OASIS: Offsetting Active Reconstruction Attacks in Federated Learning

TL;DR

This work tackles the risk that dishonest federated servers can actively reconstruct private user data via gradient inversion. It introduces OASIS, an image-augmentation defense that ensures gradients encode a linear combination of original and augmented samples, preventing exact reconstruction while preserving FL performance. The authors analyze the attack principle, generalize attacks like CAH and RTF, and show that augmenting data to create common activation patterns disrupts single-sample gradient extraction. Experimental results on ImageNet and CIFAR100 demonstrate substantial reductions in reconstruction quality with only marginal accuracy loss, offering a scalable defense for privacy-preserving federated learning.

Abstract

Federated Learning (FL) has garnered significant attention for its potential to protect user privacy while enhancing model training efficiency. For that reason, FL has found its use in various domains, from healthcare to industrial engineering, especially where data cannot be easily exchanged due to sensitive information or privacy laws. However, recent research has demonstrated that FL protocols can be easily compromised by active reconstruction attacks executed by dishonest servers. These attacks involve the malicious modification of global model parameters, allowing the server to obtain a verbatim copy of users' private data by inverting their gradient updates. Tackling this class of attack remains a crucial challenge due to the strong threat model. In this paper, we propose a defense mechanism, namely OASIS, based on image augmentation that effectively counteracts active reconstruction attacks while preserving model performance. We first uncover the core principle of gradient inversion that enables these attacks and theoretically identify the main conditions by which the defense can be robust regardless of the attack strategies. We then construct our defense with image augmentation showing that it can undermine the attack principle. Comprehensive evaluations demonstrate the efficacy of the defense mechanism highlighting its feasibility as a solution.

Figures (14)

• Figure 1: Overview design of OASIS. Top: Standard active reconstruction attack with malicious model modifications perfectly reconstructing training samples. Bottom: OASIS in place with augmented data to defend the active reconstruction attacks. The resulting reconstruction is a linear combination of images, effectively hiding the content of training samples. Note: Rotation is not the only transformation within OASIS.
• Figure 2: Example visual representation of PSNR values. Images with lower PSNR tend to have worse reconstruction quality compared to images with higher PSNR.
• Figure 3: Average PSNR over the images reconstructed by the RTF attack w.r.t the batch size and the number of attacked neurons on ImageNet and CIFAR100.
• Figure 4: Average PSNR over the images reconstructed by the CAH attack w.r.t the batch size and the number of attacked neurons on ImageNet and CIFAR100.
• Figure 5: PSNR values of images reconstructed by the RTF attack w.r.t different transformations and different batch sizes on ImageNet and CIFAR100. The green triangle denotes the average PSNR over all reconstructed images. (WO = Without OASIS, MR = Major Rotation, mR = Minor Rotation, SH = Shearing, HFlip = Horizontal Flip, and VFlip = Vertical Flip)

Theorems & Definitions (2)

• Proposition 1
• proof