AGIC: Approximate Gradient Inversion Attack on Federated Learning

AGIC: Approximate Gradient Inversion Attack on Federated Learning

Xu, J. (Student TU Delft)
Hong, C. (TU Delft Data-Intensive Systems)
Huang, J. (TU Delft Data-Intensive Systems)
Chen, Lydia Y. (TU Delft Data-Intensive Systems)
Decouchant, Jérémie (TU Delft Data-Intensive Systems)

Ceballos, Cristina (editor)
Torres, Hector (editor)

2023

Federated learning is a private-by-design distributed learning paradigm where clients train local models on their own data before a central server aggregates their local updates to compute a global model. Depending on the aggregation method used, the local updates are either the gradients or the weights of local learning models, e.g., FedAvg aggregates model weights. Unfortunately, recent reconstruction attacks apply a gradient inversion optimization on the gradient update of a single mini- batch to reconstruct the private data used by clients during training. As the state-of-the-art reconstruction attacks solely focus on single update, realistic adversarial scenarios are over- looked, such as observation across multiple updates and updates trained from multiple mini-batches. A few studies consider a more challenging adversarial scenario where only model updates based on multiple mini-batches are observable, and resort to computationally expensive simulation to untangle the underlying samples for each local step. In this paper, we propose AGIC, a novel Approximate Gradient Inversion Attack that efficiently and effectively reconstructs images from both model or gradient updates, and across multiple epochs. In a nutshell, AGIC (i) approximates gradient updates of used training samples from model updates to avoid costly simulation procedures, (ii) leverages gradient/model updates collected from multiple epochs, and (iii) assigns increasing weights to layers with respect to the neural network structure for reconstruction quality. We extensively evaluate AGIC on three datasets, namely CIFAR-10, CIFAR- 100 and ImageNet. Our results show that AGIC increases the peak signal-to-noise ratio (PSNR) by up to 50% compared to two representative state-of-the-art gradient inversion attacks. Furthermore, AGIC is faster than the state-of-the-art simulation- based attack, e.g., it is 5x faster when attacking FedAvg with 8 local steps in between model updates.

Reconstruction attack
Federated Learning
Federated Averaging

http://resolver.tudelft.nl/uuid:0e4d11be-9c34-4602-98e0-79be8aaeb57f

https://doi.org/10.1109/SRDS55811.2022.00012

2023-07-01

978-1-6654-9753-4

41st International Symposium on Reliable Distributed Systems (SRDS 2022 )

41st International Symposium on Reliable Distributed Systems, 2022-09-19 → 2022-09-22, Vienna, Austria

Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Institutional Repository

conference paper

© 2023 J. Xu, C. Hong, J. Huang, Lydia Y. Chen, Jérémie Decouchant