GUIDE: Enhancing Gradient Inversion Attacks in Federated Learning with Denoising Models

TL;DR

Federated Learning reduces data sharing but remains vulnerable to Gradient Update Inversion Attacks that reconstruct private inputs from updates. GUIDE introduces diffusion-based denoising as a generic, attack-agnostic augmentation that trains a denoiser on noisy reconstructions generated from a surrogate dataset, then refines base attacks to produce higher-fidelity reconstructions. Across two realistic attack scenarios, GUIDE yields substantial gains in PSNR and perceptual similarity (DreamSim), with improvements up to 46% in perceptual alignment and notable robustness to distribution shifts and certain defenses. The work highlights that privacy leakage can be amplified by tailored denoisers while also illustrating the limitations of defenses like DP when base attacks remain effective, underscoring the need for stronger, defense-aware privacy protections in FL.

Abstract

Federated Learning (FL) enables collaborative training of Machine Learning (ML) models across multiple clients while preserving their privacy. Rather than sharing raw data, federated clients transmit locally computed updates to train the global model. Although this paradigm should provide stronger privacy guarantees than centralized ML, client updates remain vulnerable to privacy leakage. Adversaries can exploit them to infer sensitive properties about the training data or even to reconstruct the original inputs via Gradient Inversion Attacks (GIAs). Under the honest-butcurious threat model, GIAs attempt to reconstruct training data by reversing intermediate updates using optimizationbased techniques. We observe that these approaches usually reconstruct noisy approximations of the original inputs, whose quality can be enhanced with specialized denoising models. This paper presents Gradient Update Inversion with DEnoising (GUIDE), a novel methodology that leverages diffusion models as denoising tools to improve image reconstruction attacks in FL. GUIDE can be integrated into any GIAs that exploits surrogate datasets, a widely adopted assumption in GIAs literature. We comprehensively evaluate our approach in two attack scenarios that use different FL algorithms, models, and datasets. Our results demonstrate that GUIDE integrates seamlessly with two state-ofthe- art GIAs, substantially improving reconstruction quality across multiple metrics. Specifically, GUIDE achieves up to 46% higher perceptual similarity, as measured by the DreamSim metric.

Figures (5)

• Figure 1: Comparison of reconstruction results on images when the model update is calculated over 256 images at $224 \times 224$ resolution using the VGG-16 model. (a) Reconstruction with CPA cpa_attack, (b) Reconstruction with CPA cpa_attack enhanced with GUIDE(ours), (c) Original Images.
• Figure 2: GUIDE overview. During the setup phase (i), the server constructs a denoising dataset $D_{den}$ by using model updates $\nabla'$ generated from the shared model $f_\theta$, a surrogate dataset $D'$, and the attack procedure $\mathcal{A}$ to produce noisy images (1). The attacker then trains a denoising model (2) on this newly created dataset $D_{den}$. During the reconstruction phase (ii), the client performs local training steps on private data (3), resulting in a model update $\nabla$ that is sent to the server (4). The attacker then applies the attack procedure $\mathcal{A}$ to generate noisy reconstructions of the client's data (5) and subsequently improves the quality of these reconstructions by using the diffusion-based denoising model trained in the earlier phase (6).
• Figure 3: Example of reconstructions obtained by different methods on 12 images in Scenario . The gradient is computed over 256 images with a resolution of $224 \times 224$ with the VGG16 model. All the images are not included in any noisy image seen during the training of the denoising models. (a) Images reconstructed with CPA cpa_attack. (b) Reconstruction with CPA cpa_attack enhanced with GUIDE(ours). (c) Original images used to compute the gradient.
• Figure 4: (a) Examples of images generated by CPA cpa_attack at various stages of the attack ($\mathcal{S}_{iters} = \{2000, 8000, 16000, 20000, 24000\}$) when gradients are computed over a batch of 256 images. (b) Reconstructed image obtained by starting from the image of (a) and applying denoising with a blended model. The denoising model demonstrates an ability to enhance reconstruction quality even in the early phases of the attack, as evidenced by lower DreamSim values.
• Figure 5: Example of reconstructions obtained by different methods on 8 images in Scenario . The model update is computed over 16 images with a resolution of $128 \times 128$ with the ResNet-18 model. All the images are not included in any noisy image seen during the training of the denoising models. (a) Images reconstructed with ROG rog_attack. (b) Images reconstructed with ROG rog_attack enhanced with GUIDE (ours). (c) Original images used to compute the gradient.