Unmixing gradients: Uncovering persistent leakage in Federated Learning via Independent Component Analysis

Abstract

Federated Learning (FL), a cornerstone of privacy-preserving technology in the Artificial Intelligence of Things (AIoT) era, enables collaborative model training across edge devices via gradient sharing. However, Gradient Leakage Attacks (GLA) can reconstruct private data from these gradients, fundamentally undermining FL’s privacy guarantees. While recent Generation-based GLAs demonstrate significant promise in efficiency and quality, their core feature separation algorithms rely heavily on idealized properties of early-stage training. This dependency causes attack performance to decay rapidly as training progresses and fails in challenging scenarios, such as batches with duplicate labels. To overcome this, we reframe feature separation as a Blind Source Separation (BSS) problem, solved using Independent Component Analysis (ICA). Through a systematic analysis of the entire training lifecycle, we uncover the adversarial dynamics of key mathematical properties that govern BSS solvability. Based on these insights, we introduce a novel framework: ICA-driven Generative Attacks (ICA-GA). Extensive experiments show that ICA-GA significantly outperforms baselines throughout the training lifecycle and exhibits remarkable robustness against challenging conditions, including batches with full label duplication, FedAVG, and gradient compression. Furthermore, our incremental generator fine-tuning strategy reduces the marginal cost of continuous multi-round attacks by an order of magnitude, making such threats highly practical. Our work reveals that the privacy risk in FL is far more persistent and severe than previously understood. Our code is publicly available at https://github.com/liminhao-99/ICA-GA.