Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.
review_content: summary: This paper first evaluate current gradient inversion attacks for both implicit and explicit model changes. It shows that when the batch norm mode, training epochs, skip connection or channel size is different, the result of gradient inversion attacks also changes. Finally, it proposes angular lipschitz smoothness and shows its positive correlation to the success of gradient inversion attacks.
strengths_and_weaknesses: ### Strengths
1. It is the first paper to study gradient inversion attacks on the different settings of training procedures and models, including batch-norm mode, skip connection and channel size.
2. Its second part tries to find another signal, which is able to indicate the leakage in the end. Such signal, if it has good performance, would be useful in practice.
3. The paper is well structured.

### Weaknesses
The main weakness of this paper is that some experiment results are not very reliable and and some conclusions from the results are ambiguous.
1. Results of BN: 
    (a). Why all MSE numbers in table 1 are mostly larger than 1? If all images are lying in the 0-1 cube, MSE > 1 means nothing recovered.  However, results from previous work already shows the success of image recovery at some setting of BN.
    (b). What is the conclusion from the BN experiment results?
2. Results of skip connection: why the gradient inversion attack is failed for the ConvNet? [1] and its following work all shows the success for ConvNet.
3. Results of channel size: the result "the reconstruction quality worsens as the number of channels increases for BN set to the train mode" is lack of explanation.
4. Angular Lipschitz smoothness: The intuition from theorem 1 is that smaller L means faster dropping at one step of optimization. However, it doesn't mean the minimum value of L_grad^x would be smaller, i.e. the reconstruction result is better. As the experiment details are missed in both main text and appendix, I am hypothesizing it is likely due to the unfair optimization set-up, e.g. the larger L_grad might need more iterations to converge, etc.

As for the experiment set-up, what gradient inversion attack is evaluated for those experiments?

[1] Zhu, Ligeng, Zhijian Liu, and Song Han. "Deep leakage from gradients." Advances in neural information processing systems 32 (2019).

-------After Discussion--------

I have read all responses and I'll keep my score. Thank the authors for the clarification and the additional experiment results. I hope authors can improve their paper by incorporating these results in the revision and improve their writing by highlighting the conclusions for each setting (BN, skip connection, training stages etc.) with the clear conditions.
questions: See weaknesses for details.
limitations: Yes, the authors fairly describe the limitations.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper works on the privacy attacks in the black-box FL setting, specifically using the gradient inversion methods. The contribution is on the image tasks and empirically solid. Different aspects of models are systematically evaluated to identity the vulnerability to privacy attacks. The authors also propose a new measure, the angular Lipschitz constant, to measure the privacy risk.
strengths_and_weaknesses: Strength:

Overall the paper is well-written and tackles a clear task. The FL privacy is an important and practical concern, especially in the black-box setting in which the authors have worked on. The motivation of an honest-but-curious host could be realistic. Empirically speaking, the ablation study of BN modes, number of channels, skip connection, etc. is thorough. From a theoretical viewpoint, the proposed angular Lipschitz constant has nice properties (scale-invariance); the theorem has a premise reasonably justified.

Weakness:

My main concern is the impact of this paper: the experiment is limited to one simple dataset, thus limiting my confidence that the trends observed in this paper can hold in a broader range of cases (see more comments in "Limitations"). All conclusions except the scale-invariant property of the new Lipschitz measure are empirical, which requires more experiments to support the trends claimed in the paper.

questions: See "Weakness" and "Limitations".
limitations: The limitations are discussed in the paper. However, I believe there could be additional limitations that worth consideration. 

For example, the experiment is very limited, only CIFAR datasets are tested, which contains tiny images only. It would be desirable to understand how the gradient inversion attack work on moderate images (e.g. CelebA or ImageNette) and even maybe on language samples.
review_title: null

final_score: rating: 2: Strong Reject: For instance, a paper with major technical flaws, and/or poor evaluation, limited impact, poor reproducibility and mostly unaddressed ethical considerations.
review_content: summary: The submission "Foreseeing Privacy Threats from Gradient Inversion Through the Lens of Angular Lipschitz Smoothness" is concerned with gradient inversion attacks in federated learning. The first part of this submission contains additional results and ablation studies about the success conditions of such attacks. The second part proposes a new measure of vulnerability that is claimed to be a key to client-sided defenses.
strengths_and_weaknesses: I, unfortunately,  have several points of criticism with this work, which I will list out below:

* This submission analyzes gradient inversion attacks as developed around 2019/2020, but of the analysis given in this submission has been included in other work also evaluating these attacks since. Questions brought up concerning batch normalization have been  already been analyzed in works such as Huang et al., "Evaluating Gradient Inversion Attacks and Defenses
in Federated Learning", from last year's NeurIPS. Solutions to the normalization question have then been proposed in Hatamizadeh et al., "Do Gradient Inversion Attacks Make Federated Learning Unsafe?". Whether labels are required was also discussed in Huang et al., and work such as Wainakh et al, "User Label Leakage from Gradients in Federated Learning" have made strides towards showing that label knowledge is not a requirement for a succesful attack. The impact of training state in recovery success has been discussed several times, from Zhu et al, "Deep Leakage from Gradients", Geiping et al., "Inverting Gradients - How easy is it to break privacy in Federated Learning" and also appears in follow-up work such as Wei et al., "A Framework for Evaluating Gradient Leakage Attacks in Federated Learning".

* The submission states that choices in Zhu et al., were based on the unavailability of automatic differentiation. Yet, AD was certainly already developed and present in 2018! These paragraphs in the related work are incorrect, and it is unclear what "computed the loss in closed form" here should mean. The existence of closed form solutions (which Zhu et al. do not employ, as they also backpropagate gradients using AD) is unrelated to the smoothness of the loss function. Zhu et al. use smooth activations because their optimization strategy is based on an L-BFGS solver that nominally requires well-defined higher-order derivatives. Later works use adaptive first-order optimizer and hence drop this requirement.

* I am doubtful about the proposed black-box setting. The submission proposes a black-box setting in which the global model parameters are hidden from the user, but the user application requires these parameters to compute the update gradient. The parameters have to be send to the user device, and the user has full control over their device, so the users necessarily have access to model parameters as well. 

* Further, for a user to use known inversion attacks to gauge their loss of privacy is an inherently unsafe proposal. Even if a user uses these attacks themselves and finds that they cannot reconstruct their data, this is no guarantee of privacy! These attacks can only be used to prove vulnerabilty, never to ascertain safety.

* The introduction mentions evaluation of additional models. However in the experimental section I find only the ConvNet and ResNet variations used in previous work?

* Minor: The cited work by Bauschke, Bolte and Teboulle is one of their few work where Lipschitz smoothness of the gradient in the classical sense is not actually required, in contrast to how this work is cited here.

* I like the general idea of the section concerning angular Lipschitz smoothness, but the concept makes up such a small part of the submission that it is difficult to quantify its effectiveness. The submission shows some correlation with attack success if measured in LPIPS, but the correlation is not overly strong and it is unclear whether this is a strong argument for robustness. LPIPS scores are only be a limited measure of safety. The main question here would be whether some threshold of angular Lipschity smoothness would imply that no reconstruction succeeds. The measure discussed in Yin et al., "See through gradients" might be helpful here. Further it would be necessary to discuss whether this measure is robust to adaptive attacks, meaning whether this proposed measure can be "gamed" by the attacker in some way. For example, angular smoothness might correlate with gradient obfuscation which would undermine its effectiveness.


* From a more general vantage point, I do think that this submission makes a categorical mistake about the nature of safety. The submission shows scenarios where the (even unmodified) baseline attack works more or less well and concludes from this that the attack should be evaluated in more scenarios, but this misses the asymetric nature of safety research. It is not necessary for a single attack to work optimally in all scenarios, in each scenario the question is whether an attack could exist that breaks privacy. Will small modifications as discussed in this work, categorically defeat all attacks and prove a reliable defense in the future? Will angular smoothness defend against adaptive attacks that circumvent gradient matching losses?
questions: Maybe I misunderstood the intent of the submission concerning the black-box setting. I would be glad about a correction or additional insights why this is a meaningful setting.
limitations: The submission discussses some limitations, however limitations of the proposed measure are not discussed. There is not enough evidence presented whether this really would be a key factor in future defenses.
review_title: null

final_score: rating: 3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.
review_content: summary: This paper studied the gradient inversion problem where an honest-but-curious server aims to reveal clients’ private data from model weights and gradients shared by clients in federated learning (FL). The paper first evaluated SOTA gradient inversion algorithms (mainly [6] with an additional BN-related loss term), under implicit model variations (different BN modes and training epochs with the same model architecture) and explicit variations (different model architectures). The evaluation showed that the reconstruction results vary across model variations both qualitatively and quantitively. The paper then proposed a measure of angular Lipschitz constant to indicate the outcome of reconstruction, which was shown to be stronger correlated with LPIPS and attack loss drop than gradient norm.
strengths_and_weaknesses: Strengths:
- The paper addressed an interesting problem of evaluating gradient inversion algorithms for different models. A systematic experimental study may help gain insights about the mechanism of gradient inversion.
- The paper made a good summarization on the optimization-based gradient inversion approach and related prior art in Section 2.
- The paper showed some interesting results regarding the BN train mode. Firstly, the inversion achieves the best quantitative performance at early training stages (e=5). Secondly, the inversion achieves best results for ResNet18 than for ResNet18-2 and ResNet18-4, showing that wider networks are not necessarily easier to attack.

Weaknesses:
- The main contribution of this paper seems ambiguous. The title and abstract suggest that the paper mainly proposes a new measure, angular Lipschitz constant, for assessing inversion attacks, but a large body of the paper focuses on re-evaluation of existing methods over model variations. While the re-evaluation is valuable, it should be more clearly stated as primary results or just motivational study.
- The scope of re-evaluation of SOTA algorithms in this paper overlaps with [10], which focused on evaluating gradient inversion attacks and defenses. In particular, [10] evaluated the algorithm in [6] with BN loss term (as in equation (2) of this paper), and considered different settings on knowledge of BN statistics. What is the difference between the BN settings of this paper and [10]? A detailed discussion and comparison with [10] would be beneficial.
- The re-evaluation of SOTA algorithms was performed on limited variations. If the empirical study is positioned as the primary contribution, a wider range of models may be considered, such as initialization schemes (pre-trained or random) and random seeds for implicit variations, and more architectures beyond ResNet18 with different widths for explicit variations.
- The paper only considered CIFAR100 images in experiments, but not higher-resolution (e.g. ImageNet) images.
- The paper motivates the proposed angular Lipschitz constant measure with the case that clients may only have access to gradients provided by the server. However, wouldn’t the client need white-box access to compute gradients using private local data for model training in FL? If the client only has black-box access, what is the interplay between model training, gradient inversion, and risk assessing (Section 4)? And how does the client compute the measure (in Line 277) through random sampling?

questions: - The paper mentioned about knowledge of target labels and batch size in previous work. What are the related settings in experiments of this paper? Batch size may be an important factor for observing the effect of BN modes on the performance.
- It is stated in Line 168 that the server “can send a global model with BN layers set to any mode”. But BN modes are about whether to use running mean/variance or current batch’s mean/variance in BN layers, and the computation is done on clients. How can an honest-but-curious server alter the BN mode without being noticed?
- The computation of the angular Lipschitz constant (defined in Line 277) is done through randomly sampling from Gaussian. Can this measure be manipulated by scaling the input x^*, for fixed variance of Gaussian noises? Is the input x^* normalized to compute the measure?
- In the theoretical result, the loss is guaranteed to monotonically decrease only when the step size \mu is small enough (optimally =1/(2L^2)). Are the learning rates sufficiently small in experiments?
- What is \delta in Lines 458, 465 and 466?
- BN statistics are used in two places in the inversion process, one in equation (2) as a loss term, and another in the BN layers of the networks (in train/eval modes). Which one affects the performance of inversion algorithms more significantly?

limitations: The paper discussed limitations in Section 5.
review_title: null

Meta-review: metareview: Several analyses provided in the paper are not novel and known in the literature. The black-box setting is not properly motivated and impractical. The angular Lipschitz constant is a good contribution, but it seems to be only a small part of the paper. For these reasons, the reviewers are not convinced that the contribution of this paper is significant enough.
confidence: Certain
Decision: Reject