CGGL: A client-side generative gradient leakage attack with double diffusion prior

Abstract

Federated learning (FL) has emerged as a widely adopted privacy-preserving distributed framework that facilitates information fusion and model training across multiple clients without requiring direct data sharing with a central server. Despite its advantages, recent studies have revealed that FL is vulnerable to gradient inversion attacks, wherein adversaries can reconstruct clients’ private training data from shared gradients. These existing attacks often assumed typically unrealistic in practical FL deployments. In real-world scenarios, malicious clients are more likely to initiate such attacks. In this paper, we propose a novel Client-side Generative Gradient Leakage (CGGL) attack tailored for FL-based information fusion scenarios. Our approach targets gradient inversion attacks originating from clients and introduces an adaptive poisoning strategy. By utilizing poisoned gradients in the local updates, a malicious client can stealthily embed the target gradients into the aggregated global model updates, enabling the reconstruction of private data from the aggregated gradients. To enhance the effectiveness of the attack, we further develop a reconstruction framework based on a conditional diffusion model incorporating dual diffusion priors. This design significantly improves image reconstruction fidelity, particularly under larger batch sizes and on high-resolution datasets. We validate the proposed CGGL method through extensive experiments on both natural and medical imaging datasets. Results demonstrate that CGGL consistently outperforms existing client-side gradient inversion attacks, achieving pixel-level data reconstruction and revealing substantial privacy risks in FL-enabled information fusion systems—even in the presence of various defense mechanisms.