Research question
Do shared gradients in federated learning reveal the underlying training data?
Key findings
- Pixel-exact images and token-exact text can be recovered from gradients by optimisation - Gradient sharing is not privacy-preserving by default