GRNN: Generative Regression Neural Network -- A Data Leakage Attack for Federated Learning

Abstract

Data privacy has become an increasingly important issue in Machine Learning (ML), where many approaches have been developed to tackle this challenge, e.g. cryptography (Homomorphic Encryption (HE), Differential Privacy (DP), etc.) and collaborative training (Secure Multi-Party Computation (MPC), Distributed Learning and Federated Learning (FL)). These techniques have a particular focus on data encryption or secure local computation. They transfer the intermediate information to the third party to compute the final result. Gradient exchanging is commonly considered to be a secure way of training a robust model collaboratively in Deep Learning (DL). However, recent researches have demonstrated that sensitive information can be recovered from the shared gradient. Generative Adversarial Network (GAN), in particular, has shown to be effective in recovering such information. However, GAN based techniques require additional information, such as class labels which are generally unavailable for privacy-preserved learning. In this paper, we show that, in the FL system, image-based privacy data can be easily recovered in full from the shared gradient only via our proposed Generative Regression Neural Network (GRNN). We formulate the attack to be a regression problem and optimize two branches of the generative model by minimizing the distance between gradients. We evaluate our method on several image classification tasks. The results illustrate that our proposed GRNN outperforms state-of-the-art methods with better stability, stronger robustness, and higher accuracy. It also has no convergence requirement to the global FL model. Moreover, we demonstrate information leakage using face re-identification. Some defense strategies are also discussed in this work.

arXiv commentThe source code can be found at: https://github.com/Rand2AI/GRNN

References in corpus (15)

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Deep Learning with Differential Privacy
• Language Modeling with Gated Convolutional Networks
• Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Training
• Differentially Private Federated Learning: A Client Level Perspective
• Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption
• iDLG: Improved Deep Leakage from Gradients
• CryptoDL: Deep Neural Networks over Encrypted Data
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Practical Secure Aggregation for Federated Learning on User-Held Data
• Defeating Image Obfuscation with Deep Learning
• SparkNet: Training Deep Networks in Spark
• Encrypted statistical machine learning: new privacy preserving methods
• FedEval: A Holistic Evaluation Framework for Federated Learning

Cited by in corpus (8)

• Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges
• FedCG: Leverage Conditional GAN for Protecting Privacy and Maintaining Competitive Performance in Federated Learning
• A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspective
• Privacy-Preserving Federated Learning with Differentially Private Hyperdimensional Computing
• FedBoosting: Federated Learning with Gradient Protected Boosting for Text Recognition
• Collaborative Distributed Machine Learning
• Cellular Traffic Prediction via Byzantine-robust Asynchronous Federated Learning
• A New Dimensionality Reduction Method Based on Hensel's Compression for Privacy Protection in Federated Learning