ARES: Scalable and Practical Gradient Inversion Attacks in Federated Learning via Activation Recovery

The researchers propose ARES, an active gradient inversion attack against federated learning that can reconstruct samples with high fidelity from large-batch training data without modifying the model architecture. The method formulates the recovery problem as a noisy sparse recovery task and solves it with generalized Lasso, while using the imprint method to decouple activations, enabling scalable per-sample reconstruction; the paper also provides theoretical guarantees on the expected recovery rate and an upper bound on reconstruction error. Experiments on CNNs and MLPs show that ARES significantly outperforms existing gradient inversion attacks in reconstruction under large batches and realistic federated learning settings. The authors point out that intermediate activations constitute an underestimated severe privacy risk in federated learning, highlighting the need for stronger defenses.