Deep Leakage from Model in Federated Learning

Authors: zihao  zhao
mengen  luo
wenbo  ding
Venue: CPAL_cc_2024_Conference
Published: 2023-08-26 13:53:06

Abstract: Federated Learning (FL) was conceived as a secure form of distributed learning by keeping private training data local and only communicating public model gradients between clients. However, a slew of gradient leakage attacks proposed to date undermine this claim by proving its insecurity. A common limitation of these attacks is the necessity for extensive auxiliary information, such as model weights, optimizers, and certain hyperparameters (e.g., learning rate), which are challenging to acquire in practical scenarios. Furthermore, several existing algorithms, including FedAvg, circumvent the transmission of model gradients in FL by instead sending model weights, but the potential security breaches of this approach are seldom considered. In this paper, we propose two innovative frameworks, DLM and DLM+, that reveal the potential leakage of private local data of clients when transmitting model weights under the FL framework. We also conduct a series of experiments to elucidate the impact and universality of our attack frameworks. Additionally, we propose and evaluate two defenses against the proposed attacks, assessing their protective efficacy.

Main paper: 
 introduction: 
 The explosive growth and increasing complexity of the data have raised huge difficulties as well as challenges to the traditional centralized machine learning schemes due to their heavy dependency on the local high-quality computing and storage resources. In this context, the distributed learning [1] has emerged as an effective solution to utilize the ubiquitous but low-quality resources to tackle the large-scale data problem, especially in the era of the Internet of things and edge computing. One realistic application of distributed learning is federated learning (FL) [2] , which intends to keep clients' training data locally rather than transmitting them to others to protect the privacy of each client. Specifically, during the training process, all clients train their models locally using their own private data, calculate the model update information (such as model weights and model gradients) and then upload them to the parameter server, which will aggregate this information to update the global model. Thanks to its privacy protection capability, FL has been successfully applied in the financial and medical fields [3] .However, even without uploading plain training data to the parameter server in FL, some security problems still exist in such procedures such as the data leakage problem. Recently, [4] presented a security breach for the gradient transmitting frameworks called deep leakage from gradients (DLG) to recover each client's immovable training data, which gives us a new insight into attacking the clients' private data from gradients in FL. For instance, [5] utilized the sign of CrossEntropy loss to estimate the ground-truth label and increase the accuracy of DLG. However, it could only be effective with clients who use CrossEntropy loss rather than other loss functions. [6] made use of cosine similarity to measure the distance between the dummy gradient and ground-truth gradient rather than the mean square error (MSE). [7] attempted to recover the batch input before the fully connected layer by solving the linear equation. However, strong assumptions are made to solve the equations, and data recovery cannot be guaranteed under more general conditions. [8] proposed an image batch restoration approach called GradInversion by matching gradients while regularizing image fidelity.Unfortunately, these restoration approaches require not only model gradients transmitted in FL, but also some auxiliary information, such as model parameters, the optimizer, and some hyperparameters (e.g. learning rate), which are difficult to obtain in the practice. Moreover, by realizing the hazards of uploading gradients of models, a number of recent FL frameworks turn to transmitting model parameters to perform server aggregation and model updating such as FedAvg [9] , which have not proven to be attackable directly. Nevertheless, we recently found that the transmission of model weights is also insecure and assaultable. In this paper, we intend to steal the private training data of clients by the communicated model parameters in FL, which brings a huge challenge to the foundation of FL. In particular, we mainly address two challenges: a) how to design an innovative loss function to enable the adversary to recover the ground-truth data using model parameters since the loss function of all the gradient leakage attacks cannot be utilized directly on the model parameter leakage situation, and b) how to apply this loss function to FL scenarios. Our attempt to tackle these two challenges leads to two novel attack frameworks, which we call the Deep Leakage from Model (DLM) and DLM+ for recovering the private training data of clients. The main contributions of our work are summarized as threefold:1. We identify the possibility of recovering private training data from each client in FL by utilizing only the transmitted model parameters and loss function without any prior knowledge of the training data, which poses an unprecedented challenge to the foundation of FL.2. We present two novel frameworks DLM and DLM+ based on two innovative loss functions and apply them to the FedAvg, which is the most famous and widely-used algorithm in FL. In the experiment part, the result illustrates that the FL architectures that exchange model weights between the server and clients could not manage to protect the private data of clients.3. A variety of experiments are conducted to compare different deep gradient leakage approaches and the results demonstrate that our proposed model leakage attacks obtain more accurate results compared with existing gradient leakage attacks, and we also give an intuitive explanation towards it. Moreover, two defenses are introduced to protect the FL system from the model leakage attack. 
preliminaries: 
 In this section, we will introduce some preliminaries about FL and the specific process of a widely used algorithm in FL called FedAvg. Additionally, the threat model of this literature is presented, which illustrates what the adversary could obtain and how our attack takes effect.FL, first proposed by Google in 2017 [9] , can be regarded as a distributed machine learning framework that is able to provide private local data protection. During the entire FL training process, the private data of each clientare not only kept unknown by the server but also invisible to other clients participating in the training. After completing the training process, all clients build a global shared model to realize implicit data sharing and win-win cooperation.Specifically, for an FL paradigm that transmits model weights such as FedAvg [9] , assume that the system contains LG-FedAvg (arXiv, 2020), FedProx (PMLS, 2020), HeteroFL(ICLR, 2020)K local clients {C 1 , C 2 , • • • , C K } and each client has the dataset D k = x (i) , y (i) n k i=1 ,Figure 1 : The frameworks of the proposed DLM and DLM+.In this work, the goal of our attack is to recover the private local data of each client in an FL system only by utilizing communicated model parameters. According to previous work on data leakage from gradients, e.g., [4] , suppose that the adversary is aware of the client model parameters, optimizers, and some hyperparameters such as the learning rate, which are not usually broadcast in most distributed learning frameworks and are arduous to obtain for adversaries. In our threat model, in contrast, the only two factors that the adversary needs to gain are the weights of the transmitted model and the loss function of each client. To this end, to recover the private data, the adversary first utilizes the procured model weights to construct a neural network similar to the clients. Thereafter, a pair of randomly initialized dummy data and labels are placed in the constructed neural network.With the loss function of each client, the corresponding dummy model gradients can be calculated. Most importantly, the adversary employs the dummy model gradients to compute the innovative loss function presented in Sections 3 & 4, which does not contain any prior knowledge of training data. When the algorithm converges successfully, the dummy data and dummy label will become rather close to the ground-truth data and label by approximating the true model update. 
deep leakage from model (dlm): 
 In this section, the definition of a distributed learning system derived from real-world application scenarios is first proposed. According to this system, we formulate our novel model attack framework and provide a vanilla attack to FedAvg to recover the private data.As shown in the left part of Figure 1 , at iteration t+1, each local client employs the common stochastic gradient descent (SGD) method [10] to update the model weight by:EQUATIONwhere W t and W t+1 are the model weights of a local client at iteration t and t + 1 respectively, α is the learning rate and ∇W t is the model gradients.The above Equation ( 1) is a general formula of SGD, but we need a more detailed formula in the following derivation. Assume (x * , y * ) is the ground-truth data and label, L(•) is the local loss function and the ∇ W t L(x * , y * ) is the loss w.r.t. model weights W t , the Equation (1) could also be written as:EQUATIONwhere the shared neural network function is indicated as a differential model F(•).In addition to SGD, batch gradient descent (BGD) [11] and mini-batch gradient descent (MBGD) [12] are also frequently used in distributed learning as optimizers with multiple local iterations. However, in the main part of this paper, we just analyze the SGD situation, and the MBGD with multiple local iterations will be discussed in the Supp. material part.In the FL attack process, at the beginning of the iteration t, the adversary can intercept the global model W t g transmitted from the parameter server to clients. After an arbitrary client in the FL system finishes its local training process, the adversary can gain the model weight W t+1 k of the client k uploading to the server. After obtaining all this information, the attacker can steal the local data from the transmitted model weights as shown in the right part of Figure 1 . Specifically, on the attacker side, it is assumed that the adversary knows model weights at each iteration and is unknown to other information, such as the client's learning rate α and model gradients ∇W .Similar to the DLG, the attacker in our approach first randomly initialize a dummy data input x and dummy label ŷ. Since the attacker knows the global model weights W t g in FL, one is able to put x and ŷ into the model W t g and calculate a dummy gradient ∇ W t g L(x, ŷ) using the same loss function L(•) as each client. Subsequently, the adversary is able to restore the client k's private data by minimizing the distance between the plain gradient and dummy gradient by the following naive objective function:EQUATIONwhere γ is a tuning factor to compensate for the effect of the learning rate α of each client and makes the term γ * W t k -W t+1 k approximate the ground-truth gradient. Thereafter, the adversary utilizes the gradient of this objective function with respect to its dummy data input ∇ xi L DLM (x, ŷ, γ) to update x. Similarly, the dummy label ŷ and the tuning factor γ are updated by ∇ ŷi L DLM (x, ŷ, γ) and ∇ γi L DLM (x, ŷ, γ), respectively.Nevertheless, this approach has some drawbacks. At first, this algorithm has to update three mutually-dependent variables step by step, in which these three decision variables can potentially affect each other and result in high requirements for initialization. Second, it introduces too much randomness in the training process and increases the difficulty of model convergence, which needs to be optimized further. 
deep leakage from model+ (dlm+): 
 In this section, we propose a stronger attack framework called Deep Model Leakage+ to restore the training data of each client more stably and precisely. First, the expurgation of the learning rate α from Equation ( 2) is performed, which decreases the randomness of the algorithm and obtains a better convergence. Then, we present a new objective function without the appearance of α and show how it works in FedAvg.According to Equation (1), we take the F robenius norm [13] on both sides of it:EQUATIONHence, we get the expression of α as follows:EQUATIONwhere the denominator ∥∇ W t L(x * , y * )∥ F is unknown to the adversary. Afterwards, plugging Equation ( 5) back into the model update expression, Equation (1), and will give the following expression only related to model weights at two iterations W t , W t+1 and the gradient of the loss w.r.tEQUATIONNote that the adversary can directly compute ∥∇ W t L(x * , y * )∥ F once the model parameter W t is obtained. Compared with Equation ( 2), the new equation Equation ( 6) without α reduces the randomness of the algorithm and hence gains better performance.On the attacker side, for each client k in FL, we introduce our innovative objective function L DLM + (x, ŷ), which does not have an item related to the learning rate α:EQUATIONAfterward, the adversary uses the following equation to update the dummy data x and the dummy label ŷ:EQUATION)The full algorithm is shown as Algorithm 2. In this algorithm, the private data of each client are always kept locally, which completely obeys the rules of FL. However, there is still a probability of restoring the private data by using the transmitted model weights, which raises a huge challenge to the security of FL. 
experiments: 
 Setup. The proposed frameworks are evaluated with the MNIST, CIFAR10, and CIFAR100 datasets to cover different sizes of images. In our FL system, 10 clients are employed with 10% IID partition of the total dataset. To ensure the generalization of our frameworks, 2 widely adopted models (MLP and LeNet) are selected as the attack model. On the adversary part, LBFGS [14] is employed for optimization to LeNet with learning rate η = 1, history size = 100, number of iterations = 200 and CrossEntropy loss function. For the three-layer MLP network, Adam [15] with learning rate η = 0.1 works as the optimizer, and the number of iterations = 4000 and the CrossEntropy loss function are selected while training the model.Evaluation Metrics. To measure the similarity between the restoration results and the ground-truth image, we choose three popular visual comparisons of images to evaluate the pixel-wise discrepancies: i) the peak signal-to-noise ratio (PSNR) [16] to calculate the error between pixels, ii) the learned perceptual image patch similarity (LPIPS) [17] to measure image similarity with deep features, and iii) the structural similarity (SSIM) [18] to measure the correlation, luminance distortion and contrast distortion of images.First, this experiment compares the three proposed frameworks with two gradient leakage approaches as follows.(a) DLG [4] : This deep leakage approach utilizes the ℓ 2 distance between ground-truth gradients and dummy gradients as the objective function to update the dummy data and dummy labels.(b) Cosine similarity [6] : This approach designs an objective function based on angles between ground-truth gradients and dummy gradients, i.e., cosine similarity, to restore the ground truth image and label.In particular, fifty different images from three datasets are chosen to acquire the average test accuracy, PSNR, LPIPS, and SSIM values. For fair comparisons, the iterations and models for all methods are the same. In our experiment, if the PSNR of one test is more than 30 dB, this test will be considered a successful recovery. Based on this condition, the restoration results are shown in Why DLM is better than DLG? To illustrate the reason, we slightly modify the objective function of the original DLG by adding a tuning factor k, which is similar to the form of DLM:EQUATIONwhere k = 1 will induce the original DLG. Since the original DLG utilizes the ground-truth gradient, it can converge faster but has less range to search for the optimal solution. Adding the tuning factor can appropriately enlarge the searching margin and increase the probability to recover the original data. The simulation results with 100 repeated experiments are summarized in Table 2 . The above results validate the effectiveness of introducing the tuning factor k to DLG, in terms of both accuracy and restoration quality. What's more, we could rewrite the objective function of DLM exactly similar to Equation ( 9):EQUATIONTherefore, such improvements give us an intuitive explanation for why the DLM performs better than the original DLG. More results can be found in Appendix A.3. Additionally, we also conduct some evaluations on batch data in Appendix B.In the DLM framework, the adversary has to randomly choose an initial value of the tuning factor γ. However, the choice of the initial value can greatly affect the convergence and precision of the algorithm. For the experimental setting, since the local client takes the learning rate α = 0.01, the γ is supposed to be 1/α = 100 in theory. Therefore, different values of γ near 100 are chosen to investigate the impact of the tuning factor on both the LeNet and MLP networks. Figure 2a shows that when the γ is lower than or equal to the ideal value 100, the result of restoration is completely unrecognizable. With the growth of γ, the PSNR reaches the peak at γ = 120 , and then starts decreasing until γ = 240 and the PSNR almost drops to 0. As for the MLP network, since the it utilizes the Adam as the optimizer, it achieves the highest PSNR at γ = 60 and then decreases, as shown in Figure 2b .These two figures illustrate that the DLM is difficult to find a quite precise value γ to obtain a high PSNR restoration result, because if clients adopt different learning rates α or different optimizers, the optimal value of γ will change. However, in the DLM+, there is no need to initialize any extra hyperparameter and thus the randomness of the framework is reduced.In the basic experimental setting, we consider only the local training process with 1 local epoch in DLM+. Nevertheless, in practical situations, each local client will execute several training epochs during the local training time, or sometimes the adversary may not be able to intercept the continuous model parameters W t and W t+1 but only a few rounds of model parameters in between (i.e., W t and W t+k , k > 1). Hence, different local epochs are considered to evaluate the robustness of our architectures. As Figure 3a shows, for the LeNet, the PSNR of the restoration image after 100 local epochs is still almost the same in the basic experiment with 1 local step.In addition, we also change the optimizer for local clients. Prior experiments mainly focus on the vanilla SGD, whereas SGD with momentum is more widely used to accumulate historical gradient information momentum to accelerate the vanilla SGD at present. Figure 3b indicates that the performance of DLM+ in SGD with momentum is as good as vanilla SGD.In this section, we introduce two defense approaches: differential privacy and model sparsification to protect the client from our proposed attacks.One protection method is to train a neural network under differential privacy (DP) [19] . Instead of applying DP to the model gradients [20] , we turn to performing DP on the model weights. Specifically, after finishing the local training process and updating the model weights, each l-th layer W t (l) of model weights is clipped as follows: where W t (l) is the clipped model parameter and C is a clipping threshold. Subsequently, the noise of different strengths is added to the clipped model weights for better evaluation, including Gaussian noise and Laplacian noise with variance ranging from 10 -1 to 10 -5 and central 0:EQUATIONEQUATION)where L is the group size, C is the model parameter norm bound and σ is the noise level. After employing DP with Gaussian noise between 0 and 1e-02, the PSNR results of Gaussian DP are shown in Section 5.4. When the strength grows up to more than 1e-04, our attack algorithms fail to recover the training data. Therefore, the recommended strength of Gaussian noise is 1e-04. In addition, the results of LeNet and Laplacian noise are shown in Section 5.4, which demonstrates a trend similar to that of the above result.The above results indicate that only a relatively low level of noise should be added to the communicated model parameters to prevent the whole FL system from our attacks. The reason is that a strong noise may severely disturb the parameters of the original model parameters W t g and W t+1 k .Model Sparsification. Model sparsification [21] is also an effective method to prevent clients from attacks. Particularly, before uploading their model weights to the parameter server, the clients execute the model sparsification range from 0 to 60%, in which it first sets a quantile of the whole model weight, then if the weight value is less than the chosen quantile, it will be pruned to zero. Figure 4 illustrates that when the sparsification rate is approximately 20%, DLM+ still obtains a PSNR restoration result greater than the value of 35. With the increases in sparsities, the PSNR of DLM+ keeps decreasing but DLM+ could still manage to recover identifiable training data when the sparsification rate is between 1% and 50%. Once the sparsity level exceeds the tolerance of DLM+ around 50%, it is difficult for the adversary model to find the ground-truth gradient and the PSNR becomes quite low. Therefore, a model sparsification scale larger than 50% of model sparsification could be sufficient to protect the transmitted model weights in the MLP network.However, Figure 4 also indicates that the resistance of the DLM+ attack to model sparsification is extremely poor, with a sharply shrunken PSNR even when the sparsity of LeNet is only 1. 
conclusion and discussion: 
 In this paper, we present two novel frameworks: Deep Leakage from Model (DLM) and Deep Leakage from Model+ (DLM+) to recover the private data of each client. The experiment shows that our proposed frameworks achieve the highest accuracy, PSNR, and SSIM value compared with existing gradient leakage approaches, including DLG and cosine similarity. For a better comparison, we also add a tuning factor to the original DLG to explain why DLM outperforms the DLG. In addition, the analysis of the impact of the local iteration and local optimizer verifies that both of our proposed algorithms are quite robust to multiple local iterations. Finally, two defense methods to protect the clients from our attacks are evaluated, and the corresponding protection thresholds are recommended.Discussion. In the above sections, we mainly discuss the attacks in federated learning since the FL frameworks are specially designed to protect the security of private data. However, we have to emphasize two points: (a) the DLM and DLM+ could still work on the non-IID and a number of clients' circumstances since the attacking process is similar, (b) our two proposed architectures could still steal the private training data from these distributed learning frameworks that transmitted model parameters, such as distributed SGD [22] . 
 
 Appendix: The section contains supplementary extensional algorithms and experimental results.First of all, as we mentioned in the discussion part, our two proposed architectures could also be applied to the these distributed learning (DL) frameworks which transmitted model parameters and obtain their private training data. Randomly initialize dummy data x ← N (0, I) and dummy label ŷ ← N (0, 1) Randomly initialize dummy data x ← N (0, I) and dummy label ŷ ← N (0, 1)for i = 1 to N do ∇ W t g L(x i , ŷi ) = ∂L F xi , W t g , ŷi ∂W t g Calculate the loss L DLM (x i , ŷi , γ i ) by Equation (3) xi+1 ← xi -η∇ xi L DLM (x i , ŷi , γ i ) ŷi+1 ← ŷi -η∇ ŷi L DLM (x i , ŷi , γ i ) γ i+1 ← γ i -η∇ γi L DLM (x i ,for i = 1 to N do ∇ W t g L(x i , ŷi ) = ∂L F xi , W t g , ŷi ∂W t g Calculate the loss L DLM + (x i , ŷi ) by Equation (7) xi+1 ← xi -η∇ xi L DLM + (x i , ŷi ) ŷi+1 ← ŷi -η∇ ŷi L DLM + (x i , ŷi )end for end for end functionIn this section, we introduce the structure of our experiment models (MLP and LeNet) in Table 3 and Table 4 respectively. To demonstrate the effectiveness of DLM+ on high-resolution image, we conduct experiments conducted utilizing the ImageNet dataset with image dimensions of (3 * 224 * 224). The result is shown in Fig. 6 .For better viewing the convergence of proposed frameworks under each defense method, we reveal the figures of PSNR v.s. Iterations and Loss v.s. Iterations as follows. The Figure 7 to Figure 9 are the DLM+ attacks to LeNet under DP with Gaussian noise, Laplacian noise and model sparsification, respectively. Besides, the Figure 11 and Figure 11b are the loss curves of the MLP network under different defenses.As a supplement to Sections 5.2 and 5.3, Figure 12 shows the variation of loss v.s. iteration for both the LeNet and the MLP network in the learning rate experiment. Similarly, Figure 13 informs the variation of loss v.s. iteration in the local iteration experiment. Since many researches now focus on the recovery of a mini-batch data, we also use DLM to attack the batch data in this experiment. By following the work of [6] , total variance (TV) regularization is added to the objective function DLM+:EQUATIONwhere the β is the scaling factor setting by the adversary.Subsequently, this new objective function is applied to the DLM+ framework and the result of the four batch-size data recovery is shown in Figure 14 . This figure illustrates that our proposed framework is able to restore the batch data as well. Iteration=0 Iteration=100 Iteration=200 Iteration=300 Iteration=400 Iteration=500 Ground TruthFirst Conference on Parsimony and Learning (CPAL 2024). 


Decision: This paper develops a new attack algorithm for model inversion attacks in federated learning. Different from the majority of prior art, this paper considers the setting where models instead of gradients are being transmitted. All three reviewers agree that this is a novel and interesting work and deserves acceptance to the CPAL conference. During the rebuttal phase, the authors further address the reviewers' minor concerns on this paper's complexity and setting. Therefore, I support the acceptance of this paper.

Reviews: review: title: title: Review for deep leakage
main_review: main_review: 1. Summary:
The paper begins by highlighting the challenges posed by the growth and complexity of data to traditional centralized machine learning. Distributed learning has emerged as a solution, with federated learning (FL) being a notable application. FL aims to protect client data privacy by keeping training data local. However, even without uploading raw training data, FL can still be vulnerable to data leakage.

2. Main Contributions:
a) The paper identifies the possibility of recovering private training data in FL using only transmitted model parameters and loss functions, challenging the foundational security of FL.
b) Two novel attack frameworks, DLM and DLM+, are introduced. These frameworks are applied to FedAvg, a widely-used algorithm in FL. c) The results show that FL architectures that exchange model weights cannot fully protect client data.
d) The paper compares the proposed model leakage attacks with existing gradient leakage attacks, demonstrating the superiority of the new attacks. Additionally, two defenses against these attacks are introduced.

3. Pros:
a) The paper addresses a critical security concern in federated learning, enhancing the understanding of potential vulnerabilities.
b) Introduces two novel attack frameworks, DLM and DLM+, offering a comprehensive approach to understanding data leakage in FL.
c) Provides defenses against the proposed attacks, ensuring a balanced perspective on the issue.

4. Cons:
a) The paper's focus on transmitted model weights might limit its applicability to FL systems that don't rely on this method.
b) The complexity of the proposed frameworks might make them challenging to implement in real-world scenarios.
c) The paper assumes that attackers have access to certain transmitted data, which might not always be the case in secure FL implementations.
title: title: Simple changes to DLG leads to higher attack performance and robustness
main_review: main_review: The paper titled "Deep Leakage from Model Parameters in Federated Learning" investigates the security vulnerabilities within the Federated Learning (FL) framework, primarily focusing on the potential data leakage when transmitting model parameters. The authors highlight the importance of FL in addressing data privacy concerns and the challenges posed by the explosive growth of data. The authors set the stage by mentioning the recent advancements in gradient leakage attacks, which have raised concerns about the security of FL. They emphasize the common requirement for auxiliary information in these attacks, such as model weights, optimizers, and hyperparameters, which can be challenging to obtain in practical scenarios. Furthermore, the paper raises concerns about the security of transmitting model weights in FL, a less explored area. To address these issues, the authors propose two novel attack frameworks, DLM and DLM+, which aim to expose the potential leakage of private client data when transmitting model weights. 

To reduce the number of trained variables, the authors propose to approximate learning rate with value of the weight difference of global model divided by gradients. Doing so can get rid of learning rate and gain better performance. Empirical results verify the effectiveness of proposed method. In addition, two defenses against the proposed attacks have been presented. 

Pros:

(1) The paper is written clearly and present the main idea and methodology in a very pleasant way. I can directly understand the main mechanism of data leakage after reading the paper once.

(2) The main idea is simple yet effective. A very straight-forward modification leads to significant improvement. I believe the simplicity is a pro rather than con in this case.

(3) Empirical results demonstrate the effectiveness of the proposed method clearly. 

(4) The proposed method enjoys appealing robustness to local iteration and optimizer as well.
Cons:

(1) While promising performance is demonstrated, I would like to see the efficiency comparison between DLM+ and DLG. Does the simple change leads to higher computational cost?
title: title: Official Review of Submission 16
main_review: main_review: ## Overview

The study introduces a novel attack framework, termed DLM and DLM+, that challenges existing federated learning systems where model weights are transmitted rather than the gradient. Unique to DLM(+) is its reliance solely on communicated model parameters and the loss function, making it more flexible than earlier gradient leakage attacks. Comprehensive tests underscore the consistent efficacy of the introduced methods.

## Comments

(+) The advancements brought about by DLM+ are notably superior to other attack baselines.

(+) A series of ablation studies have been carried out, which strongly attest to the efficacy of the proposed method.

(+) This work is well-motivated and proposes a threat to federated learning where only model weights are transmitted.

(-) Referring to line 172, while MNIST, CIFAR10, and CIFAR100 are employed to encompass different image sizes, both sets predominantly contain smaller images (28x28 for MNIST and 32x32 for CIFAR10/100). Integrating datasets with larger images might offer more comprehensive results.

(-) It would be valuable to understand if the presented method can be extended to situations where prior information about the loss function isn't accessible.