GradFilt : class-wise targeted data reconstruction from gradients in federated learning

Abstract

Gradient Inversion Attacks (GIAs) have shown that private training data can be recovered from gradient updates in Federated Learning (FL). However, these GIAs can only recover the entire batch of data with limited performance or stochastically restore some random instances. In this paper, we propose a class-wise targeted attack, named GradFilt, which can reconstruct the training data of some specified class(es) from the batch-averaged gradients. By modifying the parameters of the classification layer, we create a filter within the FL model that eliminates the gradients of non-target data while preserving the gradients of target data. We evaluate GradFilt with image datasets on popular FL model architectures. The results show that GradFilt can effectively reconstruct the desired samples with higher accuracies than the existing GIAs. Moreover, we can also achieve 100% success rate in restoring the batch labels. We hope this work can raise awareness of the privacy risks in FL and inspire effective defense mechanisms.