探索聯邦學習的脆弱性：深入剖析梯度反轉攻擊

Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attacks

March 13, 2025

作者: Pengxin Guo, Runxi Wang, Shuang Zeng, Jinjing Zhu, Haoning Jiang, Yanran Wang, Yuyin Zhou, Feifei Wang, Hui Xiong, Liangqiong Qu

cs.AI

摘要

聯邦學習（Federated Learning, FL）作為一種無需共享原始數據的隱私保護協同模型訓練範式，已展現出巨大潛力。然而，近期研究揭示，通過共享的梯度信息仍可能洩露隱私，並遭受梯度反轉攻擊（Gradient Inversion Attacks, GIA）的威脅。儘管已有眾多GIA方法被提出，但對這些方法的詳細分析、評估與總結仍顯不足。雖然多篇綜述論文總結了FL中的現有隱私攻擊，但鮮有研究通過大量實驗來揭示GIA的有效性及其在該情境下的限制因素。為填補這一空白，我們首先對GIA進行了系統性回顧，並將現有方法分為三類，即基於優化的GIA（OP-GIA）、基於生成的GIA（GEN-GIA）和基於分析的GIA（ANA-GIA）。隨後，我們全面分析並評估了FL中這三類GIA，深入探討了影響其性能、實用性及潛在威脅的因素。我們的研究發現，儘管OP-GIA的表現未盡如人意，但它是最為實用的攻擊設定；而GEN-GIA存在諸多依賴性，ANA-GIA則易於被檢測，使得兩者均不具備實用性。最後，我們為用戶設計FL框架和協議時提供了一個三階段防禦流程，以實現更好的隱私保護，並從攻擊者與防禦者的角度分享了一些我們認為應予探索的未來研究方向。我們希望本研究能幫助研究人員設計出更為健壯的FL框架，以抵禦這些攻擊。

English

Federated Learning (FL) has emerged as a promising privacy-preserving collaborative model training paradigm without sharing raw data. However, recent studies have revealed that private information can still be leaked through shared gradient information and attacked by Gradient Inversion Attacks (GIA). While many GIA methods have been proposed, a detailed analysis, evaluation, and summary of these methods are still lacking. Although various survey papers summarize existing privacy attacks in FL, few studies have conducted extensive experiments to unveil the effectiveness of GIA and their associated limiting factors in this context. To fill this gap, we first undertake a systematic review of GIA and categorize existing methods into three types, i.e., optimization-based GIA (OP-GIA), generation-based GIA (GEN-GIA), and analytics-based GIA (ANA-GIA). Then, we comprehensively analyze and evaluate the three types of GIA in FL, providing insights into the factors that influence their performance, practicality, and potential threats. Our findings indicate that OP-GIA is the most practical attack setting despite its unsatisfactory performance, while GEN-GIA has many dependencies and ANA-GIA is easily detectable, making them both impractical. Finally, we offer a three-stage defense pipeline to users when designing FL frameworks and protocols for better privacy protection and share some future research directions from the perspectives of attackers and defenders that we believe should be pursued. We hope that our study can help researchers design more robust FL frameworks to defend against these attacks.