Deep Leakage from Gradients

Abstract

Exchanging gradients is a widely used method in modern multi-node machine learning system (e.g., distributed training, collaborative learning). For a long time, people believed that gradients are safe to share: i.e., the training data will not be leaked by gradient exchange. However, we show that it is possible to obtain the private training data from the publicly shared gradients. We name this leakage as Deep Leakage from Gradient and empirically validate the effectiveness on both computer vision and natural language processing tasks. Experimental results show that our attack is much stronger than previous approaches: the recovery is pixel-wise accurate for images and token-wise matching for texts. We want to raise people's awareness to rethink the gradient's safety. Finally, we discuss several possible strategies to prevent such deep leakage. The most effective defense method is gradient pruning.

References in corpus (13)

• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Federated Learning: Strategies for Improving Communication Efficiency
• Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour
• MXNet: A Flexible and Efficient Machine Learning Library for Heterogeneous Distributed Systems
• HOGWILD!: A Lock-Free Approach to Parallelizing Stochastic Gradient Descent
• Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Training
• Towards Federated Learning at Scale: System Design
• Horovod: fast and easy distributed deep learning in TensorFlow
• Highly Scalable Deep Learning Training System with Mixed-Precision: Training ImageNet in Four Minutes
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Practical Secure Aggregation for Federated Learning on User-Held Data
• ChainerMN: Scalable Distributed Deep Learning Framework
• Variance-based Gradient Compression for Efficient Distributed Deep Learning

Cited by in corpus (5)

• Shielding Federated Learning Systems against Inference Attacks with ARM TrustZone
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Privacy-Preserving News Recommendation Model Learning
• Adversarial Attacks and Defenses: An Interpretation Perspective
• ArchNet: Data Hiding Model in Distributed Machine Learning System