iDLG: Improved Deep Leakage from Gradients

By Bo Zhao, Konda Reddy Mopuri, Hakan Bilen. 2020

844 citations recorded by the source corpus.

It is widely believed that sharing gradients will not leak private training data in distributed learning systems such as Collaborative Learning and Federated Learning, etc. Recently, Zhu et al. presented an approach which shows the possibility to obtain private training data from the publicly shared gradients. In their Deep Leakage from Gradient (DLG) method, they synthesize the dummy data and corresponding labels with the supervision of shared gradients. However, DLG has difficulty in convergence and discovering the ground-truth labels consistently. In this paper, we find that sharing gradients definitely leaks the ground-truth labels. We propose a simple but reliable approach to extract accurate data from the gradients. Particularly, our approach can certainly extract the ground-truth labels as opposed to DLG, hence we name it Improved DLG (iDLG). Our approach is valid for any differentiable model trained with cross-entropy loss over one-hot labels. We mathematically illustrate how our method can extract ground-truth labels from the gradients and empirically demonstrate the advantages over DLG.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Qiang Yang
2. Lingjuan Lyu
3. Lichao Sun
4. Philip S. Yu
5. Han Yu
6. Jiankun Hu
7. Yanming Zhu
8. Xuefei Yin

Citations in the corpus

• Federated Class-Incremental Learning (2022, methodology): “For the n-th element ∇Γn of ∇Γ, we can obtain its corresponding ground-truth label y n (with one-hot encoding label y n) via observing the gradient symbol of the last layer in ∇Γn (proposed in [46, 58]).”
• Dataset Condensation with Gradient Matching (2020, methodology): “Finally our method is related to the methods that produce image patches by projecting the feature activations back to the input pixel space (Zeiler & Fergus, 2014), reconstruct the input image by matching the feature activations (Mahendran & Vedaldi, 2015), recover private training images for given ”
• LotteryFL: Personalized and Communication-Efficient Federated Learning with Lottery Ticket Hypothesis on Non-IID Datasets (2020, background): “However, some works [23, 24] have shown that it is feasible to recover the private training data by eavesdropping the data communicated between the clients and the server.”
• FedPD: A Federated Learning Framework With Adaptivity to Non-IID Data (2020, background): “This is undesirable, as it has been shown that local gradient information can leak private data [19].”
• Evaluating Gradient Inversion Attacks and Defenses in Federated Learning (2021, background): “A follow-up [Zhao et al., 2020] proposes a simple approach to extract the ground-truth labels from the gradient, which improves the attack but still cannot overcome its limitations.”
• Inverting Gradients - How easy is it to break privacy in federated learning? (2020, methodology): “Recent works on privacy attacks in federated learning setups ([25, 24, 31, 35, 34]) have hinted at the fact that previous hopes that “Privacy is enhanced by the ephemeral and focused nature of the [Federated Learning] updates” [3] are not true in general.”
• End-to-end privacy preserving deep learning on multi-institutional medical imaging (2021, methodology): “…that attempt to expose sensitive data, we employ the Improved Deep Leakage from Gradients, iDLG, method with modifications as proposed previously 32 , itself a variant of previously shownn techniques 31,62 . iDLG was found highly successful against the ResNet18 architecture used in our case study.”
• A Framework for Evaluating Gradient Leakage Attacks in Federated Learning (2020, methodology): “Gradient leakage attacks, formulated in CPL of different forms, or those in literature [10,45,43], are one type of privacy exploits in the training phase.”
• FLOP: Federated Learning on Medical Datasets using Partial Networks (2021, background): “Recent empirical results in [41] show that sharing a model may not fully protect the privacy and gradients exchange will cause Deep Leakage [9, 38, 41].”
• See through Gradients: Image Batch Recovery via GradInversion (2021, methodology): “[53] extend the approach with a label restoration step, hence improving speed of single image reconstruction.”
• A Comprehensive Survey of Privacy-preserving Federated Learning (2021, methodology): “First, because the malicious server maintains the intermediate updates and the final model, the server can utilize those information to reconstruction attacks [223].”
• Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, background): “They also propose a new attack which combines the attacks proposed in [12, 62].”
• Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, methodology): “For DLG [20] and iDLG [23], both works: (1) adopted a second-order optimization method called L-BFGS, which is more computationally expensive compared with first-order optimization methods; (2) are only applicable to gradients computed on mini-batches of data, i.”
• Threats to Federated Learning: A Survey (2020, methodology): “[ Zhao et al. , 2020] presented an analytical approach called Improved Deep Leakage from Gradient (iDLG), which can certainly extract labels from the shared gradients by exploiting the relationship between the labels and the signs of corresponding gradients. iDLG is valid for any differentiable…”