JX
J. Xu
info
Please Note
<p>This page displays the records of the person named above and is not linked to a unique person identifier. This record may need to be merged to a profile.</p>
3 records found
1
Federated learning is a private-by-design distributed learning paradigm where clients train local models on their own data before a central server aggregates their local updates to compute a global model. Depending on the aggregation method used, the local updates are either the gradients or the weights of local learning models, e.g., FedAvg aggregates model weights. Unfortunately, recent reconstruction attacks apply a gradient inversion optimization on the gradient update of a single mini- batch to reconstruct the private data used by clients during training. As the state-of-the-art reconstruction attacks solely focus on single update, realistic adversarial scenarios are over- looked, such as observation across multiple updates and updates trained from multiple mini-batches. A few studies consider a more challenging adversarial scenario where only model updates based on multiple mini-batches are observable, and resort to computationally expensive simulation to untangle the underlying samples for each local step. In this paper, we propose AGIC, a novel Approximate Gradient Inversion Attack that efficiently and effectively reconstructs images from both model or gradient updates, and across multiple epochs. In a nutshell, AGIC (i) approximates gradient updates of used training samples from model updates to avoid costly simulation procedures, (ii) leverages gradient/model updates collected from multiple epochs, and (iii) assigns increasing weights to layers with respect to the neural network structure for reconstruction quality. We extensively evaluate AGIC on three datasets, namely CIFAR-10, CIFAR- 100 and ImageNet. Our results show that AGIC increases the peak signal-to-noise ratio (PSNR) by up to 50% compared to two representative state-of-the-art gradient inversion attacks. Furthermore, AGIC is faster than the state-of-the-art simulation- based attack, e.g., it is 5x faster when attacking FedAvg with 8 local steps in between model updates.
...
Federated learning is a private-by-design distributed learning paradigm where clients train local models on their own data before a central server aggregates their local updates to compute a global model. Depending on the aggregation method used, the local updates are either the gradients or the weights of local learning models, e.g., FedAvg aggregates model weights. Unfortunately, recent reconstruction attacks apply a gradient inversion optimization on the gradient update of a single mini- batch to reconstruct the private data used by clients during training. As the state-of-the-art reconstruction attacks solely focus on single update, realistic adversarial scenarios are over- looked, such as observation across multiple updates and updates trained from multiple mini-batches. A few studies consider a more challenging adversarial scenario where only model updates based on multiple mini-batches are observable, and resort to computationally expensive simulation to untangle the underlying samples for each local step. In this paper, we propose AGIC, a novel Approximate Gradient Inversion Attack that efficiently and effectively reconstructs images from both model or gradient updates, and across multiple epochs. In a nutshell, AGIC (i) approximates gradient updates of used training samples from model updates to avoid costly simulation procedures, (ii) leverages gradient/model updates collected from multiple epochs, and (iii) assigns increasing weights to layers with respect to the neural network structure for reconstruction quality. We extensively evaluate AGIC on three datasets, namely CIFAR-10, CIFAR- 100 and ImageNet. Our results show that AGIC increases the peak signal-to-noise ratio (PSNR) by up to 50% compared to two representative state-of-the-art gradient inversion attacks. Furthermore, AGIC is faster than the state-of-the-art simulation- based attack, e.g., it is 5x faster when attacking FedAvg with 8 local steps in between model updates.
Journal article
(2023)
-
E. Babcock, Z. Salhi, A. Feoktystov, L. J. Bannenberg, S. R. Parnell, D. Alba Venero, V. Hutanu, H. Thoma, J. Xu, More Authors...
The JCNS has been developing and using in-situ polarized neutron spin filters for many applications. The system used for analysis on MARIA and polarization for TOPAS were completed about 10 years ago with the MARIA system in standard operation for users and the TOPAS system employed for a long measurement on the POLI instrument. In the meantime we are progressing on several new in-situ polarizers based on these first two but with additional innovations. The KWS-1 analyzer device which was recently used in tests at TU Delft and ISIS is essentially a 50%-sized copy of the MARIA device. The two devices in construction for polarization and analysis on POLI for hot neutrons feature magic-boxes with angled plates on both the entrance and exit sides to minimize overal length and the polarizer device will employ an additional passive magnetic shield of soft iron so that it can operate inside the stray field area of a 8-T vertical (compensated) sample magnet. We will summarize the current status of our 3He neutron spin filters and provide extra focus on the technical aspects and measured performance characteristics of the new devices for KWS-1 and POLI in particular.
...
The JCNS has been developing and using in-situ polarized neutron spin filters for many applications. The system used for analysis on MARIA and polarization for TOPAS were completed about 10 years ago with the MARIA system in standard operation for users and the TOPAS system employed for a long measurement on the POLI instrument. In the meantime we are progressing on several new in-situ polarizers based on these first two but with additional innovations. The KWS-1 analyzer device which was recently used in tests at TU Delft and ISIS is essentially a 50%-sized copy of the MARIA device. The two devices in construction for polarization and analysis on POLI for hot neutrons feature magic-boxes with angled plates on both the entrance and exit sides to minimize overal length and the polarizer device will employ an additional passive magnetic shield of soft iron so that it can operate inside the stray field area of a 8-T vertical (compensated) sample magnet. We will summarize the current status of our 3He neutron spin filters and provide extra focus on the technical aspects and measured performance characteristics of the new devices for KWS-1 and POLI in particular.
...