Inference attacks based on GAN in federated learning

Abstract

Purpose In the digital age, organizations want to build a more powerful machine learning model that can serve the increasing needs of people. However, enhancing privacy and data security is one of the challenges for machine learning models, especially in federated learning. Parties want to collaborate with each other to build a better model, but they do not want to reveal their own data. This study aims to introduce threats and defenses to privacy leaks in the collaborative learning model. Design/methodology/approach In the collaborative model, the attacker was the central server or a participant. In this study, the attacker is on the side of the participant, who is “honest but curious.” Attack experiments are on the participant’s side, who performs two tasks: one is to train the collaborative learning model; the second task is to build a generative adversarial networks (GANs) model, which will perform the attack to infer more information received from the central server. There are three typical types of attacks: white box, black box without auxiliary information and black box with auxiliary information. The experimental environment is set up by PyTorch on Google Colab platform running on graphics processing unit with labeled faces in the wild and Canadian Institute For Advanced Research-10 data sets. Findings The paper assumes that the privacy leakage attack resides on the participant’s side, and the information in the parameter server contains too much knowledge to train a collaborative machine learning model. This study compares the success level of inference attack from model parameters based on GAN models. There are three GAN models, which are used in this method: condition GAN, control GAN and Wasserstein generative adversarial networks (WGAN). Of these three models, the WGAN model has proven to obtain the highest stability. Originality/value The concern about privacy and security for machine learning models are more important, especially for collaborative learning. The paper has contributed experimentally to private attack on the participant side in the collaborative learning model.

Anomaly detection and defense techniques in federated learning: a comprehensive review

“…Insufficient knowledge exists in the parameter server to properly train a collaborative machine learning model. A previous study Ha et al (2022) assumed that the participant was the one who was subject to the privacy leakage attack, and compared the success rates of inference attacks from model parameters using GANs models.…”

Fast and Accurate Deep Leakage from Gradients Based on Wasserstein Distance

“…Melis et al [16] used user-updated model parameters as features for training attack model inputs for inferring relevant attributes of other user datasets. Te literature [7,50,51] employs generative adversarial networks to generate methods for recovering training data from other users, and Mahendran et al [22] investigate gradient inversion information maximization to synthesize real data from training networks, but both rely on a priori information from auxiliary datasets. Mordvintsev et al [23] use only the gradients in the input to enable the separation of noise and image, making it difcult to obtain higher-fdelity information on large datasets.…”

“…We can still prove theoretically that the recovery of data labels is independent of the iterative training process of the network and refer to the proof of (equation ( 3)) for details. Tis 􏼈 􏼉 ≤ 0//Get the subscript c ′ of the last layer of negative bias (2) c pred ← One_Hot (c ′ )//Convert c ′ to One_Hot code (3) x ′ ←N(0, 1)//Initialize virtual data with the same dimensions as x (4) for i←1 to N do (5) ∇W ′ ←zLoss(F(x ′ , W), c pred )/zW//Calculating virtual gradients (6) Loss W d ←WDCA(∇W ′ , ∇W)//WDCA is Algorithm 2 (7) x ′ ←x ′ − η∇ x ′ Loss W d (8) end for Output: x ′ ALGORITHM 1: WDLG Algorithm.…”

“…FL builds iterable aggregated models by training distributed models across multiple data sources with local data, only exchanging model parameters or intermediate results models, and thus learning a shared target model. Improved approaches based on FL methods [2][3][4][5][6][7][8][9] have carried out a lot of research work in achieving a balance between data privacy protection and data sharing computation. Currently, more researchers are using cryptographic privacy-preserving methods and diferential privacy-preserving methods to achieve privacy-preserving security for local gradients in the federal learning security problem [10,11].…”

FedACQ: adaptive clustering quantization of model parameters in federated learning

“…According to content and scenarios, the data involved in AI applications can be divided into three categories: original data generated by users and identity data, data reflecting the appearance of the users’ behavior collected through users’ daily life behaviors, network records and App records and characteristic index data obtained from algorithms. These data bring immeasurable business value to enterprises and efficient and convenient services to people, but they may have the potential to compromise sensitive and private data in the process of flow (Guo et al , 2021; Ha and Dang, 2022). In this regard, the academic community has conducted several targeted studies.…”