GI-NAS: Boosting Gradient Inversion Attacks Through Adaptive Neural Architecture Search

TL;DR

GI-NAS presents a two-stage gradient inversion attack that leverages neural architecture search to adaptively select an over-parameterized generator architecture for each gradient batch. A training-free search uses the initial gradient matching loss $L_{grad}$ to identify an optimal model $G_{opt}$ from a space of diverse upsampling and skip-connection configurations, followed by stage-2 optimization of $G_{opt}$ parameters to maximize data reconstruction fidelity from gradients. Across CIFAR-10 and ImageNet, GI-NAS achieves state-of-the-art reconstruction quality even with high-resolution images, large batch sizes, and defense mechanisms, underscoring a critical privacy vulnerability in practical FL deployments. The work also analyzes NAS design choices, computational costs, and robustness to initialization and data heterogeneity, and discusses implications for defense, including potential victim-side NAS strategies on FL models.

Abstract

Gradient Inversion Attacks invert the transmitted gradients in Federated Learning (FL) systems to reconstruct the sensitive data of local clients and have raised considerable privacy concerns. A majority of gradient inversion methods rely heavily on explicit prior knowledge (e.g., a well pre-trained generative model), which is often unavailable in realistic scenarios. This is because real-world client data distributions are often highly heterogeneous, domain-specific, and unavailable to attackers, making it impractical for attackers to obtain perfectly matched pre-trained models, which inevitably suffer from fundamental distribution shifts relative to target private data. To alleviate this issue, researchers have proposed to leverage the implicit prior knowledge of an over-parameterized network. However, they only utilize a fixed neural architecture for all the attack settings. This would hinder the adaptive use of implicit architectural priors and consequently limit the generalizability. In this paper, we further exploit such implicit prior knowledge by proposing Gradient Inversion via Neural Architecture Search (GI-NAS), which adaptively searches the network and captures the implicit priors behind neural architectures. Extensive experiments verify that our proposed GI-NAS can achieve superior attack performance compared to state-of-the-art gradient inversion methods, even under more practical settings with high-resolution images, large-sized batches, and advanced defense strategies. To the best of our knowledge, we are the first to successfully introduce NAS to the gradient inversion community. We believe that this work exposes critical vulnerabilities in real-world federated learning by demonstrating high-fidelity reconstruction of sensitive data without requiring domain-specific priors, forcing urgent reassessment of FL privacy safeguards.

Figures (7)

• Figure 1: Quantitative and qualitative results when randomly attacking $3$ different batches by $5$ different models on ImageNet. In Figure \ref{['fig:introduction_quantitative']}, the first, second, and third rows are respectively from Batch $1$, Batch $2$, and Batch $3$.
• Figure 2: Overview of the proposed GI-NAS attack. We leverage a two-stage strategy for private batch recovery. In the first stage, we traverse the model search space and calculate the initial gradient matching loss (i.e., our training-free search metric) of each model based on the fixed input $\mathbf{z_0}$. We regard the model that achieves the minimal initial loss as our best model, for its performance at the start can stand out from numerous candidates. In the second stage, we adopt the architecture of the previously found best model and optimize its excessive parameters to reconstruct the private data.
• Figure 3: The design of search space for skip connection patterns. Different skip connection patterns are determined by the skip connection matrix $\mathbf{A} \in \{0, 1\}^{t \times t}$. $\mathbf{A}_{ij} = 1$ indicates that there exists a skip connection from $e_{i}$ to $d_{j}$ and $\mathbf{A}_{ij} = 0$ means that there is not such a skip connection.
• Figure 4: Qualitative comparison of GI-NAS to state-of-the-art gradient inversion methods on ImageNet ($256 \times 256$) with the larger batch size $B = 32$.
• Figure 5: Correlation between the initial gradient matching loss and the actual PSNR performance on CIFAR-10 ($32 \times 32$) and ImageNet ($256 \times 256$) with the default batch size $B = 4$.