Combining Stochastic Defenses to Resist Gradient Inversion: An Ablation Study
Gradient Inversion (GI) attacks are a ubiquitous threat in Federated Learning (FL) as they exploit gradient leakage to reconstruct supposedly private training data. Common defense mechanisms such as Differential Privacy (DP) or stochastic Privacy Modules (PMs) introduce randomness during gradient computation to prevent such attacks. However, we pose that if an attacker effectively mimics a client's stochastic gradient computation, the attacker can circumvent the defense and reconstruct clients' private training data. This paper introduces several targeted GI attacks that leverage this principle to bypass common defense mechanisms. As a result, we demonstrate that no individual defense provides sufficient privacy protection. To address this issue, we propose to combine multiple defenses. We conduct an extensive ablation study to evaluate the influence of various combinations of defenses on privacy protection and model utility. We observe that only the combination of DP and a stochastic PM was sufficient to decrease the Attack Success Rate (ASR) from 100% to 0%, thus preserving privacy. Moreover, we found that this combination of defenses consistently achieves the best trade-off between privacy and model utility.
Code (0)
등록된 구현이 없습니다.
Tasks
Federated LearningImage ClassificationPrivacy PreservingSimilar Papers 제목 키워드 기반
Evaluating Gradient Inversion Attacks and Defenses in Federated Learning
Gradient inversion attack (or input recovery from gradient) is an emerging threat to the security and privacy preservation of Federated learning, whereby malicious eavesdroppers or participants in the protocol can recove…
Federated LearningLearning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learning
Gradient inversion attack enables recovery of training samples from model gradients in federated learning (FL), and constitutes a serious threat to data privacy. To mitigate this vulnerability, prior work proposed both p…
Federated LearningInversion of 1D frequency- and time-domain electromagnetic data with convolutional neural networks
Inversion of electromagnetic data finds applications in many areas of geophysics. The inverse problem is commonly solved with either deterministic optimization methods (such as the nonlinear conjugate gradient or Gauss-N…
GeophysicsOn Breaking Deep Generative Model-based Defenses and Beyond
Deep neural networks have been proven to be vulnerable to the so-called adversarial attacks. Recently there have been efforts to defend such attacks with deep generative models. These defenses often involve an inversion …
TIP: Resisting Gradient Inversion via Targeted Interpretable Perturbation in Federated Learning
Federated Learning (FL) facilitates collaborative model training while preserving data locality; however, the exchange of gradients renders the system vulnerable to Gradient Inversion Attacks (GIAs), allowing adversaries…
Image ReconstructionFederated Learning