A Framework for Evaluating Gradient Leakage Attacks in Federated Learning

Abstract

Federated learning (FL) is an emerging distributed machine learning framework for collaborative model training with a network of clients (edge devices). FL offers default client privacy by allowing clients to keep their sensitive data on local devices and to only share local training parameter updates with the federated server. However, recent studies have shown that even sharing local parameter updates from a client to the federated server may be susceptible to gradient leakage attacks and intrude the client privacy regarding its training data. In this paper, we present a principled framework for evaluating and comparing different forms of client privacy leakage attacks. We first provide formal and experimental analysis to show how adversaries can reconstruct the private local training data by simply analyzing the shared parameter update from local training (e.g., local gradient or weight update vector). We then analyze how different hyperparameter configurations in federated learning and different settings of the attack algorithm may impact on both attack effectiveness and attack cost. Our framework also measures, evaluates, and analyzes the effectiveness of client privacy leakage attacks under different gradient compression ratios when using communication efficient FL protocols. Our experiments also include some preliminary mitigation strategies to highlight the importance of providing a systematic attack evaluation framework towards an in-depth understanding of the various forms of client privacy leakage threats in federated learning and developing theoretical foundations for attack mitigation.

References in corpus (11)

• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Federated Learning: Strategies for Improving Communication Efficiency
• Federated Learning with Non-IID Data
• How To Backdoor Federated Learning
• Differentially Private Federated Learning: A Client Level Perspective
• iDLG: Improved Deep Leakage from Gradients
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• BrainTorrent: A Peer-to-Peer Environment for Decentralized Federated Learning
• Towards Demystifying Membership Inference Attacks
• Federated Learning with Unbiased Gradient Aggregation and Controllable Meta Updating
• LOGAN: Membership Inference Attacks Against Generative Models

Cited by in corpus (24)

• FedML: A Research Library and Benchmark for Federated Machine Learning
• FedPD: A Federated Learning Framework with Optimal Rates and Adaptivity to Non-IID Data
• A Field Guide to Federated Optimization
• A Comprehensive Survey on 6G Networks:Applications, Core Services, Enabling Technologies, and Future Challenges
• FedCluster: Boosting the Convergence of Federated Learning via Cluster-Cycling
• Towards Communication-efficient and Attack-Resistant Federated Edge Learning for Industrial Internet of Things
• FedCV: A Federated Learning Framework for Diverse Computer Vision Tasks
• Federated Reconstruction: Partially Local Federated Learning
• Understanding Clipping for Federated Learning: Convergence and Client-Level Differential Privacy
• Spatio-Temporal Bayesian Learning for Mobile Edge Computing Resource Planning in Smart Cities
• Self-supervised Cross-silo Federated Neural Architecture Search
• Perfectly Accurate Membership Inference by a Dishonest Central Server in Federated Learning
• CAFE: Catastrophic Data Leakage in Vertical Federated Learning
• Layer-wise Characterization of Latent Information Leakage in Federated Learning
• Scalable and Communication-efficient Decentralized Federated Edge Learning with Multi-blockchain Framework
• Local Differential Privacy is Not Enough: A Sample Reconstruction Attack against Federated Learning with Local Differential Privacy
• On the Practicality of Differential Privacy in Federated Learning by Tuning Iteration Times
• Revealing and Protecting Labels in Distributed Training
• Federated Learning on Non-IID Data: A Survey
• Rethinking Privacy Preserving Deep Learning: How to Evaluate and Thwart Privacy Attacks
• Privacy-preserving Collaborative Learning with Automatic Transformation Search
• R-GAP: Recursive Gradient Attack on Privacy
• Optimizing the Numbers of Queries and Replies in Federated Learning with Differential Privacy
• Robust Deep Learning Ensemble against Deception