Federated Learning (FL) has emerged as a promising approach for collaborative model training without sharing private data. However, privacy concerns regarding information exchanged during FL have received significant research attention. Gradient Inversion Attacks (GIAs) have been proposed to reconstruct the private data retained by local clients from the exchanged gradients. While recovering private data, the data dimensions and the model complexity increase, which thwart data reconstruction by GIAs. Existing methods adopt prior knowledge about private data to overcome those challenges. In this paper, we first observe that GIAs with gradients from a single iteration fail to reconstruct private data due to insufficient dimensions of leaked gradients, complex model architectures, and invalid gradient information. We investigate a Temporal Gradient Inversion Attack with a Robust Optimization framework, called TGIAs-RO, which recovers private data without any prior knowledge by leveraging multiple temporal gradients. To eliminate the negative impacts of outliers, e.g., invalid gradients for collaborative optimization, robust statistics are proposed. Theoretical guarantees on the recovery performance and robustness of TGIAs-RO against invalid gradients are also provided. Extensive empirical results on MNIST, CIFAR10, ImageNet and Reuters 21578 datasets show that the proposed TGIAs-RO with 10 temporal gradients improves reconstruction performance compared to state-of-the-art methods, even for large batch sizes (up to 128), complex models like ResNet18, and large datasets like ImageNet (224*224 pixels). Furthermore, the proposed attack method inspires further exploration of privacy-preserving methods in the context of FL.

翻译：联邦学习（FL）作为一种无需共享私有数据即可进行协作模型训练的方法，已展现出广阔前景。然而，FL过程中交换信息所引发的隐私问题已获得大量研究关注。梯度反转攻击（GIA）被提出用于从交换梯度中重建本地客户端保留的私有数据。在恢复私有数据时，数据维度和模型复杂度的增加阻碍了GIA的数据重建。现有方法采用关于私有数据的先验知识来应对这些挑战。本文首先观察到，由于泄露梯度维度不足、复杂模型架构以及无效梯度信息，基于单次迭代梯度的GIA无法重建私有数据。我们提出了一种基于鲁棒优化框架的时间梯度反转攻击方法，称为TGIAs-RO，该方法通过利用多个时间梯度，无需任何先验知识即可恢复私有数据。为消除异常值（例如，协作优化中的无效梯度）的负面影响，我们引入了鲁棒统计方法。同时，我们提供了TGIAs-RO关于重建性能及其针对无效梯度的鲁棒性的理论保证。在MNIST、CIFAR10、ImageNet和Reuters 21578数据集上的大量实验结果表明，所提出的TGIAs-RO使用10个时间梯度即使在较大批量大小（最多128个）、复杂模型（如ResNet18）和大规模数据集（如ImageNet，224×224像素）下，重建性能也优于现有最先进方法。此外，本文提出的攻击方法为FL场景中隐私保护方法的进一步探索提供了启示。