Review for NeurIPS paper: Inverting Gradients - How easy is it to break privacy in federated learning?

There are some theoretical results about fully connected layers developed based on previous work, however, the authors doesn't seem to extend this result to convolution network, nor conducted experiments on fully connected layers, like experiments on reconstruct the inputs to a fully connect layer, what's the computation cost? 2. In line 138-142, the authors talk about the different effects of magnitude and direction of the gradients, i.e., magnitude only captures information about the state of training, the high-dimensional direction of the gradient can carry significant information, is this your feelings or do you have any justifications for this statement? It will be better if there are some experiments results on exploring this statement. Here the attacker can only access the averaged gradients, how do you know how many images participated in this gradient? This part is important and much more realistic, but it's not clear as desired, nor can I find it in the supplementary. 5. As mentioned in several places in the paper, a deeper network doesn't make the model much more private, but only make the computation cost of the attack larger, this observation is interesting and worthy exploring, can you include a section about the specific computation cost somewhere, although the attack seems strong, the authors still need to make it clear, among A images, they get B images reconstructed with high quality, and what's the corresponding computation cost.