PaperlayerView exact revision on arXiv

Source-linked AI summary

GRNN: Generative Regression Neural Network -- A Data Leakage Attack for Federated Learning

Hanchi Ren, Jingjing Deng, Xianghua Xie

arXiv:2105.00529v3cs.LGcs.CRcs.CV

TL;DR

Shared FL gradients can expose private training data, motivating an attack that generates images and labels by matching generated-data gradients to shared gradients. The authors report that GRNN outperforms prior methods across attack success, fidelity, label inference, and stability, and demonstrate leakage in face re-identification.

  • Problem

    Although FL avoids directly accessing private training data, shared gradients can reveal dataset properties or support recovery of training images.

    Source: §1 · p. 2

  • Method

    GRNN uses two generative branches to produce fake images and labels, optimizing their gradients to match the true shared gradient.

    Source: §1 · p. 2, §3.2 · pp. 5–7

  • Results

    GRNN is reported to outperform state-of-the-art methods in attack success, recovered-data fidelity, label-inference accuracy, and stability as batch size and input resolution vary.

    Source: §1 · p. 2

  • Takeaways & Limitations

    In a face re-identification experiment, images generated by GRNN achieve higher Top-1, Top-3, and Top-5 accuracies than state-of-the-art methods.

    Source: §1 · p. 2

    The attack assumes access to the global-model architecture and parameters and uses the same label set as the FL system.

    Source: §3.2 · pp. 5–6

Abstract

from arXiv · show

Data privacy has become an increasingly important issue in Machine Learning (ML), where many approaches have been developed to tackle this challenge, e.g. cryptography (Homomorphic Encryption (HE), Differential Privacy (DP), etc.) and collaborative training (Secure Multi-Party Computation (MPC), Distributed Learning and Federated Learning (FL)). These techniques have a particular focus on data encryption or secure local computation. They transfer the intermediate information to the third party to compute the final result. Gradient exchanging is commonly considered to be a secure way of training a robust model collaboratively in Deep Learning (DL). However, recent researches have demonstrated that sensitive information can be recovered from the shared gradient. Generative Adversarial Network (GAN), in particular, has shown to be effective in recovering such information. However, GAN based techniques require additional information, such as class labels which are generally unavailable for privacy-preserved learning. In this paper, we show that, in the FL system, image-based privacy data can be easily recovered in full from the shared gradient only via our proposed Generative Regression Neural Network (GRNN). We formulate the attack to be a regression problem and optimize two branches of the generative model by minimizing the distance between gradients. We evaluate our method on several image classification tasks. The results illustrate that our proposed GRNN outperforms state-of-the-art methods with better stability, stronger robustness, and higher accuracy. It also has no convergence requirement to the global FL model. Moreover, we demonstrate information leakage using face re-identification. Some defense strategies are also discussed in this work.

1 INTRODUCTION

GRNN targets the privacy risk that shared FL gradients can reveal training data, introducing a two-branch attack that generates images and labels by matching fake gradients to shared gradients. The paper reports stronger attack performance and stability than prior methods.

1 INTRODUCTION

  • Prior gradient-recovery methods have reported instability and sensitivity to batch size or resolution; IG recovers high-resolution images with large batches, but its success rate is described as relatively low.The cited prior approaches include DLG-based methods [47] [48] and IG [13].Source: §1 · p. 2
  • FL avoids direct access to private training data by sharing gradients instead, but prior studies show that shared gradients can reveal dataset properties or support image generation.The introduction also frames centralized training as infeasible for some data owners because of privacy requirements and unwillingness or inability to share private data.Source: §1 · pp. 1–2
  • Two generative branches produce fake training images and labels, optimized end-to-end to match gradients computed from generated data with the true shared gradient.The method uses MSE, Wasserstein Distance, and Total Variation Loss to measure or constrain the gradient and image differences.Source: §1 · p. 2
  • GRNN recovers private images up to 256×256 resolution and batch size 256, with corresponding labels, and is reported to outperform prior methods in attack success, data fidelity, label accuracy, and stability.The reported stability advantage concerns changes in training-batch size and input resolution.Source: §1 · p. 2

2 RELATED WORK

Related work includes label-conditioned GAN recovery, gradient-matching approaches that reconstruct inputs, and cryptographic methods that protect shared gradients. The paper positions GRNN among these recovery methods and also discusses noise addition as a defense.

2 RELATED WORK

  • Hitaj et al.’s GAN method [21] generates data resembling the training distribution from a specified class, but generated images lack explicit correspondence to training examples and are sensitive to data variance.The method uses a trained participant model as a discriminator and optimizes image confidence for the specified class.Source: §2 · p. 3
  • DLG and iDLG [47] [48] and IG [13] recover inputs by optimizing against gradients or prediction changes; the paper contrasts their approaches with GRNN’s generative method.The related-work discussion describes DLG instability and label-inference issues, while IG uses cosine distance and reports recognizable high-resolution recovery with large batches.Source: §2 · p. 3
  • Cryptographic defenses include secure aggregation [5], HE, and DP [7]; gradient encryption can allow aggregation on encrypted gradients, while the paper evaluates GRNN against noise addition.The passage notes computational expense and that encrypted image formats may not preserve visual-pattern consistency.Source: §2 · pp. 3–4

3 PROPOSED METHOD

GRNN frames gradient-based data recovery as generation guided by shared gradients, targeting stability, large batches, and high-resolution fidelity. In the federated setting, it uses paired image and label generators whose outputs are optimized to approximate the gradients available at the server.

3 PROPOSED METHOD

  • GRNN addresses instability, large-batch recovery, and high-resolution fidelity by generating data guided by gradient information rather than treating recovery only as high-dimensional fitting.The authors describe this as enabling stable, high-fidelity recovery from gradients shared between clients and the server.Source: §3 · p. 4

3.1 Federated Learning

  • Federated Averaging trains clients with parallel SGD steps and periodically averages their model updates at a central server.The FL system consists of multiple clients and one parameter server, where locally calculated gradients are aggregated.Source: §3.1 · pp. 4–5

3.2 GRNN: Data Leakage Attack

  • GRNN uses a shared latent input to generate paired fake images and labels, separating the tied representation to recover local training data from the shared gradient.The image branch uses progressive upsampling, while the label branch uses a fully connected layer followed by softmax.Source: §3.2 · p. 6
  • GRNN trains both generators by matching fake gradients to the shared gradient, combining MSE and Wasserstein distance with image total-variation smoothness regularization.The loss weights MSE and Wasserstein distance equally; the smoothness weight is α.Source: §3.2 · pp. 6–7

4.1 Dataset and Experimental Setting

The evaluation covers digit recognition, image classification, and face recognition using four public benchmarks. LeNet and ResNet-18 serve as classifier backbones, with the implementation configured for second-order differentiability.

4.1 Dataset and Experimental Setting

  • Experiments cover MNIST, CIFAR-100, LFW, and VGG-Face across digit recognition, image classification, and face recognition tasks.The datasets include 7,000 MNIST images, 60,000 CIFAR-100 images across 100 categories, 13,233 LFW images across 5,749 identities, and over 2.6 million VGG-Face images across 2,622 identities.Source: §4.1 · p. 7
  • LeNet and ResNet-18 are the backbone networks used to train the federated image classifiers.The neural network models are implemented in PyTorch.Source: §4.1 · p. 7
  • Table 3 presents examples of GRNN data leakage attacks on a global model trained for one iteration.Its middle column shows images recovered from the true gradient.Source: Table 3 · p. 8
  • The implementation replaces ReLU with Sigmoid to ensure second-order differentiability, and uses RMSprop at a learning rate of 0.0001 with momentum 0.99.The authors also state that ReLU can be used with a second-order differentiable approximation, at greater computational cost than Sigmoid.Source: §4.1 · p. 8

4.2 Image Recovery

GRNN recovers images from shared gradients across larger batches and different model-convergence states, and the authors report stronger attack success and image fidelity than DLG on several comparisons. Its experiments also examine higher image resolutions and alternative loss combinations.

4.2 Image Recovery

  • GRNN recovers images from both non-converged and converged global models, although converged-model results are generally worse; MNIST with ResNet-18 is an exception at 42.70 dB versus 43.40 dB.The attack uses the true gradient obtained at the first global-model iteration.Source: §4.2 · pp. 8–9
  • On non-converged models, GRNN's PSNR is +1.45% on MNIST and +0.52% on LFW, but -1.01% on CIFAR-100 versus DLG; DLG fails on ResNet-18.For batch size 1, the authors also describe GRNN as preserving coarse appearance before filling in finer object details.Source: Table 5 · p. 10, §4.2 · p. 10

4.2.1 Ablation Study on Batch Size.

  • GRNN recovers MNIST through batch size 256 and CIFAR-100/LFW through 64/128, while DLG fails above batch size 8 on MNIST and beyond batch size 1 on CIFAR-100/LFW.The authors also report successful GRNN attacks on complex models such as ResNet-18.Source: §4.2.1 · pp. 10, 12

4.2 Image Recovery

  • At batch sizes 4 and 8, DLG works only on MNIST and fails on CIFAR-100/LFW; at batch size 16 it fails on all datasets, while GRNN recovers images consistently.Fig. 3 plots image-similarity metrics against attack-model training iterations across three datasets.Source: §4.2 · pp. 9–10, Figure 3 · p. 11

4.2.2 Ablation Study on Success Rate.

  • At success rate 0.6, GRNN's MSE threshold is around 0.05 versus DLG's 0.17; at SSIM threshold 0.2, GRNN's worst success rate exceeds 0.77.DLG's rate at that SSIM threshold is around 0.7 for batch size 1 and drops to 0 for most other batch sizes.Source: §4.2.2 · p. 13, Figure 5 · p. 15

4.2.3 Ablation Study on Image Resolution.

  • On CIFAR-100 with ResNet-18, GRNN recovers 64×64 images at batch size 8 and 128×128/256×256 images at batch size 1; at 256×256 it outperforms IG on SSIM.The authors say GRNN can retain global structure and color appearance with a large batch, while IG can produce virtually unrecognizable images.Source: §4.2.3 · pp. 13, 15, Table 10 · p. 15
  • Among tested loss combinations, MSE, WD, and TVLoss together perform best; the authors say WD and TVLoss jointly penalize spurious noise locally and globally.WD measures geometric discrepancy between fake and true gradients to guide image generation.Source: §4.2.4 · p. 15

4.3 Label Inference

GRNN generally infers labels more accurately than DLG, with especially strong results at larger batch sizes and on ResNet-18. The authors also report that dataset class count relates to DLG accuracy and propose a joint-latent-space explanation for GRNN's pattern.

4.3 Label Inference

  • GRNN beats DLG in all label-inference experiments except MNIST at batch size 8; on LFW with LeNet at batch size 256, it reaches 99.84% versus DLG's 79.69%.The authors report a significantly larger GRNN advantage at large batch sizes.Source: §4.3 · pp. 15–16
  • ResNet-18 label accuracy is 100% in almost all experiments, except LFW at batch size 32 (94.06%), and is higher and more stable than LeNet.The authors attribute this to ResNet-18 having more trainable parameters and a more informative gradient for finding classification decision boundaries.Source: §4.3 · p. 16
  • DLG's average accuracy falls from 94.23% on 10-class MNIST to 93.51% on 100-class CIFAR-100 and 85.41% on 5,749-class LFW, while GRNN is more accurate on LFW than on the other datasets.The authors suggest GRNN's image and label generators capture image-label correspondence in a joint latent space.Source: §4.3 · p. 16

4.4 Face Re-Identification

The face re-identification experiment tests whether recovered VGG-Face images can identify their source identities. GRNN's recovered faces outperform DLG in reported accuracy comparisons, although recovery quality and re-identification accuracy decline as batch size grows.

4.4 Face Re-Identification

  • At batch size 1, Top-1 accuracy is 30.66% with ResNet-18 and 11.46% with DenseNet-121, both above the 1% random-prediction rate.Top-3 and Top-5 accuracy are higher, while re-identification accuracy declines as batch size increases.Source: §4.4 · p. 18, Table 15 · p. 19
  • The experiment uses the 100 most-sampled identities from a 2,622-identity VGG-Face dataset and counts re-identification as successful when prediction matches the true identity.GRNN recovered 700, 1,112, 2,224, and 4,352 face images at batch sizes 1, 4, 8, and 16, respectively.Source: §4.4 · pp. 17–18
  • For ResNet-18, GRNN improves on DLG by +5.52%, +29.22%, and +36.54% in Top-1, Top-3, and Top-5 re-identification accuracy.The experiment uses recovered faces from VGG-Face and reports results for ResNet-18 and DenseNet-121 recognition models.Source: §4.4 · p. 19, Table 15 · p. 19

4.5 Defense Strategy

The authors evaluate Gaussian and Laplacian noise added to shared gradients as a defense against GRNN. Noise reduces image quality, but GRNN can still recover images at some tested noise levels and infer labels even when image recovery fails.

4.5 Defense Strategy

  • At noise scale 1e-2, GRNN still recovers images with reasonable results; high noise levels cause recovery failure but also usually harm the global FL model's performance.The study varies Gaussian noise standard deviation and Laplacian parameter ε from 1e-1 to 1e-4.Source: §4.5 · p. 20
  • GRNN can infer labels correctly even when image recovery fails, whereas DLG fails to recover images and infer labels in all tested noise experiments.The noise defense adds Gaussian or Laplacian randomness to shared gradients.Source: §4.5 · p. 20
  • Noise generally lowers recovered-image PSNR, but at Gaussian scale 1e-4 MNIST scores 52.51 dB versus 52.37 dB without noise, and LFW scores 46.26 dB versus 45.57 dB.Table 17 reports average PSNR by noise type and scale.Source: §4.5 · p. 20, Table 17 · p. 21

5 CONCLUSION

GRNN recovers private data and corresponding labels in federated learning, with reported stability at larger resolutions and batch sizes. The conclusion also reports better recovery fidelity and label inference, plus results on face re-identification and noisy gradients.

5 CONCLUSION

  • GRNN is reported as more stable at large resolutions and batch sizes, and as outperforming state-of-the-art methods in recovery fidelity and label-inference accuracy.The conclusion describes the attack as recovering both private data and corresponding labels.Source: §5 · pp. 21–22
  • Fig. 6 presents MSE distances during attack-model training and generated images across three datasets for Gaussian and Laplacian noise at different scales.Its horizontal axis is the number of attack-model training iterations.Source: Figure 6 · p. 22
  • Face re-identification results show GRNN outperforming DLG on Top-1, Top-3, and Top-5 accuracies.The conclusion also reports successful, consistent data recovery when high levels of noise are added to gradients.Source: §5 · p. 23
Loading 2105.00529v3…