## 2 Related Work
### Federated Learning  
FedAvg [2] is the first proposed federated learning algorithm, which focuses on participants' data volume. The server selects \(K\) clients and sends the original model \(W_{t}\) to each client. Clients then train the model on their respective datasets and return the updated parameters \(W_{i+1}^{i}\) and data volume \(n_{i}\) to the server. The server calculates a weighted average \(W_{t+1}\) of the parameters based on the data volume of each client to generate a new model \(W_{t+1}\leftarrow\sum\limits_{k=1}^{K}\frac{n_{k}}{n}W_{t+1}^{k}\). Finally, the server sends the new model back to the clients. The above steps are repeated until the specified number of iterations is reached. In recent years, there has been an increasing amount of research on extending federated learning from a single server to multiple servers. [PERSON] et al. [9] proposed deploying multiple edge servers to accelerate training in federated learning. [PERSON] et al. [10] designed a multi-server federated learning architecture, MS-FedAvg, based on FedAvg, where the clients update the model based on the servers in the region.  
However, recent studies have shown that gradients contain sensitive private information from the original data. [PERSON] et al. [3] proposed an attack termed Deep Leakage from Gradients (DLG). In DLG, the attacker provides a dummy dataset \(x^{\prime}\) and dummy labels \(y^{\prime}\) as input to the differentiable machine learning model \(F(x,W)\) along with training parameter weights \(W\). After training, the attacker obtains dummy gradients specific to \((x^{\prime},y^{\prime})\). Subsequently, the attacker provides a dummy dataset \(x^{\prime}\) and dummy labels \(y^{\prime}\) as the input to the differentiable machine learning model \(F(x,W)\) along with the training parameter weights \(W\). After training, the attacker obtains dummy gradients specific to \((x^{\prime},y^{\prime})\). The attacker then calculates the difference between the real gradients \(\
abla\)W and the dummy gradients \(\
abla W^{\prime}\), which gradually converge over time:  
\[x^{\prime}{}^{*},y^{\prime}{}^{*}=\operatorname*{arg\,min}_{x^{\prime},y^{ \prime}}\left\|\
abla W^{\prime}-\
abla W\right\|^{2}=\operatorname*{arg\,min} _{x^{\prime},y^{\prime}}\left\|\frac{\partial\ell(F(x^{\prime},W),y^{\prime}) }{\partial W}-\
abla W\right\|^{2}\]  
As the gap between the dummy gradients and real gradients narrows, the dummy dataset \(x^{\prime}\) also aligns more closely with the real dataset \(x\). Therefore, even if clients only upload gradients to the central server, attackers can still reverse engineer the training data via the gradients. Hence, it can be concluded that federated learning is not entirely secure. [PERSON] et al. [5] presented an algorithm that utilizes attack seed-generated gradients to approximate the real gradients and reconstruct the local training data. [PERSON] et al. [6] demonstrated that it is possible to reconstruct actual input data from gradient information, allowing every fully connected layer to be reconstructed. [PERSON] et al. proposed iDLG [4] to extract the ground truth label from the gradients that clients share with the server. It can be seen that transmitting only the gradient parameters between the server and the client does not ensure security.