Abstract: Federated Learning (FL) has emerged as a promising approach for collaborative model training without sharing private data. However, privacy concerns regarding information exchanged during FL have received significant research attention. Gradient Inversion Attacks (GIAs) have been proposed to reconstruct the private data retained by local clients from the exchanged gradients. While recovering private data, the data dimensions and the model complexity increase, which thwart data reconstruction by GIAs. Existing methods adopt prior knowledge about private data to overcome those challenges. In this paper, we first observe that GIAs with gradients from a single iteration fail to reconstruct private data due to insufficient dimensions of leaked gradients, complex model architectures, and invalid gradient information. We investigate a Temporal Gradient Inversion Attack with a Robust Optimization framework, called TGIAs-RO, which recovers private data without any prior knowledge by leveraging multiple temporal gradients. To eliminate the negative impacts of outliers, e.g., invalid gradients for collaborative optimization, robust statistics are proposed. Theoretical guarantees on the recovery performance and robustness of TGIAs-RO against invalid gradients are also provided. Extensive empirical results on MNIST, CIFAR10, ImageNet and Reuters 21578 datasets show that the proposed TGIAs-RO with 10 temporal gradients improves reconstruction performance compared to state-of-the-art methods, even for large batch sizes (up to 128), complex models like ResNet18, and large datasets like ImageNet (224*224 pixels). Furthermore, the proposed attack method inspires further exploration of privacy-preserving methods in the context of FL.

Batch data recovery from gradients based on generative adversarial networks

Recover User's Private Training Image Data by Gradient in Federated Learning

DGGI: Deep Generative Gradient Inversion with Diffusion Model

Towards General Deep Leakage in Federated Learning

GIFD: A Generative Gradient Inversion Method with Feature Domain Optimization

Gradient Inversion of Federated Diffusion Models

High-Fidelity Gradient Inversion in Distributed Learning

Inverting Gradient Attack Combined with GAN Network in Federated Learning of Face Recognition

Federated Learning under Attack: Improving Gradient Inversion for Batch of Images

Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks

Instance-wise Batch Label Restoration via Gradients in Federated Learning

Gradient Inversion Attack on Graph Neural Networks

Using Highly Compressed Gradients in Federated Learning for Data Reconstruction Attacks

Understanding Training-Data Leakage from Gradients in Neural Networks for Image Classification

AFGI: Towards Accurate and Fast-convergent Gradient Inversion Attack in Federated Learning

Evaluating Gradient Inversion Attacks and Defenses in Federated Learning

Fast Generation-Based Gradient Leakage Attacks: An Approach to Generate Training Data Directly From the Gradient

SPEAR:Exact Gradient Inversion of Batches in Federated Learning

E2EGI: End-to-End Gradient Inversion in Federated Learning

Temporal Gradient Inversion Attacks with Robust Optimization

Targeted Defense Against Neuron-Exclusivity-Based Gradient Inversion Attack in Federated Learning