Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attacks
Pengxin Guo, Runxi Wang, Shuang Zeng, Jinjing Zhu, Haoning Jiang, Yanran Wang, Yuyin Zhou, Feifei Wang, Hui Xiong, Liangqiong Qu
2025-03-17
Summary
This paper explores how vulnerable Federated Learning (FL) is to attacks that try to steal private information by analyzing the data shared during the learning process.
What's the problem?
Federated Learning is designed to protect privacy by not sharing raw data, but it turns out that attackers can still potentially extract private information from the shared gradient information using Gradient Inversion Attacks (GIAs).
What's the solution?
The researchers systematically review, categorize, analyze, and evaluate different types of Gradient Inversion Attacks (GIAs) in Federated Learning, providing insights into the factors influencing their performance and potential threats. They categorize GIAs into optimization-based, generation-based, and analytics-based approaches.
Why it matters?
This work matters because it helps researchers understand the weaknesses of Federated Learning and design more robust frameworks to protect against privacy attacks, offering a three-stage defense pipeline and suggesting future research directions.
Abstract
Federated Learning (FL) has emerged as a promising privacy-preserving collaborative model training paradigm without sharing raw data. However, recent studies have revealed that private information can still be leaked through shared gradient information and attacked by Gradient Inversion Attacks (GIA). While many GIA methods have been proposed, a detailed analysis, evaluation, and summary of these methods are still lacking. Although various survey papers summarize existing privacy attacks in FL, few studies have conducted extensive experiments to unveil the effectiveness of GIA and their associated limiting factors in this context. To fill this gap, we first undertake a systematic review of GIA and categorize existing methods into three types, i.e., optimization-based GIA (OP-GIA), generation-based GIA (GEN-GIA), and analytics-based GIA (ANA-GIA). Then, we comprehensively analyze and evaluate the three types of GIA in FL, providing insights into the factors that influence their performance, practicality, and potential threats. Our findings indicate that OP-GIA is the most practical attack setting despite its unsatisfactory performance, while GEN-GIA has many dependencies and ANA-GIA is easily detectable, making them both impractical. Finally, we offer a three-stage defense pipeline to users when designing FL frameworks and protocols for better privacy protection and share some future research directions from the perspectives of attackers and defenders that we believe should be pursued. We hope that our study can help researchers design more robust FL frameworks to defend against these attacks.