Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper considers the interesting Federated Learning problem of recovering latent code data using gradient information, in the presence of additional prior knowledge and without. For an unknown dataset $\{(x_i,y_i)\}_{i=1}^B$, where $y_i$ is the label of $x_i$, the task is to find $x_i$ given gradient of $l(f_\theta(x_i),y_i)$ with respect to $\theta$. Here, $f_\theta$, is a classifier with parameters $\theta$ and $l$ is a appropriate loss function. 

In the case where a generative prior on the dataset $\{x_i\}$ is known, the paper introduces the Gradient Inversion in Alternate Spaces (GIAS) algorithm that searches the latent code space of the generator to match the known gradients. In the case where a generative prior is not known, the paper introduces the Gradient Inversion to Meta-Learn generative model (GIML) algorithm, which, in two stages, learns weights of a generative model and searches the latent code case of the approximate generative model to match the gradients (up to a regularization term). The paper is primarily focused on the implementation of these algorithms. Experimental results were provided to show the efficiency of the proposed algorithms on real datasets.
main_review: The paper provides a sufficient description of prior work. However, some sentences used in the paper are not clear or have errors. For example: 
1. Lines 53-55
2. Line 66: propose should be proposed
3. Is BN in Line 73 Batch Norm? This needs to be made clear.
4. Lines 75-77 
5. Lines 94-96
6. Lines 265-266

To my knowledge, the paper assumes that the classifier $f_\theta$ is known (or at least the architecture on $f_\theta$ is known). Is this a valid and reasonable assumption in practice?

Is there anything we can say about the number of gradients we need to accurately recover/estimate the dataset. For the case when the generative model is not known, is it in the order of $k$ (the latent code dimension)? What about when the generative model is known? A discussion would be helpful.

What is the motivation for line 11 in Algorithm 2. 

In practice, how does one assume the architecture of the generative model if such a model is not known a prior?
limitations_and_societal_impact: The paper discusses its limitation in the conclusion.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper proposed training a generative model for gradient inversion. Specifically, the authors proposed learning generative models by leveraging a generative image prior and learn a generative model for each data within one gradient inversion task. Empirical results show that the proposed GIAS and GIML outperforms baselines in applications of federated learning.
main_review: The paper proposed a novel method to optimize objective (3) using a generative model by searching latent space and parameter space. In Algorithm 1, the author proposed first searching the latent space then searching the parameter space. However, it is not clear to me why it is not done in an alternate fashion. Firstly, the authors seem to decompose (3) into (6) and (8). With algorithm 1, only (8) is satisfied. There's the z_i's solved by (6) no longer minimize (3) given the solutions in (8). Clarification of why algorithm 1 is the desired method should be stated here.

The proposed GIML algorithm learns a generative model. In the experiment, a DCGAN is learnt by the proposed algorithm. However, learning a GAN requires real image data. What is used as the real image data here? In the scenario of federated learning, who is doing the gradient inversion? The server or other clients. If the server is inverting the gradient, does that mean the server need to store a public dataset. Moreover, if the public dataset distribution is highly heterogeneous with the local data distribution, what would the performance be. In the experiment section, the heterogeneity of client data distribution is not discussed. I think it would significantly improve the experiment results if the relation between performance and heterogeneity level is presented.
limitations_and_societal_impact: Limitations and suggestions are listed in the main review.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The submission "Gradient Inversion with Generative Image Prior" investigates privacy attacks against federated learning which invert gradient information sent by users to uncover private information. They authors propose generative models as tools to improve inversion, utilizing both optimization in latent space and parameter finetuning of such generative models. This approach improves the success rates of gradient inversion attacks against image classification (and especially best-case PSNR).
main_review: Overall I think this work is a reasonable improvement of gradient inversion attacks against federated learning. The idea to utilize prior knowledge via generative models is good and executed well. I have a several main comments which I would like the authors to consider:

Comments:
* I would like to see a larger discussion of [23] (Wang et al., Beyond Inferring Class Representatives) in the related work section, which is an older work in the gradient inversion literature, but also involves training a GAN to aid in the reconstruction (although not quite in the way the authors describe here, but it would be good to delineate the differences of both approaches explicitly)
To a lesser degree this comment also applies to works such as [Hitaj et al, Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning]
* In [9] (Geiping et al, Inverting Gradients), small prior effects are noticed when considering GI-x reconstruction from the gradients of trained models. For the given submission I am not quite clear whether the authors consider a randomly initialized ResNet-18 model are a trained model. In any case, does the beneficial effect of the generative model increase or decrease when switching from random to trained parameters?
* Feedback from practitioners of federated learning about gradient attacks has often focussed on the perceived security of larger image batches (via e.g secure aggregation) and gradient noise (as main component of differential privacy). It would be great if the authors could plot the success of the proposed reconstruction approach (possibly in the best-PSNR case) over a large range of batch sizes (up to 48 or even 128?) and gradient noise levels. This would be an extension of Fig.3. While there is of course the expectation that all attacks fall off significantly with larger batch sizes, the relative gains in falloff over previous attacks can be instructive for many readers (especially if the authors could show that their method has a noticeably slower falloff rate than others, which is difficult to make out from Fig.3 currently). Alternatively a measure of success along the lines of Fig.8 in [25] (Yin et al, See through gradients) could be investigated.
* If I understand l236 correctly then this submission does not investigate a comparison to the full attack scheme of [25]? This is understandable, given the recency of that work, but it would be great if the authors could ultimately provide a clearer comparison between both attack schemes to confirm that the improvements of the generative model stack even with the full attack of [25]


Minor comments that do not influence my assessment:
* I think the authors could title this paper "Gradient Inversion with Generative Image Priors" (note the added _s_). The usage of "generative image prior" in the singular feels a bit off to me grammatically and further brings up associations with works such as "Deep image prior" and its successors, even though a deep image prior is not "the prior" used in this work (as StyleGAN is used). This could be avoided with a different title.
* The paper could benefit from another round of proof-reading by the authors to iron out minor grammatical inconsistencies.
limitations_and_societal_impact: The authors propose an improved attack against privacy in federated learning. They appropriately discuss the societal impact of this measure in a separate subsection.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The contributions of this paper are mainly two-fold:
1) Gradient inversion in alternative spaces (GIAS) that improves reconstruction with the help of the prior from generative models;
2) Gradient inversion to meta-learn (GIML) which learns a generative model via inverting multiple gradients computed on the data.
Via experiment results, this paper shows that GIAS with pretrained generative models can result in privacy leakage, and GIML can learn generative models from only gradients.
main_review: This paper proposes GIAS and GIML with improvements from baseline methods, while it might be better to provide more support on their effectiveness.

This paper compares the proposed GIAS with several other methods thoroughly via experiments. While I wonder if there are more theoretical justifications behind the effectiveness of the proposed searching mechanism in the latent and model parameter spaces.

On the other hand, how is the generalizability of GIML for more complex tasks? As 32x32 qualitative examples shown in Figure 4, there are substantial gaps between the reconstructions and the ground truths.


limitations_and_societal_impact: As the authors acknowledged in the section of "societal impact and limitation", this paper mainly focuses on how using generative model prior can facilitate gradient inversion to reveal data. It would nice (and also necessary to some extent) to discuss possible defensive strategies especially against the methods proposed in this paper.
review_title: null

Meta-review: The reviewers all agreed that this is an interesting paper and a worthy improvement over existing gradient inversion attacks against federated learning. I agree with the reviewers: the paper is clearly written and the many experimental results are worthy of publication. The paper will, at the very least, serve as an important motivation for further research on privacy in federated learning. I do caution the authors to take the suggestions made by the reviewers and the changes proposed in their rebuttal seriously and improve the manuscript in terms of related work and additional experiments.

It is also essential for the authors to implement what they promised in their rebuttal to the ethics reviewers in the final version of the paper. Critically, an experiment to demonstrate a potential fundamental defense mechanism and replacing human-face images in the paper's quantitative evaluation should be considered as "mandatory" revisions. I agree with the ethics reviewers that the authors' response helps assuage the ethical concerns (assuming that changes will be made to the final version).
Decision: Accept (Poster)