Evaluating Gradient Inversion Attacks and Defenses in Federated Learning

Abstract

Gradient inversion attack (or input recovery from gradient) is an emerging threat to the security and privacy preservation of Federated learning, whereby malicious eavesdroppers or participants in the protocol can recover (partially) the clients' private data. This paper evaluates existing attacks and defenses. We find that some attacks make strong assumptions about the setup. Relaxing such assumptions can substantially weaken these attacks. We then evaluate the benefits of three proposed defense mechanisms against gradient inversion attacks. We show the trade-offs of privacy leakage and data utility of these defense methods, and find that combining them in an appropriate manner makes the attack less effective, even under the original strong assumptions. We also estimate the computation cost of end-to-end recovery of a single image under each evaluated defense. Our findings suggest that the state-of-the-art attacks can currently be defended against with minor data utility loss, as summarized in a list of potential strategies. Our code is available at: https://github.com/Princeton-SysML/GradAttack.

Cited by in corpus (8)

• An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning
• Bilateral Dependency Optimization: Defending Against Model-inversion Attacks
• Privacy-preserving quantum federated learning via gradient hiding
• Privacy-Preserving Individual-Level COVID-19 Infection Prediction via Federated Graph Learning
• On Predicting Generalization using GANs
• IPFed: Identity protected federated learning for user authentication
• Accelerating MoE Model Inference with Expert Sharding
• Practical Federated Learning without a Server