SPEAR++让梯度反演攻击更快更实用，支持更大批量数据
SPEAR++: Scaling Gradient Inversion via Sparsely-Used Dictionary Learning
- 用稀疏字典学习加速梯度反演，突破原有指数级计算瓶颈
- 在10倍更大批次下仍保持对差分隐私和联邦平均的鲁棒性
- 适合研究联邦学习隐私漏洞或设计防御机制的研究者
联邦学习近年来在实际场景中得到广泛应用，其通过分布式训练模型而无需显式共享数据，从而保护隐私。然而，梯度反演攻击的出现对其隐私性提出了根本挑战。现有攻击多依赖直接数据优化，缺乏理论保证，导致真实系统是否脆弱仍存争议，且需为每次部署进行繁琐测试。为此，近期提出的SPEAR攻击基于线性层与ReLU激活函数梯度的理论分析，具有重要突破意义。但其在批量大小b上的运行时间呈指数增长，严重限制了实用性。本文通过引入稀疏使用字典学习的前沿技术，使针对带ReLU线性层的梯度反演问题变得可解。实验表明，新攻击SPEAR++保留了SPEAR的所有优良特性，如对差分隐私噪声和联邦平均聚合的鲁棒性，同时支持10倍更大的批量大小。
原文摘要 · Abstract (English)
Federated Learning has seen an increased deployment in real-world scenarios recently, as it enables the distributed training of machine learning models without explicit data sharing between individual clients. Yet, the introduction of the so-called gradient inversion attacks has fundamentally challenged its privacy-preserving properties. Unfortunately, as these attacks mostly rely on direct data optimization without any formal guarantees, the vulnerability of real-world systems remains in dispute and requires tedious testing for each new federated deployment. To overcome these issues, recently the SPEAR attack was introduced, which is based on a theoretical analysis of the gradients of linear layers with ReLU activations. While SPEAR is an important theoretical breakthrough, the attack's practicality was severely limited by its exponential runtime in the batch size b. In this work, we fill this gap by applying State-of-the-Art techniques from Sparsely-Used Dictionary Learning to make the problem of gradient inversion on linear layers with ReLU activations tractable. Our experiments demonstrate that our new attack, SPEAR++, retains all desirable properties of SPEAR, such as robustness to DP noise and FedAvg aggregation, while being applicable to 10x bigger batch sizes.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。