=202026.06 | 9.98 | 0.0664 | 1.15 | |
| TIPAttack Method=IG2026.02 | 9.85 | 0.01 | — | |
| ND-CGNetwork Topology=Fully connected, Number of nodes (N)=302026.06 | 9.72 | 0.1165 | 1.16 | |
| ND-MMNetwork Topology=Ring, Number of nodes (N)=102026.06 | 9.6 | 0.0847 | 1.7 | |
| AGPAttack Method=IG2026.02 | 9.54 | 0.03 | — | |
| iDLGBatch size=322026.03 | 9.51 | — | — | |
| ND-MMNetwork Topology=Bipartite, Number of nodes (N)=202026.06 | 9.5 | 0.0718 | 1.61 | |
| ND-MMNetwork Topology=Fully connected, Number of nodes (N)=202026.06 | 9.42 | 0.0933 | 1.95 | |
| ND-MMNetwork Topology=Bipartite, Number of nodes (N)=102026.06 | 9.37 | 0.0907 | 1.9 | |
| DPAttack Method=IG2026.02 | 9.18 | 0.02 | — | |
| DPDL-CGNetwork Topology=Ring, Number of nodes (N)=302026.06 | 9.06 | 0.0214 | 2.35 | |
| DPDL-MMNetwork Topology=Ring, Number of nodes (N)=302026.06 | 9.03 | 0.0212 | 2.02 | |
| DPDL-CGNetwork Topology=Fully connected, Number of nodes (N)=202026.06 | 8.78 | 0.0204 | 2.18 | |
| DPDL-CGNetwork Topology=Bipartite, Number of nodes (N)=302026.06 | 8.77 | 0.0247 | 2.24 | |
| DPDL-CGNetwork Topology=Fully connected, Number of nodes (N)=102026.06 | 8.72 | 0.0221 | 2.4 | |
| DPDL-MMNetwork Topology=Fully connected, Number of nodes (N)=202026.06 | 8.69 | 0.0217 | 2.2 | |
| DPDL-MMNetwork Topology=Bipartite, Number of nodes (N)=302026.06 | 8.68 | 0.0214 | 2.21 | |
| DPDL-CGNetwork Topology=Ring, Number of nodes (N)=202026.06 | 8.58 | 0.0205 | 2.24 | |
| DPDL-CGNetwork Topology=Bipartite, Number of nodes (N)=202026.06 | 8.58 | 0.0198 | 2.34 | |
| DPDL-MMNetwork Topology=Ring, Number of nodes (N)=202026.06 | 8.58 | 0.0233 | 2.28 | |
| iDLGBatch size=642026.03 | 8.52 | — | — | |
| DPDL-MMNetwork Topology=Bipartite, Number of nodes (N)=202026.06 | 8.52 | 0.0188 | 2.26 | |
| DPDL-CGNetwork Topology=Fully connected, Number of nodes (N)=302026.06 | 8.28 | 0.0344 | 2.22 | |
| DPDL-MMNetwork Topology=Fully connected, Number of nodes (N)=102026.06 | 8.17 | 0.0187 | 2.49 | |
| DPDL-CGNetwork Topology=Ring, Number of nodes (N)=102026.06 | 8.12 | 0.0249 | 2.47 | |
| DPDL-CGNetwork Topology=Bipartite, Number of nodes (N)=102026.06 | 8.12 | 0.0208 | 2.4 | |
| DPDL-MMNetwork Topology=Ring, Number of nodes (N)=102026.06 | 8.12 | 0.0268 | 2.47 | |
| DPDL-MMNetwork Topology=Fully connected, Number of nodes (N)=302026.06 | 8.03 | 0.0241 | 2.64 | |
| DPDL-MMNetwork Topology=Bipartite, Number of nodes (N)=102026.06 | 8.02 | 0.0185 | 2.6 | |
| Differential Privacy (DP1)Attack Strength=50%, Privacy Budget (epsilon)=0.52025.12 | — | — | 0.652 | |
| Differential Privacy (DP2)Attack Strength=50%, Privacy Budget (epsilon)=0.72025.12 | — | — | 0.554 | |
| DPepsilon=0.5, Attack Strength=25%2025.12 | — | — | 0.61 | |
| DPepsilon=0.7, Attack Strength=25%2025.12 | — | — | 0.516 | |
| No DefenseAttack Strength=50%2025.12 | — | — | 0.24 | |
| No DefenseAttack Strength=25%2025.12 | — | — | 0.135 | |
| OPEAttack Strength=50%2025.12 | — | — | 0.391 | |
| OPEAttack Strength=25%2025.12 | — | — | 0.412 | |
| PRIVEE-DPAttack Strength=50%, Privacy Budget (epsilon)=0.12025.12 | — | — | 22.594 | |
| PRIVEE-DPepsilon=0.1, Attack Strength=25%2025.12 | — | — | 40.212 | |
| PRIVEE-DP++Attack Strength=50%2025.12 | — | — | 18.29 | |
| PRIVEE-DP++Attack Strength=25%2025.12 | — | — | 17.824 | |
| R(1)Attack Strength=50%2025.12 | — | — | 0.126 | |
| R(1)Attack Strength=25%2025.12 | — | — | 0.118 | |
| R(2)Attack Strength=50%2025.12 | — | — | 0.124 | |
| R(2)Attack Strength=25%2025.12 | — | — | 0.096 |