Federated learning updates reveal private data better with path integral method
A Path Integral Surrogate for Multi-Step Gradient Inversion in Federated Learning
Machine LearningDistributed, Parallel, and Cluster Computing
Summary
Federated learning promises privacy by sharing only updates to a model, not raw data. However, attackers try to reverse-engineer private images from these updates. The authors improve this type of attack by modeling the update as a path integral, which better captures what happens during multiple training steps. This leads to more accurate reconstruction of private images from the updates, tested on popular image datasets.
What this means in practice
- •For federated learning security teams: Improve assessment of privacy risks by better reconstructing private inputs from shared model updates in federated learning.
- •For machine learning auditors: Use advanced inversion techniques to evaluate privacy leakages in multi-step client updates within federated learning deployments.
Authors
Agnivo Ghosh, Saumik Bhattacharya
Abstract
Federated learning lets many clients train a shared model together without ever sending their private data to a central server. Each client shares only a model update, and this update should reveal far less about the client than its raw training examples would. This premise is what protects the privacy of the clients. Gradient inversion attacks challenge it directly by trying to reconstruct a client's private input images from the single update it shared. Under FedAvg, a client's update accumulates several local training steps, so the server sees only the two endpoints of a hidden weight trajectory. Recent gradient inversion attacks fit a surrogate model along the path between these two endpoints but they still read its gradient at a single point. We propose the Path-Integral Surrogate Model Extension (PI-SME) which treats the accumulated update as a path integral of the gradient field and approximates it by Gauss--Legendre quadrature over several nodes along a learnable Bézier path. On CIFAR-100 and FEMNIST images across a range of trajectory lengths and class-restricted batches PI-SME reconstructs the private inputs more faithfully than the strongest surrogate baseline on several inversion metrics and the matching loss.