See through Gradients: Image Batch Recovery via GradInversion

By Hongxu Yin, Arun Mallya, Arash Vahdat, José Manuel Álvarez, Jan Kautz, Pavlo Molchanov. Computer Vision and Pattern Recognition, 2021

618 citations recorded by the source corpus.

Training deep neural networks requires gradient estimation from data batches to update parameters. Gradients per parameter are averaged over a set of data and this has been presumed to be safe for privacy-preserving training in joint, collaborative, and federated learning applications. Prior work only showed the possibility of recovering input data given gradients under very restrictive conditions – a single input point, or a network with no non-linearities, or a small 32 × 32 px input batch. Therefore, averaging gradients over larger batches was thought to be safe. In this work, we introduce GradInversion, using which input images from a larger batch (8 – 48 images) can also be recovered for large networks such as ResNets (50 layers), on complex datasets such as ImageNet (1000 classes, 224 × 224 px). We formulate an optimization task that converts random noise into natural images, matching gradients while regularizing image fidelity. We also propose an algorithm for target class label recovery given gradients. We further propose a group consistency regularization framework, where multiple agents starting from different random seeds work together to find an enhanced reconstruction of the original data batch. We show that gradients encode a surprisingly large amount of information, such that all the individual images can be recovered with high fidelity via GradInversion, even for complex datasets, deep networks, and large batch sizes.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/0fd50e1483f761ba2bae44de54c5e8db6e35de5a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Deep Neural Networks are Surprisingly Reversible: A Baseline for Zero-Shot Inversion (2021, result): “This is consistent with the recent ﬁndings in [99].”
Evaluating Gradient Inversion Attacks and Defenses in Federated Learning (2021, methodology): “…was thought to leak little information about the client’s private data, recent papers [Zhu et al., 2019, Zhao et al., 2020, Geiping et al., 2020, Yin et al., 2021] developed a “gradient inversion attack” by which an attacker eavesdropping on a client’s communications with the server can begin…”