See through Gradients: Image Batch Recovery via GradInversion

Yin, Hongxu; Mallya, Arun; Vahdat, Arash; Álvarez, Jose M.; Kautz, Jan; Molchanov, Pavlo

doi:10.1109/cvpr46437.2021.01607

Cited by 188 publications

(139 citation statements)

References 27 publications

Supporting

Mentioning

136

Contrasting

Unclassified

Order By: Relevance

“…We account for image prior losses by minimizing L prior , which includes total variation and l 2 norm losses [14]. In addition, we jointly optimize the corresponding labels from a client's data by using a trainable label ŷk and minimize a loss function such as cross-entropy that is used for supervising the classification networks.…”

Section: B Practical Gradient Inversion Attackmentioning

confidence: 99%

“…In this work, we use image identifiability precision (IIP) [14], which is designed for measuring the image-specific features between the reconstructed images and original training data. In its original formulation, the metric is computed for a fixed number of randomly selected images (e.g., 256) by employing the gradient-inversion attacks for each batch of data.…”

Section: Image Identifiability Precisionmentioning

confidence: 99%

“…We utilize an extended version of the GradInversion algorithm [14] to invert the training images of each client separately based on its model updates sent during FL. For details on the inversion attack, see Section II-B.…”

Section: B Limitations Of Previous Attack Scenariosmentioning

confidence: 99%

“…We furthermore adjusted the Image Identifiability Precision (IIP) proposed in Yin et al [14] to the FL scenario. Our specific approach is outlined in Section II-D. IIP measures the amount of identifiable information leaked in the gradient inversion attack by counting the closest exact matches between the reconstructions from the membership attack and the original training images for each client.…”

Section: G Membership Inference Attack Data Leakagementioning

confidence: 99%

“…Geiping et al [13] showed also that high-resolution images could be reconstructed from model updates sent in FL from small batch sizes, with access to the model gradients for one training iteration. Most recently, Yin et al [14] further improved the image fidelity and visual realism of gradient inverted reconstructions by matching fixed running statistics of BN layers. To effectively localize objects in the training images, they use different optimization seeds to simultaneously reconstruct several images that can be registered to a consensus image from all recovered images.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Do Gradient Inversion Attacks Make Federated Learning Unsafe?

Hatamizadeh¹,

Yin²,

Molchanov³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Federated learning (FL) allows the collaborative training of AI models without needing to share raw data. This capability makes it especially interesting for healthcare applications where patient and data privacy is of utmost concern. However, recent works on the inversion of deep neural networks from model gradients raised concerns about the security of FL in preventing the leakage of training data. In this work, we show that these attacks presented in the literature are impractical in real FL use-cases and provide a new baseline attack that works for more realistic scenarios where the clients' training involves updating the Batch Normalization (BN) statistics. Furthermore, we present new ways to measure and visualize potential data leakage in FL. Our work is a step towards establishing reproducible methods of measuring data leakage in FL and could help determine the optimal tradeoffs between privacy-preserving techniques, such as differential privacy, and model accuracy based on quantifiable metrics.

show abstract

Section: B Practical Gradient Inversion Attackmentioning

confidence: 99%

Section: Image Identifiability Precisionmentioning

confidence: 99%

Section: B Limitations Of Previous Attack Scenariosmentioning

confidence: 99%

Section: G Membership Inference Attack Data Leakagementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Do Gradient Inversion Attacks Make Federated Learning Unsafe?

Hatamizadeh¹,

Yin²,

Molchanov³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

Security of federated learning for cloud‐edge intelligence collaborative computing

Yang

Zheng

Zhang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Federated Learning (FL) is one of the key technologies to solve privacy protection for cloud-edge intelligent collaborative computing, and its security and privacy issues have attracted extensive attention from academia and industry. FL is a distributed privacy protection framework. Multiple edged nodes or servers jointly train a machine learning model by sharing model parameters without exchanging local data. However, there are still many security risks and privacy threats in FL in edge-cloud collaborative computing. In this paper, we mainly discuss the security and privacy challenges on FL in collaborative computing at the edge. First, we introduce the principle, classification, and threat model of FL in edge-cloud collaboration, which helps understand the challenges faced by edgecloud collaborative computing. Second, privacy leakage attacks and poisoning attacks launched by adversaries or honest but curious actors are summarized and compared. Then, the problems existing on the attack method are summarized and analyzed. Finally, the future development direction of FL in the field of edgecloud collaborative computing is further discussed.

show abstract

An effective and practical gradient inversion attack

Luo

Zhu

Fang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

While gradient aggregation playing a vital role in federated or collaborative learning, recent studies have revealed that gradient aggregation may suffer from some attacks, such as gradient inversion, where the private training data can be recovered from the shared gradients. However, the performance of the existing attack methods is limited because they usually require prior knowledge in Batch Normalization and could only reconstruct a single image or a small batch one. To make the attacks less restrictive and more applicable, we propose an effective and practical gradient inversion method in this paper. Specifically, we use cosine similarity to measure the difference of gradients between the synthesized and ground-truth images, and then construct an input regularization for the fully connected layer to ensure the fidelity of the image. Moreover, we apply the total variation denoising strategy to the convolution feature map for further improving the smoothness of the reconstructed image. Experimental results demonstrate that our method can reconstruct high fidelity training data on a large batch size for complex data sets, such as ImageNet.

show abstract

See through Gradients: Image Batch Recovery via GradInversion

Cited by 188 publications

References 27 publications

Do Gradient Inversion Attacks Make Federated Learning Unsafe?

Do Gradient Inversion Attacks Make Federated Learning Unsafe?

Security of federated learning for cloud‐edge intelligence collaborative computing

An effective and practical gradient inversion attack

Contact Info

Product

Resources

About