## 2 Background
### Gradient Inversion Attacks  
Despite the promise of privacy in FL, recent work has shown that the heuristic of sending gradient updates instead of training samples actually provides a false sense of security. In their seminal work, [PERSON] et al. [30] proposed the Deep Leakage from Gradients method and showed that it is possible for the server to recover the entire batch of training samples when the aggregated gradients are transmitted. Their attack matched the gradients of the reconstructed data and the original gradients leaked from federated learning. Even if the clients and the server only exchange intermediate learning results, such as models or gradient updates, it has been shown that sensitive information can be derived from local training datasets in FL systems [31; 32]. Furthermore, it has been shown that an attacker who gains possession of gradient updates can launch a gradient inversion attack to recover the training patterns used by the clients to generate the gradients [30]. In gradient inversion attacks, it is generally assumed that the attacker is an honest but curious server. There are studies demonstrating gradient-based inversion attacks using vision transformers (ViTs) [18]. The authors found that vision transformers are significantly more vulnerable than previously studied CNNs due to the presence of the attention mecha  
Figure 1: A global federated learning round with model update. nism. Gradient inversion attacks in the time-series domain have also gained attention recently, as they are an important privacy concern in FL systems. These attacks aim to reconstruct sensitive data from shared gradient updates, which could compromise the privacy guarantees for federated learning [33]. [PERSON] et al. [34] proposed Temporal Gradient Attacks with Robust Optimisation--an optimisation-based reconstruction. This method leverages multiple temporal gradients to enhance reconstruction performance, even for large batch sizes and complex models. Gradient inversion attacks (GradInvs) are the reconstruction process for solving an optimisation problem that aims to make dummy gradients similar to real gradients. In a GradInv, the attacker observes the gradients that the model has shared during training and attempts to recover the original data or labels. This is usually performed by minimising the distance between the ground truth gradients and the gradients generated by the guessed inputs [25; 35; 36]. The attacker primarily tries to minimise the distance between a randomly initialised sample gradient and the true gradient shared in FL [37]. This method is known as an _iterative reconstruction_ process and basically solves a dual-optimisation objective [30; 38]:  
\[x_{i}^{*}=\operatorname*{argmin}_{\hat{x}}|\mid G_{i}^{t}-\hat{G}\mid\mid^{2} \tag{1}\]  
\[y_{i}^{*}=\operatorname*{argmin}_{\hat{y}}|\mid G_{i}^{t}-\hat{G}\mid\mid^{2} \tag{2}\]  
where \(G_{i}^{t}\) is the true gradient and \(\hat{G}\) is the dummy gradient computed from randomly instantiated data \((\hat{x},\hat{y})\). Attacks are typically considered successful if the correct values are found, i.e., meaning the attacker can recover at least one signal from the batch. By combining iteration and optimisation approaches, GradInvs, based on iterative optimisation, attempt to reconstruct the private data during the training of a neural network [35]. This process consists of the following: in the forward pass, \(x^{\prime}\) represents an input (possibly modified or the attacker's input); \(W_{1},b_{1},\ldots,W_{L}\), \(b_{L}\) denote the weights (\(W\)) and biases (\(b\)) of the layers of the neural network, from the first layer 1 to layer \(L\). \(\sigma_{1}(\cdot),\ldots\sigma_{L}(\cdot)\) are activation functions applied at each layer; \(a_{1},\ldots a_{L}\) are the activation outputs of each layer. The input \(x^{\prime}\) is passed through the network layer by layer, undergoing a transformation of weights, biases and activation functions. The final layer produces an output \(y^{\prime}\), which is the target output or label.