Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes to recover training data from gradient updates in federated learning. Specifically, it leverages an auxiliary dataset to obtain the gradients for these samples. A neural network model is then trained on them by mapping the gradient to the input. This paper also utilizes existing feature hashing method to reduce the dimensionality of the input gradient. The evaluation is conducted on one image classification dataset and one language task. The experimental results show the proposed method has better attack performance compared to existing techniques against different defense techniques.
strength_and_weaknesses: ### Strength

+ Important topic of gradient inversion attack
+ Easy to follow


### Weaknesses

- Unrealistic assumption
- Limited novelty
- Impractical evaluation setup
- Limited evaluation


### Detailed comments

* In the threat model, the paper assumes "the FL protocol does not leverage secure aggregation", which is an unrealistic assumption. The purpose of secure aggregation is to avoid revealing private information to other parties in a distributed setting such as federated learning. The paper discards the secure aggregation and builds an attack on top of such an unrealistic assumption. In addition, it assumes the gradient for each sample in the batch (actually it assumes the batch size is 1), which is impractical. It is not meaningful to study the problem in such a setting.

* This paper leverages an auxiliary dataset to train a model for mapping the gradient to the input. Similar ideas have already been studied in many existing works. The dimensionality reduction issue is addressed by directly using an existing feature hashing technique. There is very limited technical contribution in this paper.

* The paper uses the term "auxiliary dataset" to denote a dataset different from the training data by the subject model. However, in the evaluation, the paper directly uses the training data that the subject was trained on to construct their gradient inversion model, which is impractical.

* The evaluation is conducted on both computer vision and natural language processing, which is good. However, only one dataset in each domain is evaluated. The model used on the computer vision task is LeNet, which is a very simple model structure. There is no evaluation on advanced and complex model structures.

* Important details are missing in the paper. There is no data showing the performance of the subject model on corresponding tasks. The baseline GI-GIP uses ImageNet to train the generator in the original paper. It is unclear whether the authors directly use the trained generator from GI-GIP or retrain the generator on CIFAR-10. If it is the former case, the comparison is not considered fair.
clarity,_quality,_novelty_and_reproducibility: ### Clarity, Quality, Novelty

Please see detailed comments in Strength And Weaknesses.

### Reproducibility

The submission includes the code. However the baselines are missing from the code. Without the aforementioned details regarding baselines, it is hard to reproduce the results.
summary_of_the_review: This paper studies an important problem. However, the proposed method is based on unrealistic and impractical assumptions and settings. The technical novelty is also limited.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper investigates potential privacy risk in federated learning. They found that existing privacy defenses in FL can be broken via a simple adaptive attack. In particular, the proposed learning-based approach (Learning to invert) aims to train an inversion model to reconstruct training samples from their gradient with the help from auxiliary dataset.  Experiments demonstrate the effectiveness of the proposed model. 

strength_and_weaknesses: Strength:
1. The research problem is very important and this paper provides a simple but effective attacking method to conduct gradient inversion attacks in federated learning. 
2. This paper is easy to follow and clearly written.  
3. The experimental results demonstrate the effectiveness of the proposed method. 


Weaknesses

There are some concerns regarding this paper.

1. Auxiliary datasets are used to help learn the inversion model for privacy attacks in FL. In such cases, this task can be considered as a malicious server that wants to steal private information from some clients. The attacker task is weird to me. To steal information from one client, why not just a serve and a client pair, and attack this client directly? Such an attacking strategy is not hard to achieve. 

2. The batch size is set to 1. When the batch size increases, the proposed method can perform much worse. This may limit their applications to many real-world tasks, where many FL methods would consider using large batch sizes. Meanwhile, it's somehow unfair compared with other privacy attacks in FL.

clarity,_quality,_novelty_and_reproducibility: N.A
summary_of_the_review: Strength:
1. The research problem is very important and this paper provides a simple but effective attacking method to conduct gradient inversion attacks in federated learning. 
2. This paper is easy to follow and clearly written.  
3. The experimental results demonstrate the effectiveness of the proposed method. 


Weaknesses

There are some concerns regarding this paper.

1. Auxiliary datasets are used to help learn the inversion model for privacy attacks in FL. In such cases, this task can be considered as a malicious server that wants to steal private information from some clients. The attacker task is weird to me. To steal information from one client, why not just a serve and a client pair, and attack this client directly? Such an attacking strategy is not hard to achieve. 

2. The batch size is set to 1. When the batch size increases, the proposed method can perform much worse. This may limit their applications to many real-world tasks, where many FL methods would consider using large batch sizes. Meanwhile, it's somehow unfair compared with other privacy attacks in FL.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper introduces a new gradient inversion method in Federated Learning. The proposed approach called "Learning To Invert" (LTI) directly attempts to learn the mapping between the gradient of a sample and the corresponding input sample using an auxiliary dataset.  A simple multi-layer perceptron (MLP) is used to learn this mapping. Dimensionality reduction is applied to the gradients to make the MLP practically feasible. The paper asserts that current defense mechanisms such as Sign Compression, Gradient Pruning, and Gaussian Perturbation cannot defend against the proposed attack, because the same transformations can be applied by the server before it learns to reconstruct. The method is evaluated on vision and language tasks (CIFAR10, WikiText).
strength_and_weaknesses: Strengths: 
1.	Evaluation of the proposed method for both vision and language tasks. 
2.	Comparison of LTI with current SOTA gradient inversion attacks.
3.	Ablation results based on the auxiliary dataset (both degree of overlap and size of the dataset).

Weaknesses:

1.    The attack works only in the presence of an auxiliary dataset (which has some overlap with the client distributions) at the server. Hence, the comparison with SOTA gradient inversion methods is not fair. For a fair comparison, other inversion methods should be updated to make use of the auxiliary dataset. When $\beta=0$ (no overlap between the auxiliary and training sets), the MSE of the proposed method is the worst. Note that even for $\beta=0.01$, there will be significant number of common samples between the two sets, which explains the superiority of the proposed method. Ideally, Tables 1 & 2 and Figures 2 & 4 should be reported for low values of $beta$ (< 0.1) or with an auxiliary dataset that is completely different (some other natural image and NLP dataset that is different from the training).

2.  The main experimental setup is designed such that the training samples and samples in the auxiliary dataset are the SAME. Furthermore, the gradients are computed based on a single sample. So, effectively there is one-to-one mapping between a sample and its gradient, which any network can easily learn (all one needs is a indexing table!). So, the results in Table 1 and Figure 2 are unsurprising - in fact, it is somewhat underwhelming because exact reconstruction should be possible in this setting unless there is loss of some information in the dimensionality reduction step. 

3. There is no information about how the proposed approach will scale to higher fidelity data (say, images of 224 x 224 x 3 resolution). The MLP approach is likely to become practically infeasible for higher fidelity data.

4. The other key aspect that is missing is the FL round in which the reconstruction is attempted. Several works in the literature have shown that reconstruction is easier in the first few rounds (when training from scratch), while it becomes harder in the later rounds. That is why multiple rounds of local training is typically carried out before the collaboration starts and this serves as a good defense against gradient inversion attacks. 
clarity,_quality,_novelty_and_reproducibility: The paper is well written. However, the novelty is limited and the experiments are not comprehensive.There are no concerns about the reproducibility.
summary_of_the_review: The paper tackles an important problem in FL, but the assumptions involved are unrealistic, the novelty is limited, and the experiments are not comprehensive.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper presents a simple learning-based gradient inversion attack. The new method is trained using auxiliary data and can learn how to invert gradients on both vision and language tasks.  A new learning function is built to learn model parameters on the auxiliary data.  
strength_and_weaknesses: 1. To learn the parameter theta, a large number of auxiliary data are required. This is also a limitation of the proposed method. A challenging problem would be reduce the number of the auxiliary data while keeping the performance. 
2. The learning function of eq.(2) is simple yet powerful. A new algorithm is expected to show the learning steps with data input/output and all the parameters used in the algorithm. 

clarity,_quality,_novelty_and_reproducibility: The codes and data are available. 
summary_of_the_review: See the above.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a new gradient inversion attack against federated learning. By assuming that the server has access to some auxiliary data, the main idea of the paper is to learn a gradient inversion model from the auxiliary data. The paper shows that compared with previous optimization-based approaches such as Inverting Gradients (IG), Gradient Inversion with Generative Image Prior (GI-GIP), and TAG, the proposed learning to invert (LTI) method obtains better reconstruction accuracy on both an image task (CIFAR-10) and a language task (Wikitext), under both gradient perturbation and compression based defenses. 
strength_and_weaknesses: Strengths

1. The idea of learning an inversion model using auxiliary data seems a simple yet effective approach. 
2. Ablation studies show that even when the auxiliary data only consists of 500 images sampled from CIFAR-10 or contains 250 in-distribution samples, LTI still outperforms IG and GI-GIP, which is impressive. 

Weaknesses

1. An important limitation of the proposed approach is that it only works for gradients computed from a single data sample. For a real FL system, even without using secure aggregation, a local update from a client is obtained by taking the gradient of a batch of data samples or through multiple gradient descent steps. Thus, the proposed approach is not sophisticated enough to be applied to real FL systems. 
2. Another limitation is that the proposed attack method is only tested against gradient perturbation and gradient compression, which were not originally designed for countering gradient inversion. It would be useful to understand how the proposed method performs against more recent defenses, such as Soteria [1], that target gradient inversion. 

[1] Jingwei Sun, Ang Li, Binghui Wang, Huanrui Yang, Hai Li, and Yiran Chen. Soteria: Provable defense against privacy leakage in federated learning from representation perspective. CVPR 2021.

clarity,_quality,_novelty_and_reproducibility: Multiple global models are generated during the FL training process.  An important detail that is unclear is which of them are used to train the gradient inversion module and which of them are used to evaluate the attacks and defenses. It is unlikely that the same model can be used for both purposes in practice, given the amount of time needed to train the gradient inversion module. Thus, the question is whether a module trained using early FL models can be effective for the inversion task against new FL models.  A related question is whether it is easier or harder to perform inversion attacks at the earlier stage of FL training. 

The idea of training a gradient-inversion module using a small amount of auxiliary data seems novel.
summary_of_the_review: The paper departs from existing optimization-based methods and proposes a simple learning-based approach to gradient inversion against federated learning. The approach is effective in the simple setting when the batch size is 1, and the server adopts gradient perturbation or gradient compression-based defenses. It is unclear if it can be applied to practical FL systems with larger batch sizes and strong defenses. Thus, the claim that existing defenses provide a false sense of security may not hold.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This work proposes a method for recovering training data from gradient updates in federated learning. The method uses an auxiliary dataset to obtain the gradients for the samples and trains a neural network model to map the gradient to the input. The paper also uses feature hashing to reduce the dimensionality of the input gradient.

Reviewers concerns:
- The use of an auxiliary dataset is not novel. Hence, there is a question of the overall novelty of the method.
- The threat model makes unrealistic assumptions, such as the absence of secure aggregation and a batch size of 1 and client size of 4 (which are both very small). 
- The comparison to SOTA gradient inversion methods is not fair because other methods could also make use of the auxiliary dataset. 
- The paper does not discuss how the proposed approach would scale to higher fidelity data or the impact of the FL round on the success of the attack.

My concerns:
- The use of an auxiliary dataset with a possibly different distribution than the training data requires careful analysis due to the change in distributions. I do not see this analysis in the paper.

Authors may find the following parallel work interesting: https://arxiv.org/abs/2206.07758
justification_for_why_not_higher_score: No positive reviewer. The authors did the bare minimum in the rebuttal and did not address most of the questions.
Decision: Reject