Learning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learning
This reveals underestimated privacy risks for users in federated learning systems, challenging prior assumptions about defense effectiveness.
The paper tackles the problem of gradient inversion attacks in federated learning by showing that existing defenses, such as gradient compression, can be broken with a simple adaptive attack using a model trained on auxiliary data, achieving recovery on vision and language tasks.
Gradient inversion attack enables recovery of training samples from model gradients in federated learning (FL), and constitutes a serious threat to data privacy. To mitigate this vulnerability, prior work proposed both principled defenses based on differential privacy, as well as heuristic defenses based on gradient compression as countermeasures. These defenses have so far been very effective, in particular those based on gradient compression that allow the model to maintain high accuracy while greatly reducing the effectiveness of attacks. In this work, we argue that such findings underestimate the privacy risk in FL. As a counterexample, we show that existing defenses can be broken by a simple adaptive attack, where a model trained on auxiliary data is able to invert gradients on both vision and language tasks.