Federated learning was introduced to enable machine learning over large decentralized datasets while promising privacy by eliminating the need for data sharing. Despite this, prior work has shown that shared gradients often contain private information and attackers can gain knowledge either through malicious modification of the architecture and parameters or by using optimization to approximate user data from the shared gradients. However, prior data reconstruction attacks have been limited in setting and scale, as most works target FedSGD and limit the attack to single-client gradients. Many of these attacks fail in the more practical setting of FedAVG or if updates are aggregated together using secure aggregation. Data reconstruction becomes significantly more difficult, resulting in limited attack scale and/or decreased reconstruction quality. When both FedAVG and secure aggregation are used, there is no current method that is able to attack multiple clients concurrently in a federated learning setting. In this work we introduce LOKI, an attack that overcomes previous limitations and also breaks the anonymity of aggregation as the leaked data is identifiable and directly tied back to the clients they come from. Our design sends clients customized convolutional parameters, and the weight gradients of data points between clients remain separate even through aggregation. With FedAVG and aggregation across 100 clients, prior work can leak less than 1% of images on MNIST, CIFAR-100, and Tiny ImageNet. Using only a single training round, LOKI is able to leak 76-86% of all data samples.

翻译：联邦学习旨在通过无需数据共享来保障隐私，从而在大型去中心化数据集上实现机器学习。尽管如此，先前研究已表明，共享梯度常包含隐私信息，攻击者可通过恶意修改架构和参数，或利用优化方法从共享梯度中近似用户数据来获取信息。然而，以往的数据重建攻击在设置和规模上存在局限，大多数工作以FedSGD为目标，且将攻击限制为单客户端梯度。在更实际的FedAVG设置或使用安全聚合汇总更新的情况下，许多此类攻击失败。数据重建难度显著增加，导致攻击规模受限和/或重建质量下降。当同时采用FedAVG和安全聚合时，目前尚无方法能在联邦学习环境下并发攻击多个客户端。本文提出LOKI，该方法克服了先前局限，并打破了聚合的匿名性——泄露的数据可被识别，且直接关联到其来源客户端。我们的设计向客户端发送定制化卷积参数，使各客户端数据点的权重梯度即使在聚合后仍保持分离。在跨100个客户端的FedAVG和聚合场景下，先前方法在MNIST、CIFAR-100和Tiny ImageNet上只能泄露不到1%的图像。仅需单轮训练，LOKI即可泄露所有数据样本的76%-86%。