Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning
New gradient inversion attacks tied to erasure-coding theory recover 94–100% of ImageNet batches, showing federated learning privacy leakage is underestimated.
The paper connects gradient inversion in federated learning to erasure-correcting code theory, constructing analytic attacks that exceed previously known recovery bounds. The attacks recover batches exactly, with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks, even a passive attacker observing an honestly trained network recovers 94–100% of ImageNet batches up to size 128, and more than 90% actively at batch sizes of several hundred. The authors conclude that federated learning's privacy leakage has been underestimated.
- Connects gradient inversion to erasure-correcting code theory
- Exact batch and label recovery from one FedSGD round
- Passive attacker recovers 94–100% of ImageNet batches up to size 128
- More than 90% recovered actively at batch sizes of several hundred
- Shows federated learning privacy leakage is underestimated
From the original article
1 min read at arxiv.orgFederated learning shares model updates rather than raw data, yet these updates can be inverted to reconstruct the clients' training data.
By Saeed Shariati · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.