Some algorithms in the literature allow recovering the input data used to train a neural network. This is done using the gradients (updates) of weights, such as in Deep Leakage from Gradients (2019) by Ligeng Zhu et al.

In case the neural network is trained using encrypted (homomorphic) input data, what could be the output of the above algorithm? Will the algorithm recover the data in clear or encrypted (as it was fed encrypted)?

  • $\begingroup$ Just to clarify, although I am not familiar with that paper/work, but are you assuming that the neural network would be trained with an encrypted version of the data? $\endgroup$
    – nbro
    Dec 19, 2020 at 23:44
  • $\begingroup$ Yes, exactly the neural network is trained with encrypted data using homomorphic encryption ... but the neural network ie. weights and parameters are not encrypted, only the training data is encrypted. $\endgroup$
    – witdev
    Dec 20, 2020 at 11:40

1 Answer 1


It will recover the encrypted inputs.

The algorithm starts with dummy data and dummy labels, and then iteratively optimizes the dummy gradients to be close as to the original. This makes the dummy data close to the real training data:

$$\mathbf{x}^{\prime *}, \mathbf{y}^{\prime *}=\underset{\mathbf{x}^{\prime}, \mathbf{y}^{\prime}}{\arg \min }\left\|\nabla W^{\prime}-\nabla W\right\|^{2}=\underset{\mathbf{x}^{\prime}, \mathbf{y}^{\prime}}{\arg \min }\left\|\frac{\partial \ell\left(F\left(\mathbf{x}^{\prime}, W\right), \mathbf{y}^{\prime}\right)}{\partial W}-\nabla W\right\|^{2}$$

As the distance is minimized, the algorithm restores the original training data; in the case of encrypted training data - you should get an encrypted input (up to failures when the resulted 'input' isn't close to the original input).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .