PaperlayerView exact revision on arXiv

Source-linked AI summary

See through Gradients: Image Batch Recovery via GradInversion

Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M. Alvarez, Jan Kautz, Pavlo Molchanov

arXiv:2104.07586v1cs.LGcs.CV

TL;DR

Whether batch-averaged gradients leak private training data remained an open question for privacy-preserving federated learning. GradInversion optimizes images initialized from random noise to match batch-averaged gradients, using label restoration and group-consistency regularization to improve reconstruction. A non-learning-based image recovery method enables full, high-fidelity recovery of individual 224 × 224 px images by inverting batch gradients, even at batch sizes up to 48.

  • Problem

    Whether batch-averaged gradients leak private training data remained an open question for privacy-preserving federated learning.

    Source: §1 · p. 1

  • Method

    GradInversion optimizes images initialized from random noise to match batch-averaged gradients, using label restoration and group-consistency regularization to improve reconstruction.

    Source: §1 · p. 2

  • Results

    A non-learning-based image recovery method enables full, high-fidelity recovery of individual 224 × 224 px images by inverting batch gradients, even at batch sizes up to 48.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Sharing averaged gradients from deep networks on complex datasets does not ensure privacy, even at large batch sizes.

    Source: Conclusions · p. 8

    The underlying mechanism of information transfer that enables original data recovery from gradients remains to be studied.

    Source: Conclusions · p. 8

Abstract

from arXiv · show

Training deep neural networks requires gradient estimation from data batches to update parameters. Gradients per parameter are averaged over a set of data and this has been presumed to be safe for privacy-preserving training in joint, collaborative, and federated learning applications. Prior work only showed the possibility of recovering input data given gradients under very restrictive conditions - a single input point, or a network with no non-linearities, or a small 32x32 px input batch. Therefore, averaging gradients over larger batches was thought to be safe. In this work, we introduce GradInversion, using which input images from a larger batch (8 - 48 images) can also be recovered for large networks such as ResNets (50 layers), on complex datasets such as ImageNet (1000 classes, 224x224 px). We formulate an optimization task that converts random noise into natural images, matching gradients while regularizing image fidelity. We also propose an algorithm for target class label recovery given gradients. We further propose a group consistency regularization framework, where multiple agents starting from different random seeds work together to find an enhanced reconstruction of original data batch. We show that gradients encode a surprisingly large amount of information, such that all the individual images can be recovered with high fidelity via GradInversion, even for complex datasets, deep networks, and large batch sizes.

1. Introduction

GradInversion recovers high-fidelity individual 224 × 224 px images from batch-averaged gradients, including batches of up to 48 images. It combines gradient-matching image optimization with label restoration and multi-seed group consistency regularization.

  • Although gradient sharing supports collaborative, distributed, and federated learning, gradients can reveal private training data, and high-resolution ImageNet recovery beyond batch size one had remained elusive.Source: §1 · pp. 1–2
  • GradInversion optimizes noisy inputs to match client-provided gradients while regularizing image realism, building on DeepInversion.Source: §1 · p. 2
  • A one-shot label-restoration algorithm uses last fully connected layer gradients to recover each batch example’s ground-truth label.Source: §1 · p. 2
  • Multi-seed optimization registers candidate images and penalizes deviations from their registered mean, improving recovery despite differing minima and spatial arrangements.Source: §1 · p. 2
  • A non-learning-based image-recovery method makes high-fidelity, visually detailed recovery of individual 224 × 224 px images feasible by inverting batch gradients, even for batch sizes up to 48 images.Source: §1 · p. 2
  • The paper introduces Image Identifiability Precision to measure inversion ease across batch sizes and identify samples vulnerable to inversion.Source: §1 · p. 2

2. Related Work

Prior work explored image generation from GANs and pretrained networks, as well as gradient-based inversion. Exact image recovery from gradients had advanced to single images on ImageNet, but remained difficult for averaged gradients from batches.

Related Work

  • GANs [16] [36] [38] achieved state-of-the-art image modeling, including BigGAN-deep on ImageNet [4], but generator training requires original data; pretrained-model GAN training [6] [34] yielded less detailed, less perceptually similar images.Source: §2 · p. 2
  • Security work inverted pretrained networks: Fredrikson et al. optimized inputs using model gradients, while follow-ups [47] remained limited to shallow networks and Secret Revealer scaled to modern architectures on less diverse datasets.Secret Revealer used auxiliary-dataset priors and GANs to guide inversion, with examples including MNIST and face recognition.Source: §2 · p. 2
  • Network visualization methods synthesized natural pre-images [30] [31], and global generative priors [39] and Plug & Play [38] improved inversion diversity and quality, but relied on auxiliary data, feature embeddings, or altered training.Source: §2 · p. 2
  • Auxiliary-free image synthesis from pretrained classifiers progressed from Deep-Dream and Saturkar et al. [42] to extensions [5] that improved performance without extra training but relied on batch-normalization statistics.Source: §2 · p. 2
  • Earlier gradient-inversion studies inferred proxy information such as training-sample existence or sample properties [21], primarily using very shallow networks.Source: §2 · p. 3
  • Prior exact gradient inversion progressed from theoretical single-neuron or single-layer feasibility and single-image recovery with a 4-layer network to deeper architectures [53], but struggled with ImageNet batches.Zhu et al. required continuous models without strides and scaled only to low-resolution CIFAR; Geiping et al. reconstructed single images, not batches.Source: §2 · p. 3

3. GradInversion

GradInversion optimizes a noisy synthetic batch to match observed gradients, while using auxiliary losses for image fidelity and group consistency. It also estimates batch labels from gradients to support reconstruction.

3.1. Objective Function

  • GradInversion optimizes a random-noise input batch to match the supplied gradients, adding auxiliary image-fidelity and group-consistency regularization.Gradient matching minimizes layer-wise ℓ2 distances between gradients from the synthetic and ground-truth data.Source: §3.1 · p. 3

3.2. Batch Label Restoration

  • For nonrepeating-label batches, labels are estimated from negative feature-wise minima of the batch-averaged fully connected gradients.With nonnegative final-layer features, true-label logit gradients are negative; taking minima helps preserve negative signs, and the method assumes labels do not repeat within a batch.Source: §3.2 · pp. 3–4

3.3. Fidelity (Realism) Regularization

  • Image-fidelity regularization combines total-variation and ℓ2 priors with DeepInversion batch-normalization statistics to encourage realistic reconstructions.The batch-normalization prior matches feature-map means and variances at convolutional layers.Source: §3.3 · p. 4

3.4. Group Consistency Regularization

  • Group consistency jointly optimizes reconstructions from different seeds, penalizing candidates against a consensus built from a pixel mean, registration, and a post-registration mean.The authors use RANSAC-flow [43] for registration; different seeds can produce semantically correct but spatially shifted local minima.Source: §3.4 · pp. 4–5

3.5. The Final Update

  • Each optimization update adds pixel-wise random Gaussian noise to the optimizer step to encourage exploration and diversity.The update uses a learning rate and rescales the added noise; the noise is inspired by Langevin updates [15].Source: §3.5 · p. 5

4. Experiments

The experiments evaluate gradient-based label restoration and image-batch reconstruction on ImageNet, then examine reconstruction methods and how recovery changes with batch size.

4.1.1 Label restoration

  • Zero-shot GradInversion restores ImageNet training- and validation-set labels accurately across batch sizes, improving on prior art [53] over 10K random samples.Table 1 summarizes average label-restoration accuracy for samples divided into varying batch sizes.Source: §4.1.1 · p. 5, Table 1 · p. 6

4.1.2 Batch reconstruction

  • ℓ2 gradient matching outperforms cosine similarity, and adding fidelity regularization improves reconstruction quality both visually and quantitatively.These ablations use batches of 8 images.Source: §4.1.2 · pp. 5–6, Table 2 · p. 6
  • Group consistency improves reconstruction, with registration-based regularization improving all evaluation metrics; stronger feature extraction also yields better reconstruction, led by self-supervised ResNet-50.The method jointly optimizes 8 random-seed initializations; registration begins after 5K iterations and repeats every 100 iterations.Source: §4.1.2 · p. 6, Table 3 · p. 6

4.3. Effect of scaling up the batch size

  • Recovery gradually decreases as batch size grows, yet GradInversion still reveals substantial original visual information at batch size 48, sometimes yielding a viable complete reconstruction.The analysis scales to batches of 48 using a 32GB NVIDIA V100 GPU.Source: §4.3 · p. 7, Figure 6 · p. 8, Figure 7 · p. 8

4.2. Comparison with the state-of-the-art

  • For ResNet-50 gradient inversion on ImageNet1K, GradInversion outperforms prior art visually and numerically; DeepInversion has little observable link to originals, while BigGAN projection misses visual details.Source: §4.2 · p. 7, Table 4 · p. 8

4.3. Effect of scaling up the batch size

  • 28% of samples remain correctly identifiable after gradients are averaged across 48 images, and vulnerable-population batches nearly double IIP at that batch size.IIP is the fraction of exact matches between an original image and the nearest neighbor to its reconstruction; higher-gradient-norm images were more vulnerable.Source: §4.3 · p. 8, Figure 8 · p. 8

Conclusions

GradInversion reconstructs individual images from averaged gradients, showing that sharing gradients from deep networks on complex datasets does not ensure privacy, even at large batch sizes. The conclusions call for studying gradient-based information transfer and strengthening aggregation-based federated learning against inversion.

Conclusions

  • GradInversion reconstructs individual images from averaged gradients, showing that gradient sharing does not ensure privacy for deep networks on complex datasets, even at large batch sizes.The findings offer new insights for developing privacy-preserving deep learning frameworks.Source: Conclusions · p. 8
  • Future work should study how gradients enable data recovery and investigate vulnerabilities in aggregation-based federated learning, while strengthening defenses against inversion.The authors identify the underlying information-transfer mechanism as another fruitful research direction.Source: Conclusions · p. 8

Appendix A - More Examples

Appendix A provides additional examples of information leakage from ResNet-50 gradients on ImageNet validation samples.

Appendix A - More Examples

  • Figure 9 pairs each ImageNet validation sample with its GradInversion reconstruction from ResNet-50 gradients.Each block shows the original on the left and the reconstruction on the right.Source: Figure 9 · p. 11

Appendix B - Ablation Studies Images

The ablation visual shows progressively better-looking reconstructions as fidelity and regularization terms are added, with group-based image-registration regularization producing the best-looking outputs.

Appendix B - Ablation Studies Images

  • Group-based image-registration regularization produces the best-looking outputs, following improvements from fidelity loss and multiple seeds with mean-image regularization over gradient loss alone.Starting from noise, gradient loss produces noisy outputs that begin to reveal image content; fidelity loss encourages more realistic outputs.Source: Figure 10 · p. 12

Appendix C - Additional Details & Analysis

The appendix reports that ℓ2 loss converges more strongly for gradient matching and describes reconstruction limitations under a specific ResNet-50/ImageNet1K setup. It cautions that these observations may not generalize beyond the chosen network and optimization settings.

Lgrad cost function

  • ℓ2 loss yields stronger convergence than cosine similarity for gradient matching, assessed by ℓ2 distance, gradient-sign match percentage, and cosine similarity.Table 5 compares these three measures between the losses; the supplied passages do not give their numerical values.Source: Appendix C · p. 13, Table 5 · p. 13

Insights & open challenges

  • The reported observations concern GradInversion on ResNet-50 (MOCO V2) and ImageNet1K, and may not generalize beyond the chosen network and optimization settings.The authors present them as experience intended to provide insights for future work.Source: Appendix C · p. 13
  • Recovered images sometimes omit original details, with a diver and bird disappearing in examples, echoing missing details during StyleGAN2 latent-code projection.The appendix describes this as an occasional observation.Source: Appendix C · p. 13, Figure 11 · p. 13
  • GradInversion can reveal the presence of text and digits, but their exact details remain blurry.The appendix points to quick examples in Figure 11(b).Source: Appendix C · p. 13, Figure 11 · p. 13
  • ImageNet human-face samples are harder to recover: features such as eyes, noses, and mouths may appear but are spatially misarranged, a challenge also noted for BigGAN [4].The authors conjecture that this reflects ImageNet1K under-representation of faces and the classifier's lack of focus on spatial alignment; other tasks, such as facial recognition, may differ.Source: Appendix C · p. 13, Figure 11 · p. 13

Related papers

Loading 2104.07586v1…