[Paper Review] iDLG: Improved Deep Leakage from Gradients

Bo Zhao, Konda Reddy Mopuri+1 more|arXiv (Cornell University)|Jan 8, 2020

Privacy-Preserving Technologies in DataComputer Science10 references376 citations

TL;DR

iDLG analytically extracts ground-truth labels from shared gradients and uses this to improve data reconstruction, achieving 100% label extraction accuracy across MNIST, CIFAR-100, and LFW while outperforming the original DLG in data fidelity.

ABSTRACT

It is widely believed that sharing gradients will not leak private training data in distributed learning systems such as Collaborative Learning and Federated Learning, etc. Recently, Zhu et al. presented an approach which shows the possibility to obtain private training data from the publicly shared gradients. In their Deep Leakage from Gradient (DLG) method, they synthesize the dummy data and corresponding labels with the supervision of shared gradients. However, DLG has difficulty in convergence and discovering the ground-truth labels consistently. In this paper, we find that sharing gradients definitely leaks the ground-truth labels. We propose a simple but reliable approach to extract accurate data from the gradients. Particularly, our approach can certainly extract the ground-truth labels as opposed to DLG, hence we name it Improved DLG (iDLG). Our approach is valid for any differentiable model trained with cross-entropy loss over one-hot labels. We mathematically illustrate how our method can extract ground-truth labels from the gradients and empirically demonstrate the advantages over DLG.

Motivation & Objective

• Motivate the vulnerability of gradient sharing in distributed learning to reveal private training data.
• Derive a method to identify ground-truth labels from gradients regardless of model architecture.
• Propose iDLG to improve data leakage by using extracted labels to drive gradient-matching reconstruction.

Proposed method

• Derive the sign-based relationship between output gradients and true labels under cross-entropy with one-hot labels.
• Show that gradients with respect to the last-layer weights reveal the ground-truth label based on sign patterns.
• Extract the ground-truth label from shared gradients using a sign-based criterion.
• Initialize a dummy input and optimize it to minimize the Frobenius norm difference between dummy gradients and shared gradients.
• Update the dummy input via gradient descent to reconstruct the private data with the extracted label.

Experimental results

Research questions

• RQ1 Can ground-truth labels be reliably inferred from shared gradients regardless of network architecture?
• RQ2 Does using the extracted labels improve the fidelity and convergence of data reconstruction compared to DLG?
• RQ3 How does iDLG perform across datasets with varying complexity (MNIST, CIFAR-100, LFW)?
• RQ4 What is the impact of gradient access scope (per-sample gradients) on leakage effectiveness?

Key findings

• iDLG achieves 100% accuracy in extracting ground-truth labels across MNIST, CIFAR-100, and LFW, unlike DLG which mislabels frequently.
• iDLG consistently outperforms DLG in data fidelity across all three datasets, with notable gains on the challenging LFW task.
• Across 1000 trials, iDLG yields higher label extraction accuracy and better fidelity (lower MSE) for reconstructed data.
• The method converges faster, with fewer iterations needed to reach comparable fidelity compared to DLG (e.g., 90 vs 200 iterations on LFW in the provided example).