\section{Conclusion and Future Work}
\label{sec:conclusion}

We demonstrated the effectiveness of LTI---a simple learning-based gradient inversion attack---under realistic federated learning settings. For both vision and language tasks, LTI can match or exceed the performance of state-of-the-art optimization-based methods when no defense is applied, and significantly outperform all prior works under defenses based on gradient perturbation and gradient compression. Given its simplicity and versatility, we advocate the use of LTI as both a strong baseline for future research and a diagnostic tool for evaluating privacy leakage in FL.

%\textbf{Negative societal impact.} The concept of a gradient inversion attack can lead to negative consequences if used inappropriately. Our work showed that if FL is deployed without consideration for gradient inversion attacks, an adversary can leverage its vulnerabilities to compromise the data privacy of clients \emph{even under strong empirical defenses}. However, we strongly emphasize that our work should not be interpreted as a tool for adversaries, but rather serve to inform the community about the risks of data privacy breach in FL and promote future research into safe practices.

\textbf{Future work.} This paper serves as preliminary work towards understanding the effectiveness of learning-based gradient inversion attacks, and our method can be further improved in several directions. 
\textbf{1.} For large models, our current approach is to hash the gradients into a lower-dimensional space to reduce memory cost. It may be possible to leverage model architectures to design more effective dimensionality reduction techniques to further scale up the method. 
\textbf{2.} Currently we only focus on the setting with batch size 4 for vision tasks and batch size 1 for language tasks. In practice, the batch size could be larger. For LTI, the complexity of MLP would increase when the batch size increases, which makes learning harder. More advanced model architectures and loss designs may help with the large batch case.
\textbf{3.} LTI in its current form does not leverage additional data priors such as image smoothness or text fluency. We can readily incorporate these priors by modifying the inversion model's loss function with total variation (for image data) or perplexity on a trained language model (for text data), which may further improve the performance of LTI. 
% The use of sign compression in our experiment on text data still presents a challenge for both optimization-based and learning-based attacks. More careful analysis is needed to determine whether this is truly an effective defense against gradient inversion in NLP or if it can be circumvented with stronger attacks. 
% 3. The auxiliary dataset for learning the inversion model currently plays a crucial role. An important question is whether it's possible to leverage synthetic data or random noise to train the inversion model to further reduce the capabilities of the attacker.
% \ruihan{update the limitations}
%get explicitly optimization tips from learned model, e.g. which part of gradient is more important.