Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: Gradient inversion in federated learning is often constrained by the lack of labels. Current label restoration methods are limited to class-wise label restoration, which is to infer the presence of a category. This paper introduces a new method to infer instance-wise labels in federated learning, i.e., the number of instances per class. Based on several approximations, the labels can be restored by solving a linear equation system using a pseudo-inverse algorithm. The authors then empirically explore how well this works in practice. Some results of the compatibility with model inversion attacks are also presented. 
strength_and_weaknesses: Strength:
1. The proposed method is compatible with gradient inversion attacks and can be plugged in to enhance current optimization-based methods.

2. Instead of optimization-based methods, this paper utilizes a method based on a pseudo-inverse algorithm.

Weakness:
1. Since the instance-wise label is the number of instances per class, how can this number be used with a model inversion attack? For example, IG attack assumes there is only one image per class in a batch, so it seems that with this attack, there is no large difference between previous class-wise label restoration and instance-wise label restoration.

2. Continued with point 1, what is the improvement of instance-wise restoration compared with class-wise restoration? Could you please give some application scenarios where this method surpasses the class-wise one?

3. I do not quite understand some of the approximations or assumptions in this paper as follows. 
  (1) In the last of the Approx 1, you mention that "it is observed that the variance of \|e\| over the whole batch is so small". Could you please provide any theoretical analysis or any empirical results to explain this?
  (2) Approx 2 is based on the assumption that the gradients in $\mathbb{B}_i$ is dominant in the approximation of the gradients at index $i$. But what is the influence of label distribution in a batch to the restoration results? What if the number of class $i$ is much smaller than other classes (i.e., an extremely unbalanced batch)? Are there any results for this?
  (3) Approx 1 assumes the embeddings $e$ and the gradients of $L$ w.r.t. $z$ are similar over a certain class. The Approx 2 assumes the gradients in $\mathbb{B}_i$ is dominant. It is easier to understand this in a well-trained model. But what is the performance in the early training stage? Or could you please figure out whether the model used in the experiments is pre-trained or randomly initialized?
  (4) Could you please explain more about the Approx 3 of softmax? Why or when does this approximation hold?

Minor comments:
1. Superscript $j$ is used in Approx 1 without explanation, although it is explained in section 3.2.

2. In section 3.2, I think $k_j$ is the same as $|B_j|$. Is it correct?
clarity,_quality,_novelty_and_reproducibility: This is an interesting work with originality. But the there are still some concerns of mine which limits the novelty. Please refer to the previous comments. 
summary_of_the_review: This is an interesting paper, but from my point of view, it relies on many assumptions to support the approximation and method proposed in this paper. There is a lack of evidence for these assumptions. Additionally, the improvement of this method compared with class-wise restoration seems limited. If the author can provide some motivation or results of the previously mentioned assumptions, I will raise my score.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This manuscript studies the instance-level label restoration in mini-batch training under the federated learning structure. The authors proposed a strong method that is capable of restoring labels via gradient inversion attack even when batch size is as large as 4096, which was usually considered a challenging task. This is achieved by estimating the class-wise averaged embedding (to which authors improved over [1]) to estimate the class-wise averaged predicted probabilities, and then using the Moore-Penrose algorithm to solve the linear equation systems formulated by the class-wise averaged predicted probabilities and the bias gradients.

[1] Sun, Jingwei, et al. "Soteria: Provable defense against privacy leakage in federated learning from representation perspective." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.
strength_and_weaknesses: Pros:
1. Authors studied a non-trivial research question, which is how to recover the training labels in federated learning through the gradient inversion attack when the batch size is large and the number of classes is more than two. With such information, the features of training samples could be better inferred, hence posing more server threats to the security of federated learning. 
2. Compared with existing work, this work does not need the strong assumption that the categories in the same batch must be small or equal to two.
3. This work empirically shows that the training labels can be accurately inferred even when the training batch is 4096, to the reviewer’s best knowledge, this is a new record and can without doubt boost the performances of most of the gradient inversion attacks.
4. Authors insightfully leverage the averaged post-softmax probabilities, to link the label recovery and class-wise averaged embeddings via Equation (4) and (5). 

Cons:
1. Authors pointed out that existing work might fail when the activation function can yield negative values. However, I did not see how the authors' proposed method can solve this.
2. I’m interested in the situation when there is no bias for the FC layer since the absence of bias is rare - but not impossible. In that case, is the reconstructed class-wise embedding reduced to the embedding produced by [1]? Also, while the authors make the justification that leveraging bias gradients can be helpful, I recommend authors make ablation studies to compare the quality of the class-wise embedding learned by [1] and authors’ method, which could make the authors’ contribution more convincing. 
3. After we know the number of instances per class within a batch, how do we assign the labels to each individual instance? If we don't do so, can authors elaborate on how only knowing the count of each class within a batch can help recover features?
4. When there are some basic defensive strategies applied (such as DP noise and gradient pruning), what are their influence on the authors' method?

The aforementioned "Cons" are not necessarily the limitations, but some clarifications/ablation studies that I'm interested in.

[1] Sun, Jingwei, et al. "Soteria: Provable defense against privacy leakage in federated learning from representation perspective." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.
clarity,_quality,_novelty_and_reproducibility: $\textbf{Clarity}$: While this paper is overall well-written, authors should try to improve the clarity of the paper, some long sentences in the manuscript make the ideas behind really hard to follow. Authors are encouraged to use intuitive and simple explanations in sections that are important for the audience such as Section 2.2 and Section 3.2. 

$\textbf{Quality}$: I believe this paper is of high quality, authors provide an appendix to supplement additional information, and they released their well-structured implementation code as well as a comprehensive readme and experiment log.

$\textbf{Originality}$: A large part of this work is based on the discovery made by Sun $\textit{et. al}$ [1], however, the authors also made a non-trivial supplement to the existing work that leads to significant empirical results. Thus I believe this paper has considerable novelties.

$\textbf{Reproducibility}$: After examining the code and experiment log, this work is believed to be reproducible.



summary_of_the_review: Overall, this is a well-written paper which I'm leaning towards accepting. The authors' proposed method makes intuitive sense and the motivation is clear, the experiments are comprehensive. The score will be increased upon the satisfactory and convincing rebuttal regarding the questions in “Cons”.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper presents to perform instance-wise batch label restoration from only the gradient of the final layer, to extract labels from gradients. The core idea is to establish linear equations of the gradients, probabilities and labels to derive the Number of Instances (NoI) per class by the Moore-Penrose pseudoin-verse algorithm. For this purpose, this paper designs two metrics and performs empirical studies that achieve state-of-the-art performance on three benchmark datasets.
strength_and_weaknesses: Strength：
This paper considers the more real-world settings in gradient inversion attacking of Federated Learning (FL), where there are multiple instances of each class in a training batch. Besides, this paper derives the equation to design the algorithm.

Weakness：
- The paper is somewhat clear, but some important details are missing or unclear. For example, does the model of server share the same network architecture with the model of clients in Figure 1？Moreover，in Figure 2，how do servers and clients interact？Is the iLRG method run on the server side?
- The authors leverage Intra-class High Similarity and Inter-class Low Entanglement. However, this may assume that the server can obtain the labels of clients, which violates the privacy setting of FL.
- There are missing ablation experiments with the experimental part. For example, which of the intra-class high similarity and inter-class low entanglement contributes more to the result？

Question:
What judgment does the server use to determine similar or dissimilar classes in section 3.1？

clarity,_quality,_novelty_and_reproducibility: Clarity: The paper is somewhat clear, but some important details are missing or unclear.

Quality: The paper appears to be technically sound. 

Novelty: The paper contributes some new ideas or represents incremental advances.

Reproducibility: Key details are sufficiently well-described for competent researchers to confidently reproduce the main results.
summary_of_the_review: Please see Q1 and Q2.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper studies instance-wise batch label restoration in the realm of federated learning. It proposes an analytic method which requires merely the gradient of the final layer. This work implements Moore-Penrose pseudoinverse algorithm to estimate the Number of Instances (NoI) per class by solving a linear system. Reviewers think this paper is novel and is strongly supported by experiments. One reviewer thought that the work does not need strong assumptions for recovering labels and the empirical results are state-of-the-art. I think the paper will be of interest to Federated learning researchers. I suggest acceptance. 

justification_for_why_not_higher_score: It still lacks a strong theoretical results.
justification_for_why_not_lower_score: This paper is novel and is strongly supported by experiments. The work does not need strong assumptions for recovering labels and the empirical results are state-of-the-art.
Decision: Accept: poster