Client-Side Gradient Inversion Attack in Federated Learning Using Secure Aggregation

Yu Sun

doi:10.1109/JIOT.2024.3405939

2024-09-01

PRE

DOI：10.1109/JIOT.2024.3405939

原文链接

原文求助

摘要

En 中文

As a privacy-preserving enhancement to the federated learning (FL) framework, secure aggregation (SA) enables multiparty summation without any party needing to reveal their updates to the aggregator in the Internet of Things applications. However, the conventional threat model underestimates the potential inversion attacks on aggregated gradients from an honest-but-curious client, due to the considering information loss caused by SA. This study for the first time, demonstrates the gradient inversion attack against the SA schemes in which gradients are quantized and aggregated. Then, an enhanced gradient inversion from the client side is proposed to address two roadblocks caused by SA, i.e., aggregation information loss and quantization rounding error. To countermeasure the information loss, we utilize class-wise representation matching to achieve the category-level decomposition. This relies on a prior restoration of the class-wise representations and instance-wise labels, whose numerical accuracy is cyclically calibrated through the prior-based offset estimation. Since, cryptographic operators involved in the SA schemes usually operates in the integer domain, gradient quantization is introduced. Regarding the rounding errors from the gradient quantization, quantization-aware gradient matching (QGM) is presented to align with a more precise optimization objective. Extensive experiments demonstrate that a semi-honest client is sufficient to infer sensitive data from the aggregated gradients after even 8-bit quantization. Moreover, a defense scheme based on 1-bit gradient quantization is proposed. The new attack from the client side in SA-based FL urges the community to take necessary defensive measures.

Keyword:

Quantization (signal)

Threat modeling

Internet of Things

Training

Federated learning

Computational modeling

Protocols

Federated learning (FL)

gradient inversion attack

secure aggregation (SA)

quantization