Gradient Obfuscation

The foundational defense strategy that adds calibrated noise directly to computed gradients before transmission. This masks the precise contribution of individual data points. The most rigorous form is Differential Privacy (DP-SGD) , which provides a mathematical privacy guarantee by clipping per-sample gradients and injecting Gaussian noise proportional to a sensitivity bound. The privacy loss is tracked via a privacy accountant and bounded by the parameter epsilon (ε) .

• Local Differential Privacy (LDP): Noise is added by the client before any data leaves the device.
• Central DP: Noise is added by a trusted server after secure aggregation.
• Trade-off: Higher noise increases privacy but degrades model utility and convergence speed.

Reduces the information content of gradient updates by transmitting only a fraction of the data. Gradient Pruning transmits only the top-k largest magnitude elements, setting the rest to zero. Gradient Sparsification generalizes this to reduce the bandwidth of the leakage channel. These methods were originally designed for communication efficiency but serve as a natural defense by creating an incomplete picture for an attacker.

• Gradient Dropping: Randomly omits a percentage of gradient elements.
• Rank-Based Sparsification: Selects elements based on statistical significance rather than absolute magnitude.
• Defense Limitation: A determined adversary can still reconstruct data from sparse signals if the sparsity pattern is consistent.

Reduces the numerical precision of gradient values from 32-bit floats to lower bit-width representations (e.g., 8-bit integers). The resulting quantization error acts as a non-linear distortion that frustrates optimization-based inversion attacks like Deep Leakage from Gradients (DLG) . SignSGD represents the extreme case, transmitting only the sign (1 bit) of each gradient element.

• Stochastic Quantization: Probabilistically rounds values to reduce systematic bias.
• QSGD (Quantized SGD) : A scheme that trades off between compression and variance.
• Effect: Destroys the fine-grained magnitude information required for precise input reconstruction.

A cryptographic defense that ensures the central server can only compute the sum of all client updates, never inspecting an individual client's gradient in plaintext. This is achieved through Secure Multi-Party Computation (SMPC) techniques like Shamir's Secret Sharing or Homomorphic Encryption. Even if the server is compromised, individual gradients remain cryptographically hidden.

• Masking: Clients agree on pairwise random masks that cancel out during summation.
• Dropout Robustness: Protocols handle clients dropping out mid-round without revealing secrets.
• Defense Property: Prevents a malicious server from performing any gradient leakage attack.

Moving beyond modifying gradients to fundamentally altering the training topology. Split Learning partitions the model so the client only shares intermediate activations (smashed data) rather than raw data or full gradients. The server completes the forward/backward pass on its portion, and the client never exposes its local model layers. This limits the adversary to reconstructing abstract feature representations, which is significantly harder than reconstructing raw pixels.

• Client-Side Model: The first few layers remain private on the device.
• U-Shaped Configurations: Both input and label sides can be split for maximum privacy.
• Limitation: Activations can still leak information, requiring additional perturbation.

Robust aggregation rules designed to defend against malicious clients submitting poisoned or dummy gradients intended to disrupt training or facilitate leakage. Techniques like Krum, Trimmed Mean, and Median replace the simple weighted average with statistical robust estimators. These methods filter out outlier updates that deviate significantly from the consensus, which can incidentally suppress gradient inversion signals that appear as statistical anomalies.

• Krum: Selects the single update closest to its n-f-2 neighbors.
• Coordinate-wise Median: Takes the median of each gradient dimension independently.
• Multi-Krum: Averages several benign-looking updates for stability.

The direct injection of calibrated noise into shared gradients to mask individual contributions. This technique adds Gaussian or Laplacian noise to the gradient vector before transmission, ensuring that the server receives a mathematically obscured update. The noise scale is typically calibrated using a privacy budget (epsilon) to balance utility and protection. Unlike secure aggregation, perturbation does not require client coordination, making it suitable for cross-silo federated learning where a trusted aggregator is unavailable.

A family of techniques that reduce the communication volume of gradients while incidentally limiting leakage fidelity. Methods include:

• Gradient Sparsification: Transmitting only the top-k gradient elements by magnitude, setting the rest to zero.
• Gradient Quantization: Reducing numerical precision from 32-bit floats to 8-bit integers or lower.
• SignSGD: Communicating only the sign of each gradient element, transmitting just 1 bit per parameter. The resulting information loss creates a natural bottleneck that degrades the quality of reconstructed inputs in inversion attacks.

A selective transmission defense where only a subset of gradient elements is shared during distributed training. Unlike sparsification, which selects elements by magnitude, pruning may use randomized or structured selection patterns. By withholding a significant fraction of the gradient vector, the adversary's optimization landscape becomes severely underdetermined. Research shows that pruning rates above 90% can prevent high-fidelity reconstruction while maintaining model convergence, particularly when combined with error feedback mechanisms that accumulate pruned residuals for future rounds.

A bounding operation that constrains the L2 norm of individual gradients before sharing. Clipping limits the signal-to-noise ratio available to an adversary by capping the maximum influence any single example can exert on the gradient. In DP-SGD, per-sample clipping is a prerequisite for meaningful privacy guarantees, as it bounds the sensitivity of the gradient computation. Even without formal differential privacy, aggressive clipping disrupts the gradient matching objective used by Deep Leakage from Gradients (DLG) attacks by distorting the relationship between inputs and their corresponding gradients.

A cryptographic protocol that allows a central server to compute the sum of model updates from multiple clients without inspecting any individual contribution in plaintext. Using techniques like Shamir secret sharing and pairwise masking, the server only sees the aggregated result. This eliminates the gradient leakage channel entirely, as no individual gradient is ever exposed. Secure aggregation is a cornerstone defense in production federated learning systems like Google's Gboard and is often combined with differential privacy for defense-in-depth against a curious or compromised aggregator.

A privacy model where individual users perturb their gradients locally before sharing, ensuring the aggregator never accesses true values. Unlike central DP, which trusts the aggregator to add noise, LDP places control in the hands of data owners. Each client applies a randomized response mechanism or adds noise calibrated to a local privacy budget (epsilon). While LDP typically incurs higher utility loss than central DP for the same privacy level, it provides stronger guarantees against a malicious server and is essential for cross-device federated learning scenarios with untrusted infrastructure.