PaperlayerView exact revision on arXiv

Source-linked AI summary

A Path Integral Surrogate for Multi-Step Gradient Inversion in Federated Learning

Agnivo Ghosh, Saumik Bhattacharya

arXiv:2610.03597v1cs.LGcs.DC

TL;DR

Gradient inversion seeks to recover private inputs from updates shared in federated learning, but FedAvg updates accumulate gradients across hidden local steps and recent surrogate attacks sample only one path point. PI-SME approximates the update's path integral with multi-node quadrature along a learnable Bézier path. It outperforms the strongest surrogate baseline across CIFAR-100 and FEMNIST settings and reconstruction metrics.

  • Problem

    FedAvg updates accumulate gradients over hidden local steps, while recent surrogate attacks match them using a gradient evaluated at a single path point.

    Source: §1 · p. 1

  • Method

    PI-SME approximates the accumulated update as a path integral using Gauss–Legendre quadrature over several nodes along a learnable Bézier path.

    Source: §1 · p. 1, §3 · p. 2, §3.1 · p. 2

  • Results

    PI-SME improves over NL-SME in every reported setting and metric; CIFAR-100 PSNR gains are about 0.8 dB at T=100 and about 3 dB at T=250.

    Source: §1 · p. 1, §4.1 · p. 3

  • Takeaways & Limitations

    PI-SME's margin over NL-SME widens as trajectories lengthen and batches span fewer classes, where the single-point approximation is weaker.

    Source: §6 · p. 4

Abstract

from arXiv · show

Federated learning lets many clients train a shared model together without ever sending their private data to a central server. Each client shares only a model update, and this update should reveal far less about the client than its raw training examples would. This premise is what protects the privacy of the clients. Gradient inversion attacks challenge it directly by trying to reconstruct a client's private input images from the single update it shared. Under FedAvg, a client's update accumulates several local training steps, so the server sees only the two endpoints of a hidden weight trajectory. Recent gradient inversion attacks fit a surrogate model along the path between these two endpoints but they still read its gradient at a single point. We propose the Path-Integral Surrogate Model Extension (PI-SME) which treats the accumulated update as a path integral of the gradient field and approximates it by Gauss--Legendre quadrature over several nodes along a learnable B\'ezier path. On CIFAR-100 and FEMNIST images across a range of trajectory lengths and class-restricted batches PI-SME reconstructs the private inputs more faithfully than the strongest surrogate baseline on several inversion metrics and the matching loss.

1. INTRODUCTION

FedAvg shares updates accumulated over several local training steps, while gradient inversion attacks seek to reconstruct private inputs from those updates. PI-SME models the update as a path integral and reports better reconstruction than the strongest surrogate baseline on CIFAR-100 and FEMNIST.

1. INTRODUCTION

  • Federated learning keeps raw client samples on-device, and FedAvg aggregates client models after several local SGD steps.Secure aggregation and differential privacy are also cited as defenses supporting this privacy goal.Source: §1 · p. 1
  • Gradient inversion attacks reconstruct private inputs from shared updates, while recent surrogate attacks still evaluate the fitted path's gradient at only one point.FedAvg exposes only the initial and returned model endpoints after multiple local steps.Source: §1 · p. 1
  • PI-SME improves over the strongest surrogate baseline across all reconstruction metrics on CIFAR-100 and FEMNIST, with the largest gains on long trajectories and class-scarce batches.The approach treats the accumulated update as a path integral and approximates it with multi-node Gauss–Legendre quadrature along a learnable Bézier path.Source: §1 · p. 1

2. BACKGROUND AND RELATED WORK

FedAvg produces an update from multiple local steps, although the server observes only the initial and final models. Surrogate attacks fit a path between those endpoints but match the update using a gradient from a single path state.

2.1. Multi-step updates in FedAvg

  • The server sees only the initial and final models, while the intermediate states of the client's T local SGD steps remain hidden.The returned update is a sum of gradients at the T states preceding each step, and its direction is the mean gradient along the trajectory.Source: §2.1 · pp. 1–2
  • A single-step attack evaluated at the initial model mismatches the accumulated update, and the mismatch grows with T.The update sums gradients evaluated at distinct states along the local trajectory.Source: §2.1 · p. 2

2.2. Surrogate-model attacks

  • SME fits a surrogate on the line between observed endpoints, whereas NL-SME uses a quadratic Bézier curve; both match a gradient from one path state.NL-SME also learns a coordinatewise calibration vector that can lower its cosine matching loss relative to SME.Source: §2.2 · p. 2

3. PROPOSED METHOD: PI-SME

PI-SME treats the multi-step update as a path integral rather than matching a gradient at one state. It approximates that integral along a learnable Bézier curve and jointly optimizes the reconstructed batch, curve control point, and calibration.

3. PROPOSED METHOD: PI-SME

  • PI-SME approximates the accumulated update as a path integral along a learnable Bézier curve, rather than matching a gradient at one surrogate state.It uses m Gauss–Legendre nodes; each node adds one gradient evaluation per iteration, and the rule is exact for polynomial integrands up to degree 2m −1.Source: §3 · p. 2, §3.1 · p. 2

3.1. Path-integral surrogate

  • The integrated surrogate gradient is a weighted average of gradients at m fixed curve points, with m setting path resolution and computational cost.Each additional node requires one more gradient evaluation per iteration.Source: §3.1 · p. 2

3.2. Calibration and objective

  • A learnable coordinatewise calibration vector rescales the integrated gradient, while a regularizer pulls it toward the all-ones vector.The control-point regularizer keeps the Bézier control point near the straight line between endpoints.Source: §3.2 · p. 2
  • The reconstruction objective combines cosine matching, an anisotropic total-variation image prior, and control-point and calibration regularizers.PI-SME jointly optimizes the dummy batch, control point, and calibration with Adam for 1000 iterations; labels are recovered from the last-layer update and held fixed.Source: §3.2 · pp. 2–3

4. RESULTS

Across CIFAR-100 and FEMNIST, PI-SME improves on NL-SME across settings and inversion metrics. It retains an advantage when NL-SME receives more iterations and when the client batch contains fewer classes.

4. RESULTS

  • Evaluation uses CIFAR-100 and FEMNIST small CNNs, fixes m=7, and compares PI-SME with SME, NL-SME, IG, GI-NAS, and DGGI.Source: §4 · p. 3

4.1. Benchmark comparison

  • About 0.8 dB (CIFAR-100, T=100), 3 dB (CIFAR-100, T=250), and 1.2 dB (FEMNIST, both lengths) are PI-SME’s PSNR gains over NL-SME.SSIM, FSIM, LPIPS, and Lsim move the same way; Fig. 1 shows CIFAR-100 originals and reconstructions.Source: Table 1 · p. 3, §4.1 · p. 3, Figure 1 · p. 3

4.2. NL-SME under matched compute conditions

  • At T=100, NL-SME PSNR stays 25.76, 25.63, and 25.80 dB across 1000, 5000, and 7000 iterations; at T=250 it falls to 20.21, 19.15, and 19.26 dB.At T=250, calibrated Lsim falls while honest matching loss rises from 0.0147 to 0.0233.Source: §4.2 · p. 3

4.3. Class deficiency conditions

  • As C falls from 100 to 10, PI-SME’s PSNR margin over NL-SME widens from about 0.8 to about 4.2 dB; all three attacks lose quality, with PI-SME degrading slowest.Fewer classes leave a lower-rank signal because per-sample softmax residuals sum to zero across the C logits.Source: §4.3 · pp. 3–4, Figure 2 · p. 4

5. ABLATION STUDY

The ablation selects seven quadrature nodes because performance changes little across tested counts, then tests path integration against a best-case single-state reference. At both tested trajectory lengths, quadrature loss is lower despite using only endpoint information.

5.1. Node-count selection

  • Across m=3, 4, 5, 7, 10, and 12, metrics change little and larger m gives no monotone gain; m=7 is fixed for later experiments.The best count varies by setting and seed, and each added node costs another gradient evaluation per iteration.Source: §5.1 · p. 4, Table 2 · p. 4

5.2. Path-consistency test

  • The comparison grants the single-node reference all T+1 true states, while the quadrature fit uses only the two observed endpoints and fits control point P1.The test uses a CIFAR-100 client and compares gradient directions against the true mean direction without optimizing dummy data.Source: §5.2 · p. 4
  • 0.0079 vs 0.0242 at T=100 and 0.0136 vs 0.0446 at T=250: two-node quadrature cuts honest cosine loss by roughly threefold versus the single-node reference.The quadrature loss remains below the single-node reference for every tested node count at both lengths.Source: Table 3 · p. 4, §5.2 · p. 4

6. CONCLUSION

PI-SME models the multi-step update as a path integral and approximates it with Gauss–Legendre quadrature along a learnable Bézier curve. Its margin over NL-SME widens with longer client training and batches spanning fewer classes, while principled node selection and the sharp class-deficient-batch decline remain open questions.

  • The margin over NL-SME grows from about 0.8 dB at T=100 to about 3 dB at T=250, and from about 0.8 dB at C=100 to about 4.2 dB at C=10.Source: §6 · p. 4
  • PI-SME approximates the accumulated gradient path integral with an m-node Gauss–Legendre rule along a learnable Bézier curve.Source: §6 · p. 4
  • Choosing m from a principled bound and explaining the sharp decline of surrogate methods on class-deficient batches remain open scope for future work.Source: §6 · p. 4
Loading 2610.03597v1…