[论文解读] Client-side Gradient Inversion Against Federated Learning from Poisoning

Jiaheng Wei, Yanjun Zhang+6 more|arXiv (Cornell University)|Sep 14, 2023

Privacy-Preserving Technologies in Data被引用 6

一句话总结

本文提出CGI，这是联邦学习中首个客户端梯度反演攻击，使攻击者在仅具备最少先验知识的情况下，能够从聚合梯度中重建私有训练数据。通过污染全局模型以放大目标类别的梯度，CGI使这些梯度在聚合中占据主导地位，从而在拜占庭鲁棒聚合规则下仍能实现有效反演，且在多种数据设置下表现一致。

ABSTRACT

Federated Learning (FL) enables distributed participants (e.g., mobile devices) to train a global model without sharing data directly to a central server. Recent studies have revealed that FL is vulnerable to gradient inversion attack (GIA), which aims to reconstruct the original training samples and poses high risk against the privacy of clients in FL. However, most existing GIAs necessitate control over the server and rely on strong prior knowledge including batch normalization and data distribution information. In this work, we propose Client-side poisoning Gradient Inversion (CGI), which is a novel attack method that can be launched from clients. For the first time, we show the feasibility of a client-side adversary with limited knowledge being able to recover the training samples from the aggregated global model. We take a distinct approach in which the adversary utilizes a malicious model that amplifies the loss of a specific targeted class of interest. When honest clients employ the poisoned global model, the gradients of samples belonging to the targeted class are magnified, making them the dominant factor in the aggregated update. This enables the adversary to effectively reconstruct the private input belonging to other clients using the aggregated update. In addition, our CGI also features its ability to remain stealthy against Byzantine-robust aggregation rules (AGRs). By optimizing malicious updates and blending benign updates with a malicious replacement vector, our method remains undetected by these defense mechanisms. To evaluate the performance of CGI, we conduct experiments on various benchmark datasets, considering representative Byzantine-robust AGRs, and exploring diverse FL settings with different levels of adversary knowledge about the data. Our results demonstrate that CGI consistently and successfully extracts training input in all tested scenarios.

研究动机与目标

• 填补无需服务器控制或强先验知识的客户端梯度反演攻击的空白。
• 开发一种方法，使客户端在不修改主要训练框架或降低模型性能的前提下实现梯度反演。
• 设计一种可规避拜占庭鲁棒聚合规则（AGRs）检测的攻击。
• 评估在不同攻击者知识水平（完全、半知、无知）下该攻击的有效性——即对数据分布的了解程度。
• 分析现有防御措施（如安全聚合、差分隐私和数据去重）对这一新型攻击向量的局限性。

提出的方法

• 攻击者训练一个恶意模型，人为放大特定目标类别损失，从而增加该类别样本的梯度幅值。
• 使用该污染模型更新全局模型，导致后续聚合中目标类别的梯度占据主导地位。
• 攻击者随后利用聚合后的全局更新进行梯度反演，重建其他客户端的私有训练样本。
• 为保持隐蔽性，攻击通过替换向量将恶意更新与良性更新混合，超参数经调优以规避检测。
• 该方法无需批量归一化、数据分布先验知识或模型参数修改。
• 攻击通过损失差距度量（$\mathcal{L}_{gap}$）进行优化，该度量用于衡量目标梯度在聚合更新中的主导程度。

实验结果

研究问题

• RQ1 无服务器控制或强先验知识的客户端攻击者能否从聚合梯度中重建私有训练数据？
• RQ2 针对旨在检测恶意更新的拜占庭鲁棒聚合规则，该攻击的有效性如何？
• RQ3 当攻击者除目标类别外对数据分布一无所知时，该攻击是否仍有效？
• RQ4 损失差距（$\mathcal{L}_{gap}$）在多大程度上影响反演性能？
• RQ5 现有防御措施（如差分隐私或安全聚合）能否缓解此客户端梯度反演攻击？

主要发现

• CGI在所有测试基准数据集（包括CIFAR-10、SVHN和Fashion-MNIST）的多种联邦学习设置下，成功重建了私有训练样本。
• 该攻击实现高质量重建，PSNR值随损失差距（$\mathcal{L}_{gap}$）增大而提升，当$\mathcal{L}_{gap} \approx 1$时达到最优性能。
• CGI具备高度隐蔽性，通过有效混合恶意与良性更新，成功规避拜占庭鲁棒聚合规则的检测。
• 即使在“无知识”条件下（攻击者缺乏数据分布信息），该方法仍具有效性，表明其对有限先验知识的鲁棒性。
• 差分隐私和安全聚合对CGI无效，因为该攻击利用了梯度中被放大的敏感性，需不切实际地添加大量噪声才能保障隐私。
• 基于数据去重的防御措施失效，因为CGI不依赖于对训练样本的记忆。