Abstract:Recent years have witnessed the vulnerability of Federated Learning (FL) against gradient leakage attacks, where the private training data can be recovered from the exchanged gradients, making gradient protection a critical issue for the FL training process. Existing solutions often resort to perturbation-based mechanisms, such as differential privacy, where each participating client injects a specific amount of noise into local gradients before aggregating to the server, and the global distribution variation finally conceals the gradient privacy. However, perturbation is not always the panacea for gradient protection since the robustness heavily relies on the injected noise. This intuition raises an interesting question: is it possible to deactivate existing protection mechanisms by removing the perturbation inside the gradients? In this paper, we present the answer: yes and propose the Perturbation-resilient Gradient Leakage Attack (PGLA), the first attempt to recover the perturbed gradients, without additional access to the original model structure or third-party data. Specifically, we leverage the inherent diffusion property of gradient perturbation protection and construct a novel diffusion-based denoising model to implement PGLA. Our insight is that capturing the disturbance level of perturbation during the diffusion reverse process can release the gradient denoising capability, which promotes the diffusion model to generate approximate gradients as the original clean version through adaptive sampling steps. Extensive experiments demonstrate that PGLA effectively recovers the protected gradients and exposes the FL training process to the threat of gradient leakage, achieving the best quality in gradient denoising and data recovery compared to existing models. We hope to arouse public attention on PGLA and its defense.

Improving Resistance to Adversarial Deformations by Regularizing Gradients

Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model

Towards Robust Training of Neural Networks by Regularizing Adversarial Gradients

Gradient Diffusion: A Perturbation-Resilient Gradient Leakage Attack

Defense Against Adversarial Attacks via Controlling Gradient Leaking on Embedded Manifolds

Deep Defense: Training DNNs with Improved Adversarial Robustness

Adaptive Epsilon Adversarial Training for Robust Gravitational Wave Parameter Estimation Using Normalizing Flows

Gradients Stand-in for Defending Deep Leakage in Federated Learning

Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks

Improving the Robustness of Adversarial Attacks Using an Affine-Invariant Gradient Estimator

LAFIT: Efficient and Reliable Evaluation of Adversarial Defenses With Latent Features

Designing defensive techniques to handle adversarial attack on deep learning based model

Improving Adversarial Transferability with Gradient Refining

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Flow-Pronged Defense Against Adversarial Examples.

Dynamic and Diverse Transformations for Defending Against Adversarial Examples

AdversaFlow: Visual Red Teaming for Large Language Models with Multi-Level Adversarial Flow

Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques

Improving Adversarial Transferability with Heuristic Random Transformation.