OASIS: Offsetting Active Reconstruction Attacks in Federated Learning
This addresses a critical privacy vulnerability in Federated Learning, which is widely used in sensitive domains like healthcare, but the defense is incremental as it builds on existing augmentation techniques.
The paper tackles active reconstruction attacks in Federated Learning, where dishonest servers can steal private user data by manipulating model parameters, and proposes OASIS, a defense based on image augmentation that effectively counteracts these attacks while preserving model performance.
Federated Learning (FL) has garnered significant attention for its potential to protect user privacy while enhancing model training efficiency. For that reason, FL has found its use in various domains, from healthcare to industrial engineering, especially where data cannot be easily exchanged due to sensitive information or privacy laws. However, recent research has demonstrated that FL protocols can be easily compromised by active reconstruction attacks executed by dishonest servers. These attacks involve the malicious modification of global model parameters, allowing the server to obtain a verbatim copy of users' private data by inverting their gradient updates. Tackling this class of attack remains a crucial challenge due to the strong threat model. In this paper, we propose a defense mechanism, namely OASIS, based on image augmentation that effectively counteracts active reconstruction attacks while preserving model performance. We first uncover the core principle of gradient inversion that enables these attacks and theoretically identify the main conditions by which the defense can be robust regardless of the attack strategies. We then construct our defense with image augmentation showing that it can undermine the attack principle. Comprehensive evaluations demonstrate the efficacy of the defense mechanism highlighting its feasibility as a solution.