GRNN: Generative Regression Neural Network—A Data Leakage Attack for Federated Learning

Abstract

Data privacy has become an increasingly important issue in Machine Learning (ML), where many approaches have been developed to tackle this challenge, e.g. cryptography (Homomorphic Encryption (HE), Differential Privacy (DP), etc. ) and collaborative training (Secure Multi-Party Computation (MPC), Distributed Learning and Federated Learning (FL)). These techniques have a particular focus on data encryption or secure local computation. They transfer the intermediate information to the third party to compute the final result. Gradient exchanging is commonly considered to be a secure way of training a robust model collaboratively in Deep Learning (DL). However, recent researches have demonstrated that sensitive information can be recovered from the shared gradient. Generative Adversarial Network (GAN), in particular, has shown to be effective in recovering such information. However, GAN based techniques require additional information, such as class labels which are generally unavailable for privacy-preserved learning. In this paper, we show that, in the FL system, image-based privacy data can be easily recovered in full from the shared gradient only via our proposed Generative Regression Neural Network (GRNN). We formulate the attack to be a regression problem and optimize two branches of the generative model by minimizing the distance between gradients. We evaluate our method on several image classification tasks. The results illustrate that our proposed GRNN outperforms state-of-the-art methods with better stability, stronger robustness, and higher accuracy. It also has no convergence requirement to the global FL model. Moreover, we demonstrate information leakage using face re-identification. Some defense strategies are also discussed in this work.

Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges

“…Their proposed attack seems to be slightly better than the one proposed by Geiping et al [64], but further experimentation is required to confirm their superiority. The same can be applied to Ren et al [65], whose comparison with others than Zhu and Han [12] remains undone.…”

“…With the same attacker knowledge, Li et al [63] propose a framework to measure the effectiveness of passive Feature inference attacks on logistic regression models, whose inputs are binary. Geiping et al [64] and Ren et al [65] propose different approaches to solve the initialization and stability problems of [12] and their attacks can handle batches of up to 100 and 256 elements, respectively. With the same attacker knowledge, Wei et al [66] propose an extensive study to measure the capabilities of passive reconstruction attacks focused on recovering images.…”

Digital Privacy Under Attack: Challenges and Enablers

“…Wei et al [146] discussed the gradient leakage attacks targeted at the federated server, thus violating the client's privacy regarding its training data. Ren et al [115] pointed out that the proposed Generative Regression Neural Network can recover the image data in the FL framework.…”

Stabilizing and Improving Federated Learning with Non-IID Data and Client Dropout

“…We simulate the scenarios with possible information leakage risks by presenting several data leakage attacks on CIFAR-10 dataset, including up-convolutional neural network (UpCNN) [60] and variational autoencoder (VAE) [61] that try to recover the input images from the feature representations. And we also adopt the approach from the state-of-the-art gradient attack generative regression neural network (GRNN) [62] to inverse the feature prototypes. From the reconstructed results in Fig.…”