In federated learning (FL), data does not leave personal devices when they are jointly training a machine learning model. Instead, these devices share gradients, parameters, or other model updates, with a central party (e.g., a company) coordinating the training. Because data never "leaves" personal devices, FL is often presented as privacy-preserving. Yet, recently it was shown that this protection is but a thin facade, as even a passive, honest-but-curious attacker observing gradients can reconstruct data of individual users contributing to the protocol. In this work, we show a novel data reconstruction attack which allows an active and dishonest central party to efficiently extract user data from the received gradients. While prior work on data reconstruction in FL relies on solving computationally expensive optimization problems or on making easily detectable modifications to the shared model's architecture or parameters, in our attack the central party makes inconspicuous changes to the shared model's weights before sending them out to the users. We call the modified weights of our attack trap weights. Our active attacker is able to recover user data perfectly, i.e., with zero error, even when this data stems from the same class. Recovery comes with near-zero costs: the attack requires no complex optimization objectives. Instead, our attacker exploits inherent data leakage from model gradients and simply amplifies this effect by maliciously altering the weights of the shared model through the trap weights. These specificities enable our attack to scale to fully-connected and convolutional deep neural networks trained with large mini-batches of data. For example, for the high-dimensional vision dataset ImageNet, we perfectly reconstruct more than 50% of the training data points from mini-batches as large as 100 data points.

翻译：在联邦学习（FL）中，当个人设备联合训练机器学习模型时，数据不会离开这些设备。相反，这些设备与协调训练的中央方（例如公司）共享梯度、参数或其他模型更新。由于数据从未"离开"个人设备，联邦学习常被标榜为隐私保护技术。然而，近期研究表明这种保护不过是层薄纱——即便是仅被动观测梯度的"诚实但好奇"攻击者，也能重建参与协议的个体用户数据。在本工作中，我们提出一种新型数据重建攻击，使主动且不诚实的中央方能够从接收的梯度中高效提取用户数据。尽管先前关于联邦学习数据重建的研究依赖求解计算昂贵的优化问题，或对共享模型架构/参数进行易被察觉的修改，而我们的攻击中，中央方只需在向用户发送模型前，对共享模型权重进行不易觉察的修改。我们将这些修改后的权重称为陷阱权重。我们的主动攻击者能够完美（即零误差）恢复用户数据，即便这些数据来自同一类别。恢复成本近乎为零：该攻击无需复杂的优化目标。相反，我们的攻击者利用模型梯度固有的数据泄露特性，通过陷阱权重恶意篡改共享模型权重，从而简单放大这一效应。这些特性使我们的攻击可扩展至使用大批量数据训练的深度全连接网络与卷积神经网络。例如，针对高维视觉数据集ImageNet，我们从多达100个数据点的批次中完美恢复了超过50%的训练数据点。