首次揭示联邦学习中视频数据可通过梯度反演泄露,需警惕隐私风险。
Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning
- 用梯度反演攻击分析视频数据在联邦学习中的泄露风险。
- 特征提取器比原始帧处理更抗攻击,但复杂度不足仍可被破解。
- 超分辨率技术能提升重构视频质量,适合安全与隐私研究者关注。
联邦学习(FL)允许多方协作训练共享模型,核心原则是仅交换模型更新(如梯度),不共享原始敏感数据,适用于对隐私要求高的领域。然而,梯度反演攻击可从共享梯度中逆向重建私有训练数据,威胁其安全性。尽管该类攻击在图像、文本和表格数据上已有研究,视频数据的泄露风险尚未被系统评估。本文首次分析了使用梯度反演攻击时视频数据在联邦学习中的泄露问题。我们评估了两种主流视频分类方法:一种采用预训练特征提取器,另一种对原始视频帧进行简单变换处理。实验表明,使用特征提取器的方法更具抗性;同时,图像超分辨率技术可显著提升梯度反演获得的帧质量,使攻击者重建出更高清晰度的视频。我们在攻击者拥有0、1或多个参考帧的不同场景下验证了该现象。结果发现,即使使用特征提取器,若分类器复杂度不足,泄露仍可能发生。因此,视频数据在联邦学习中的泄露是一个真实且亟待深入研究的威胁。
原文摘要 · Abstract (English)
Federated learning (FL) allows multiple entities to train a shared model collaboratively. Its core, privacy-preserving principle is that participants only exchange model updates, such as gradients, and never their raw, sensitive data. This approach is fundamental for applications in domains where privacy and confidentiality are important. However, the security of this very mechanism is threatened by gradient inversion attacks, which can reverse-engineer private training data directly from the shared gradients, defeating the purpose of FL. While the impact of these attacks is known for image, text, and tabular data, their effect on video data remains an unexamined area of research. This paper presents the first analysis of video data leakage in FL using gradient inversion attacks. We evaluate two common video classification approaches: one employing pre-trained feature extractors and another that processes raw video frames with simple transformations. Our initial results indicate that the use of feature extractors offers greater resilience against gradient inversion attacks. We also demonstrate that image super-resolution techniques can enhance the frames extracted through gradient inversion attacks, enabling attackers to reconstruct higher-quality videos. Our experiments validate this across scenarios where the attacker has access to zero, one, or more reference frames from the target environment. We find that although feature extractors make attacks more challenging, leakage is still possible if the classifier lacks sufficient complexity. We, therefore, conclude that video data leakage in FL is a viable threat, and the conditions under which it occurs warrant further investigation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。