Evaluating Gradient Inversion Attacks and Defenses in Federated Learning

By Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, Sanjeev Arora. Neural Information Processing Systems, 2021

391 citations recorded by the source corpus.

Gradient inversion attack (or input recovery from gradient) is an emerging threat to the security and privacy preservation of Federated learning, whereby malicious eavesdroppers or participants in the protocol can recover (partially) the clients' private data. This paper evaluates existing attacks and defenses. We find that some attacks make strong assumptions about the setup. Relaxing such assumptions can substantially weaken these attacks. We then evaluate the benefits of three proposed defense mechanisms against gradient inversion attacks. We show the trade-offs of privacy leakage and data utility of these defense methods, and find that combining them in an appropriate manner makes the attack less effective, even under the original strong assumptions. We also estimate the computation cost of end-to-end recovery of a single image under each evaluated defense. Our findings suggest that the state-of-the-art attacks can currently be defended against with minor data utility loss, as summarized in a list of potential strategies. Our code is available at: https://github.com/Princeton-SysML/GradAttack.

Subfields: Artificial Intelligence, Ocean Engineering

View Paper: https://www.semanticscholar.org/paper/98dabedfbab42072b2bc62282ab48eb6ff6026dc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Ocean Engineering

Citations in the corpus

Transformers in Medical Imaging: A Survey (2022, background): “An interesting future direction is to explore recent privacy enhancement approaches like differential privacy [427] to prevent gradient inversion attacks [428] on FL-based medical imaging systems in the context of ViTs.”
Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, methodology): “Throughout this survey, we will interchangeably use participants/clients/users to represent the participants in FL.”