Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes a theoretical Bayesian framework for the problem of gradient leakage in federated learning. It shows that recent gradient leakage attacks are approximations of the Bayesian framework with different prior distributions for the input and conditional distributions of the gradients given the input. The paper also claims that recent defense mechanisms are not good enough, especially during the early stages of training. 
main_review: 1) The theoretical formulation proposed in the paper is intuitive and appears to be mostly correct. 

2) The key limitation of the work is the lack of much practical impact, due to the following reasons.

(a) The paper admits that for most sophisticated defense mechanisms, it is not possible to define a Bayes optimal adversary. Instead the paper falls back on designing custom attacks for each of these defense mechanisms.

(b) It is also not surprising that most existing defense mechanisms are ineffective against early stages of training, which are most sensitive to the input data. As training progresses and the models converge, the inputs are expected to have little impact on the gradients. So, this cannot be considered as a significant finding.

(c) From Table 2, it appears that the Bayes optimal attack does not produce significantly better reconstructions compared to existing attacks (l_2 and cos), except in the case where pruning is involved (last two rows). Furthermore, the paper does not claim reduction in the computational complexity of the attack using the Bayes optimal attack. Thus, there appears to be no major benefit from using the Bayesian framework.

(d) The ablation study (Figure 4) shows that even for the simplest distributions, mis-specification of the prior and conditional distributions can lead to sub-optimal reconstruction. For real-world inputs, it may be simply impossible to precisely define the prior and conditional distributions to carry out a Bayes optimal attack.
summary_of_the_review: The proposed Bayesian formulation for gradient leakage is reasonable, but has little practical significance because it neither provides an easier way to break sophisticated defense mechanisms nor does it lead to better reconstructions. The design of attacks against recent defense mechanisms (Soteria, ATS, and Precode) may be a useful contribution, but does not merit a publication in itself. 

Since the authors have managed to show that the proposed attacks can be derived as approximations of the Bayes optimal adversary and are not purely custom designed, I have updated the rating.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The submission "Bayesian Framework for Gradient Leakage" discusses privacy attacks against federated learning based on gradient inversion. In the first part of this work, a range of existing attacks is unified in a Bayesian setting. In the middle part of this work, three existing defenses are analyzed and broken by adaptive attacks. In the final part of this work, an attack based on estimation of the optimal Bayesian adversary is evaluated against several classical defenses and compared to other objectives.
main_review: In summary I think this is an interesting submission. The unification of existing attacks in a Bayesian sense (while maybe not thrilling from a purely theoretical point of view) is certainly a good idea and clearly described and executed and, to me, the strongest part of this work. The experiments in Sec. 6 then show that this viewpoint can have tangible benefits. However I am torn regarding the section on breaking existing defenses. While these are great attacks and I liked to read this section, it does feel disconnected from the rest of the paper. None of the insights from the Bayesian framework seem to help in creating these adaptive attacks.

Some more comments and questions regarding the experimental evaluation below:

* After the introduction of the Bayesian framework in Sec. 4 it does seem a bit disappointing that the only Bayesian attack evaluated in Sec. 6 operates with k=1 Monte-Carlo samples. It would have been great to see an ablation of the effects (or the lack thereof) of a range of values of k.
* If k=1 and p(g|x) is Gaussian, how does the proposed attack differ from the attack of Yin et al. with Langevin noise (from a random Gaussian distr.)? The order of gradient computation and noise addition differs, but it is not clear to me if this is a meaningful distinction in the Bayesian sense.
* For Sec. 6, Table 2 it would be interesting to complete the selection of objectives and also show results for an $\ell^1$ objective, which would be the optimal adversary for Laplacian noise when $\delta\to0$.
* The data distribution $p(x)$ appears somewhat under-utilized after its introduction in Sec. 4. For example, for the TV regularization, the optimal $\alpha$ could have been tuned by fitting the distribution to measured data instead of grid-searching all possible alpha in terms of final PSNR of the attack. Also, would the results in Table 2 be strengthened or weakened when using a stronger data prior such as e.g. the  DeepInversion prior from Yin et al.?
* In terms of discussions of priors, Table 1 should also contain a mention of Jeon et al., who do spend time on searching for closer approximations to $p(x)$ in several ways.
* One particular prior effect that appears in some previous work but sometime falls under the radar is the prior knowledge that all real images are drawn from the bounded set  $[0,1]^n$  (for $n$ the number of pixels). Did the authors experiment with this (although arguably relatively weak) prior as well?
* Also in Table 2, the authors also compare to pruning. However it is not clear to me whether $p(g|x)$ takes the pruning into account in those rows?
summary_of_the_review: I have a positive outlook on this submission. Classifying and unifying previous attacks in a single framework and clarifying the optimal choice of regularizer and objective is a helpful contribution to the community. 

I do have several questions regarding the experimental evaluation that I would like for the authors to answer and I would be interested in a clarification why the inclusion of Sec. 5 should be part of this submission and its connection to the overall Bayesian framework discussed in this work.

--------------------------------------------- After Author Responses: --------------------------------------------

The authors have adressed my concerns during the response period. This lead me to increase my score from 6 to 8.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper provides a gradient leakage attack via Bayes optimal adversary. The authors also demonstrate that existing attacks can be seen as approximations of Bayes optimal adversary. Empirically, this paper shows some heuristic defenses fail under the proposed attack.
main_review: After reading author's response: review remains unaltered.

Strengths:
1. The unification of several existing attacks is interesting. 
2. The paper is well-written.


Weaknesses:
1. It would be better if the authors could introduce more details of how to approximate p(x) and p(g|x). Estimating it from data is known to be a hard problem. Does this mean the attack may fail on a large-scale dataset?

summary_of_the_review: This paper is overall well-written. The proposed method is simple and empirically effective.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper introduces a framework to address issues in the leakage of information through gradients. This paper claims to provide Bayes optimal adversary as an optimization problem which other attacks can be considered as an approximation of this framework. Some experiments are provided to support their claims. 
main_review: + This paper is well-written, easy to follow. Provides sufficient background and literature review.
+ The framework is straightforward yet makes sense. The mathematical results seem to be derived correctly. 
+ Linking the existing attacks to their framework is interesting. 
-  As mentioned in the paper the Bayesian adversary loss is intractable, thus providing some kind of approximation for it would have been better. 
- It is not clear to me even though as mentioned by the authors we do not have any sort of effective defense, what are the authors' suggestions in that regard as the paper is based on that. Could the authors please elaborate on that?
- Section 6, the existing attack section contains interesting results but I fail to see the relevance to this paper. It has taken most of the section without justifying its importance to the proposed framework. 
- This paper suffers from the lack of a wide range of experimental results to back up the claims. The experimental results must cover compassion to other techniques in addition to accenting the importance of each experiment. 
-  The lack of provided details in the paper, however, the code for experimental results must not be considered due to the late submission of their codes. Authors should provide more details regarding their experiments. 


summary_of_the_review: - Even though the assumptions seem to be correct, the contribution of the paper is extermley simple and straightforward. 
- The experimental results seem to be insufficient as it is only compared to two other methods. The experiment section is written poorly and the importance of each section is not justified.
review_title: null

Meta-review: The paper formalizes the problem of gradient leakage through a Bayesian framework. They show that existing attacks can be viewed as approximations of a Bayesian optimal adversary. The empirical results show that heuristic defences are not good against stronger attacks and that the early part of the training is particularly vulnerable. There was a lively discussion in the reviews and rebuttal and the outstanding questions of the reviewers have been answered.
Decision: Accept (Poster)