Abstract:Recent years have witnessed the vulnerability of Federated Learning (FL) against gradient leakage attacks, where the private training data can be recovered from the exchanged gradients, making gradient protection a critical issue for the FL training process. Existing solutions often resort to perturbation-based mechanisms, such as differential privacy, where each participating client injects a specific amount of noise into local gradients before aggregating to the server, and the global distribution variation finally conceals the gradient privacy. However, perturbation is not always the panacea for gradient protection since the robustness heavily relies on the injected noise. This intuition raises an interesting question: is it possible to deactivate existing protection mechanisms by removing the perturbation inside the gradients? In this paper, we present the answer: yes and propose the Perturbation-resilient Gradient Leakage Attack (PGLA), the first attempt to recover the perturbed gradients, without additional access to the original model structure or third-party data. Specifically, we leverage the inherent diffusion property of gradient perturbation protection and construct a novel diffusion-based denoising model to implement PGLA. Our insight is that capturing the disturbance level of perturbation during the diffusion reverse process can release the gradient denoising capability, which promotes the diffusion model to generate approximate gradients as the original clean version through adaptive sampling steps. Extensive experiments demonstrate that PGLA effectively recovers the protected gradients and exposes the FL training process to the threat of gradient leakage, achieving the best quality in gradient denoising and data recovery compared to existing models. We hope to arouse public attention on PGLA and its defense.

Variance of the Gradient Also Matters: Privacy Leakage from Gradients.

SAPAG: A Self-Adaptive Privacy Attack from Gradients

Gradient Inversion Attacks: Impact Factors Analyses and Privacy Enhancement

Wasserstein Distance-Based Deep Leakage from Gradients.

Gradient leakage attacks in federated learning

Gradients Look Alike: Sensitivity is Often Overestimated in DP-SGD

SSGD: A Safe and Efficient Method of Gradient Descent

Recover User's Private Training Image Data by Gradient in Federated Learning

Protect Privacy from Gradient Leakage Attack in Federated Learning

A(DP)$^2$SGD: Asynchronous Decentralized Parallel Stochastic Gradient Descent with Differential Privacy

Understanding Deep Gradient Leakage via Inversion Influence Functions

Securing Distributed SGD Against Gradient Leakage Threats

Analyzing Inference Privacy Risks Through Gradients in Machine Learning

Gradient Diffusion: A Perturbation-Resilient Gradient Leakage Attack

DPDR: Gradient Decomposition and Reconstruction for Differentially Private Deep Learning

Gradient Inversion Attack on Graph Neural Networks

An Improved Privacy-Preserving Stochastic Gradient Descent Algorithm

SoK: Gradient Leakage in Federated Learning

Enhancing DP-SGD through Non-monotonous Adaptive Scaling Gradient Weight

High-Fidelity Gradient Inversion in Distributed Learning

Seeing the Forest through the Trees: Data Leakage from Partial Transformer Gradients