Abstract:Federated Learning (FL) enables distributed participants (e.g., mobile devices) to train a global model without sharing data directly to a central server. Recent studies have revealed that FL is vulnerable to gradient inversion attack (GIA), which aims to reconstruct the original training samples and poses high risk against the privacy of clients in FL. However, most existing GIAs necessitate control over the server and rely on strong prior knowledge including batch normalization and data distribution information. In this work, we propose Client-side poisoning Gradient Inversion (CGI), which is a novel attack method that can be launched from clients. For the first time, we show the feasibility of a client-side adversary with limited knowledge being able to recover the training samples from the aggregated global model. We take a distinct approach in which the adversary utilizes a malicious model that amplifies the loss of a specific targeted class of interest. When honest clients employ the poisoned global model, the gradients of samples belonging to the targeted class are magnified, making them the dominant factor in the aggregated update. This enables the adversary to effectively reconstruct the private input belonging to other clients using the aggregated update. In addition, our CGI also features its ability to remain stealthy against Byzantine-robust aggregation rules (AGRs). By optimizing malicious updates and blending benign updates with a malicious replacement vector, our method remains undetected by these defense mechanisms. To evaluate the performance of CGI, we conduct experiments on various benchmark datasets, considering representative Byzantine-robust AGRs, and exploring diverse FL settings with different levels of adversary knowledge about the data. Our results demonstrate that CGI consistently and successfully extracts training input in all tested scenarios.

Compromise Privacy in Large-Batch Federated Learning Via Model Poisoning

Oblivion: Poisoning Federated Learning by Inducing Catastrophic Forgetting.

FL-PTD: A Privacy Preserving Defense Strategy Against Poisoning Attacks in Federated Learning.

BPFL: Blockchain-Based Privacy-Preserving Federated Learning against Poisoning Attack

Efficient and Privacy-Preserving Federated Learning Against Poisoning Adversaries

DPFLA: Defending Private Federated Learning Against Poisoning Attacks

A federated learning attack method based on edge collaboration via cloud

Data Poisoning Attacks Against Federated Learning Systems

DP-Poison: Poisoning Federated Learning under the Cover of Differential Privacy

PROFL: A Privacy-Preserving Federated Learning Method with Stringent Defense Against Poisoning Attacks

Poisoning with A Pill: Circumventing Detection in Federated Learning

Client-side Gradient Inversion Against Federated Learning from Poisoning

A New Federated Learning Framework Against Gradient Inversion Attacks

SPFL: A Self-purified Federated Learning Method Against Poisoning Attacks

APFed: Anti-Poisoning Attacks in Privacy-Preserving Heterogeneous Federated Learning.

Robust and privacy-preserving federated learning with distributed additive encryption against poisoning attacks

Split Aggregation: Lightweight Privacy-Preserving Federated Learning Resistant to Byzantine Attacks

Defending Against Data Poisoning Attack in Federated Learning With Non-IID Data

Breaking Secure Aggregation: Label Leakage from Aggregated Gradients in Federated Learning

Concealing Sensitive Samples against Gradient Leakage in Federated Learning

Model Poisoning Attacks to Federated Learning via Multi-Round Consistency