Do Gradient Inversion Attacks Make Federated Learning Unsafe?

Area of Science:

• Artificial Intelligence
• Machine Learning
• Data Privacy

Background:

• Federated learning (FL) enables collaborative AI model training without raw data sharing, crucial for sensitive healthcare data.
• Existing data inversion attacks on FL models raise privacy concerns, despite FL's privacy-preserving design.
• Batch Normalization (BN) statistics updates in FL clients were thought to mitigate these attacks.

Purpose of the Study:

• To evaluate the practical security of federated learning against data leakage attacks when Batch Normalization statistics are updated.
• To develop and demonstrate a new, practical attack vector for data leakage in such FL scenarios.
• To introduce novel methods for quantifying and visualizing potential data leakage in federated learning.

Main Methods:

• Analysis of existing deep neural network inversion attacks in the context of FL with Batch Normalization.
• Development of a novel baseline data leakage attack tailored for FL scenarios involving BN statistics.
• Implementation of new metrics and visualization techniques to assess data leakage risks.

Main Results:

• Demonstrated that previously proposed data inversion attacks are impractical for FL with Batch Normalization.
• Presented a new, effective baseline attack that successfully exploits FL with BN for data leakage.
• Introduced quantifiable metrics and visualization tools for measuring and understanding data leakage in FL.

Conclusions:

• Federated learning with Batch Normalization is not immune to data leakage attacks.
• New methods are required to accurately assess and mitigate privacy risks in FL.
• This research provides a foundation for establishing reproducible privacy assessments and optimizing privacy-accuracy trade-offs in FL systems.