Federated Learning (FL) enables collaborative model training by sharing model updates instead of raw data, aiming to protect user privacy. However, recent studies reveal that these shared updates can inadvertently leak sensitive training data through gradient inversion attacks (GIAs). Among them, active GIAs are particularly powerful, enabling high-fidelity reconstruction of individual samples even under large batch sizes. Nevertheless, existing approaches often require architectural modifications, which limit their practical applicability. In this work, we bridge this gap by introducing the Activation REcovery via Sparse inversion (ARES) attack, an active GIA designed to reconstruct training samples from large training batches without requiring architectural modifications. Specifically, we formulate the recovery problem as a noisy sparse recovery task and solve it using the generalized Least Absolute Shrinkage and Selection Operator (Lasso). To extend the attack to multi-sample recovery, ARES incorporates the imprint method to disentangle activations, enabling scalable per-sample reconstruction. We further establish the expected recovery rate and derive an upper bound on the reconstruction error, providing theoretical guarantees for the ARES attack. Extensive experiments on CNNs and MLPs demonstrate that ARES achieves high-fidelity reconstruction across diverse datasets, significantly outperforming prior GIAs under large batch sizes and realistic FL settings. Our results highlight that intermediate activations pose a serious and underestimated privacy risk in FL, underscoring the urgent need for stronger defenses.

翻译：联邦学习（FL）通过共享模型更新而非原始数据来实现协作模型训练，旨在保护用户隐私。然而，最近的研究表明，这些共享更新可能通过梯度反转攻击（GIA）无意中泄露敏感的训练数据。其中，主动式GIA尤为强大，即使在大批量处理条件下也能实现单个样本的高保真重建。然而，现有方法通常需要修改模型架构，这限制了其实用性。在本工作中，我们通过引入基于稀疏反演的激活恢复（ARES）攻击填补了这一空白——这是一种无需修改架构、即可从大批量训练数据中重建训练样本的主动式GIA。具体而言，我们将恢复问题建模为带噪稀疏恢复任务，并利用广义最小绝对收缩与选择算子（Lasso）进行求解。为将攻击扩展到多样本恢复场景，ARES采用印记方法解耦激活值，从而实现可扩展的逐样本重建。我们进一步建立了期望恢复率，并推导出重建误差的上界，为ARES攻击提供了理论保证。在CNN和MLP上的大量实验表明，ARES能够在不同数据集上实现高保真重建，在大批量处理和现实FL设置下显著优于先前的GIA方法。我们的结果凸显了中间激活值在FL中构成被严重低估的隐私风险，亟需发展更强的防御机制。