[Paper Review] Evaluating Gradient Inversion Attacks and Defenses in Federated Learning

Yangsibo Huang, Samyak Gupta+3 more|arXiv (Cornell University)|Nov 30, 2021

Geophysical Methods and ApplicationsEngineering123 citations

TL;DR

The paper systematically evaluates gradient inversion attacks and defenses in Federated Learning, showing that relaxing strong attacker assumptions weakens attacks and that combining defenses can preserve data utility while reducing privacy leakage.

ABSTRACT

Gradient inversion attack (or input recovery from gradient) is an emerging threat to the security and privacy preservation of Federated learning, whereby malicious eavesdroppers or participants in the protocol can recover (partially) the clients' private data. This paper evaluates existing attacks and defenses. We find that some attacks make strong assumptions about the setup. Relaxing such assumptions can substantially weaken these attacks. We then evaluate the benefits of three proposed defense mechanisms against gradient inversion attacks. We show the trade-offs of privacy leakage and data utility of these defense methods, and find that combining them in an appropriate manner makes the attack less effective, even under the original strong assumptions. We also estimate the computation cost of end-to-end recovery of a single image under each evaluated defense. Our findings suggest that the state-of-the-art attacks can currently be defended against with minor data utility loss, as summarized in a list of potential strategies. Our code is available at: https://github.com/Princeton-SysML/GradAttack.

Motivation & Objective

• Assess the risks of gradient inversion attacks under realistic threat models.
• Evaluate existing defense mechanisms and quantify privacy leakage vs. data utility.
• Investigate whether combining defenses improves protection with acceptable model performance.
• Estimate end-to-end computational cost of recovering a single image under different defenses.

Proposed method

• Review and formalize state-of-the-art gradient inversion attacks, focusing on Geiping et al. (2020).
• Identify and relax two strong assumptions: Knowledge of BatchNorm statistics and private labels.
• Re-design attacks under relaxed assumptions to measure impact on reconstruction quality.
• Systematically evaluate defenses including GradPrune, MixUp, and Intra-InstaHide against the strongest attack.
• Analyze combinations of defenses and measure privacy leakage using LPIPS and test accuracy.
• Provide time costs for end-to-end recovery under different defenses.

Experimental results

Research questions

• RQ1 What are the critical assumptions underlying gradient inversion attacks and how does removing them affect attack efficacy?
• RQ2 How do existing defenses perform in terms of privacy leakage and data utility against the strongest gradient inversion attack?
• RQ3 Can combining defenses yield better privacy-utility trade-offs than individual defenses?
• RQ4 What is the computational cost of recovering a single image under various defenses?
• RQ5 Do higher batch sizes and secure configurations mitigate gradient inversion risks?

Key findings

• Relaxing assumptions about BatchNorm statistics and private labels substantially weakens gradient inversion attacks, especially for high-resolution data.
• GradPrune alone is insufficient against the strongest attack unless pruning is extremely aggressive (p ≥ 0.999), which incurs sizable accuracy loss.
• MixUp and Intra-InstaHide provide limited leakage reduction when used alone, particularly for small batch sizes.
• Combining defenses (e.g., Intra-InstaHide with gradient pruning) can markedly reduce privacy leakage with moderate accuracy costs, especially at batch size 32.
• End-to-end recovery time estimates show InstaHide can greatly increase attacker cost, making recovery impractical for medium-to-large datasets.
• Best practice suggestions include avoiding sharing BatchNorm statistics, using larger batch sizes, and combining defenses for improved security with acceptable utility loss.