Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: This paper proposes a new gradient attack method named R-GAP. R-GAP decomposites the DNN gradient attack problem into subproblems for each layer, and recursively solves each of them. The subproblem of each layer is formulated as a least-square reconstruction problem.

The authors further point out the rank of network weight matrix is (non-surprisingly) correlated with the difficulty of input recovery. Based on this finding, they design a metric based on the weight matrix rank to estimate the feasibility of fully recovering data.
Experimental results on MNIST and CIFAR10 show that the proposed method R-GAP is comparable or superior to the classic DLG method. The authors also claimed the proposed method to be much faster than DLG baseline.

Strengths:
1. Gradient attacks raise data privacy concerns in many applications such as federated learning, making it an important problem.
2. As an analytical method to solve the input reversion problem, R-GAP should have its intrinsic advantage over previous optimization-based gradient attack (O-GAP) methods such as DLG. For example, in my assumption (and also claimed by the authors), R-GAP can be much faster than O-GAP.
3. R-GAP has much better performance than DLG on full-rank CNN6 networks, as shown both visually and numerically in Figure 3 and Table 1. This shows that if the attacked model satisfies the full-rank condition, R-GAP can be both faster and more effective than DLG. 

Weakness:
1. Insufficient experiments.
My largest concern is over the lack of necessary experiments to show the advantage of R-GAP. 
i. Why only showing results on a self-designed CNN6 network? In order to fairly compare with DLG, and also to show the general effectiveness of the proposed method, the authors should also consider comparing with DLG on some standard network, such as the LeNet benchmarked in many previous gradient attack works [1,2].
This is very important also because we need to see whether the popular deep models such as LeNet, VGG, ResNet, etc. satisfy the full rank condition required by the proposed method. If not, the proposed R-GAP will have limited application scenarios. 
ii. Why not compare with more recent gradient attack methods such as iDLG [2], which has been shown to also outperform the original DLG [1]?
iii. The authors claimed the proposed method is much faster than DLG. Although I agree this is intuitively true, I think it necessary to report the numbers in the paper. For example, how much time/FLOPs does it take to attack a single image for each method?

2. Additional tricks used without detailed description in the Method section. 
In Table 1, the authors show that R-GAP is largely outperformed by DLG on the rank-deficient network CNN6-d. However, according to the authors' vague descriptions, simply adding a smoothing operation can largely improve R-GAP performance. (I assume H-GAP = R-GAP + image smoothing?) Is the image smoothing the main technique making the proposed method effective?
This is really confusing since neither H-GAP nor image smoothing is mentioned in the method/related work sections. I suggest the authors to provide more descriptions about the H-GAP method and also provide explanations why it largely outperforms R-GAP.

I'm willing to increase my score if these concerns are properly tackled during the rebuttal period.

Other comments:
1.  The artifacts of DLG reconstruction images are mainly located on the corner of the images (see Figure 2), while the artifacts of DLG are evenly distributed on the whole images (see Figure 3). Is this a general trend? If yes, any explanations or intuitions behind this?
2. The proposed RA-i is only using matrix rank to predict the hardness of input recovery. In my view, it might be better to consider using matrix condition number as the metric. This is because the sub-problem at each layer is basically a least-square regression problem, and two least-square regression problems can have different difficulties when the matrix have identical ranks but different condition numbers. In other words, condition number contains more information than rank, and thus might be more useful. (Please point out if I'm wrong here.)

Reference

[1] Deep leakage from gradients.

[2] iDLG: Improved Deep Leakage from Gradients. 

Update: The authors have addressed my concerns and now I vote for acceptance.
review_title: Review

final_score: rating: 6: Marginally above acceptance threshold
review_content: The authors proposed a theoretical explanation of the gradient attack on privacy. To be specific, a closed-form approach, namely recursive gradient attack on privacy has been proposed to explain how the gradients can be used to recover the original data. Moreover, the authors also presented a rank analysis method that is used to estimate the risk of being gradient attacked. Overall, this paper is easy to follow and well-written. I have a few concerns as follows:
1. In Eqn.10, the authors assume the activation function is ReLU or LeakyReLU. In that case, the recursive form will be held. I guess whether the limitation for this method would be the activation function has to be ReLU or LeakyReLU? For instance, sigmoid and tanh activation functions are also widely used. Whether the proposed method is able to address those? If not, what would the reconstruction errors be.

2. I am a little bit confused by the equations (19) and (20). When the activation functions are non-linear, how the authors define V? Also, how does V affect the layer rank? Maybe the conclusion below equation (20) is not very straightforward to me. 

3. As for the networks that used in this paper, I wonder when residual connections are used, how the rank deficiency problem would be?

4. The follow-up question is when the network is very deep, like DenseNet and ResNet, whether the conclusions of this paper will hold? 

5. The symbols in Algorithm 1 should be consistent to the context. More importantly, I would suggest the authors highlight the correspondences between the equation and the algorithm diagram.

6. Practical usage is one of my concern. In practice, researchers or engineers may use very deep models for practical problems. If the authors could demonstrate a more practical model, that would make this submission very strong. 
review_title: This paper addresses a distributed and federated learning based gradient attack techniques, which explains how gradients can lead to recovery of original data.

final_score: rating: 7: Good paper, accept
review_content: This paper studies the problem of gradient attack in deep learning models. In particular,  this paper tries to form a system of linear equations to find a training data point when the gradient of the deep learning model with respect to that data point is available. The algorithm for finding the data point is called R-GAP.

Strengths: 
1. The idea of the paper is simple and interesting. The main idea is that for a deep learning model with $d$ layers, we can form $d$ systems of linear equations that can be solved recursively. Solving the last system of linear equations gives us the reconstructed data point. 
2. Moreover, because R-GAP is using systems of linear equations, it is very easy to know/analyze the feasibility of the R-GAP algorithm.
3. In contrast to (Phong et al. (2018)), the proposed method works for CNNs as well. 

Weaknesses: 
1. The contribution of the paper seems limited. This paper extends the method of (Phong et al. (2018)). More precisely, (Phong et al. (2018)) forms a system of equations only with respect to the first layer. The current paper does the same thing for $d$ layers.

2. This paper compares R-GAP with the DLG algorithm. However, there is an improved version of the DLG algorithm called iDLG (Zhao et al. (2020)). Therefore, more numerical examples are required to compare R-GAP with iDLG. 
3. This paper situates itself in the Federated Learning (FL) literature. However, in FL problems, each node reports the gradient with respect to the whole local training data points (not a single data point). Therefore, it is not realistic to assume that the central node or an adversary has access to the gradient with respect to one data point. I believe batch DLG (Zhu et al., 2019) is a better attack method in an FL setting. 

Update: I would like to increase the score to 7. The authors have improved the paper and addressed my concerns.

review_title: This paper proposes a new gradient based attack which is able to reconstruct a data point when the gradient with respect to that data point is available

Meta-review: The major criticism of this paper after the initial reviews was a lack of experimental results on deeper and more modern architectures that include skip connections.  The authors added results to the paper to address these issues.
Decision: Accept (Poster)