Instance-wise Batch Label Restoration via Gradients in Federated Learning
Authors: Kailang Ma
Yu Sun
Jian Cui
Dawei Li
Zhenyu Guan
Jianwei Liu
Venue: ICLR 2023 poster (2023)
Keywords: federated learning
batch label restoration
gradient inversion attack.

Abstract: Gradient inversion attacks have posed a serious threat to the privacy of federated learning. The attacks search for the optimal pair of input and label best matching the shared gradients and the search space of the attacks can be reduced by pre-restoring labels. Recently, label restoration technique allows for the extraction of labels from gradients analytically, but even the state-of-the-art remains limited to identify the presence of categories (i.e., the class-wise label restoration). This work considers the more real-world settings, where there are multiple instances of each class in a training batch. An analytic method is proposed to perform instance-wise batch label restoration from only the gradient of the final layer. On the basis of the approximate recovered class-wise embeddings and post-softmax probabilities, we establish linear equations of the gradients, probabilities and labels to derive the Number of Instances (NoI) per class by the Moore-Penrose pseudoinverse algorithm. Our experimental evaluations reach over 99% Label existence Accuracy (LeAcc) and exceed 96% Label number Accuracy (LnAcc) in most cases on three image datasets and four classification models. The two metrics are used to evaluate class-wise and instance-wise label restoration accuracy, respectively. And the recovery is made feasible even with a batch size of 4096 and partially negative activations (e.g., Leaky ReLU and Swish). Furthermore, we demonstrate that our method facilitates the existing gradient inversion attacks by exploiting the recovered labels, with an increase of 6-7 in PSNR on both MNIST and CIFAR100. Our code is
available at https://github.com/BUAA-CST/iLRG.

Published as a conference paper at ICLR 2023
LNSTANCE-WISE BATCH LABEL RESTORATION VIA GRADIENTS IN FEDERATED LEARNING
Kailang Ma, Yu Jian Cui, Dawei Li, Zhenyu Guan, Jianwei Liu School Cyber Science and Technology. Beihang University, China {makail Lang, sunyv, cui jianw, lidawei, guanzhenyu, 1iu Linjianeee
ABSTRACT
Gradient inversion attacks have posed serious threat to the privacy of federated learning. The attacks search for the optimal pair of input and label best match- ing the shared gradients and the search space of the attacks can be reduced by pre-restoring labels. Recently, label restoration technique allows for the extrac- tion of labels from gradients analytically, but even the state-of-the-ard remains limited to identify the presence of categories (i.e., the class-wise label restora- tion). This work considers the more real-world settings, where there are multiple instances of each class in training batch. An analytic method is proposed perform instance-wise batch label restoration from only the gradient of the final layer. On the basis of the approximate recovered class wise embeddings and post- softmax probabilities, we establish linear equations of the gradients, probabilities and labels to derive the Number of Instances (Nol) per class by the Moore-Penroos pseudoinverse algorithm. Untrained models are most vulnerable to the proposed attack, and therefore serve as the primary experimental setup. Our experimental evaluations reach over 99% Label existence Accuracy (LeAcc) and exceed 96% Label number Accuracy (LnAce) in most cases on three image datasets and four untrained classification models. The two metrics are used to evaluate class-wise and instance-wise label restoration accuracy, respectively. And the recovery is made feasible even with a batch size of 4096 and partially negative activations (c.g., Leaky ReLU and Swish). Furthermore, we demonstrate that our method fa- cilitates the existing gradient inversion attacks by exploiting the recovered labels, with an increase of 6-7 in PSNR on both MNIST and CIFAR100. Our code is available https///gttub.coo/BBAAAACCCCII
INTRODUCTION
Federated Learning (FL) is one of the most popular distributed learning paradigms to achieve privacy preservation and has attracted widespread attention (Jochems et al.] [016]] McMahan et 2017
Yang et al. 2019a), especially in privacy-sensitive fields such as healthcare (Brisimi et al. 2018 Sadilek et al. 2021) and finance (Yang al., 2019b] Long et al. 2020). FL requires participants to communicate the gradients or weight updates instead of private data on a central server, in principle, offering sufficient privacy protection.
Contrary to prior belief, recent works have demonstrated that shared gradients still leak sensi- tive information in FL. Multiple attack strategies preliminarily look into the issue despite their own limitations. For instance, Membership Inference (Shokri et al. 2017) allows the adversary to de- termine whether an existing data sample is involved in the training set. Property Inference (Melis) al. 2019) analogously retrieves certain attributes (e.g., people's race and gender in the training set). Model Inversion (Fredrikson et al.] 2015) utilizes the GAN (Goodfellow et al. (2014) model generate visual alternatives that look similar but are not the original data, An emerging research, i... Deep Leakage from Gradients (DLG) (Zhu et al. 2019), has showed the possibility of fully recovering input data given gradients in process now known as gradient inversion. This approach primarily rely on the gradient matching objective to perform the attack, i.e., optimizing a dummy
"Co-first authors.
Cooresponding author.

---

Published as a conference paper at ICLR 2023
imput by minimizing the distance between its gradient to target gradient sent from client. Further- more, enables pixel-wise accurate reconstruction on image classification tasks, and soon scales to deeper networks and farger-reoolution images in mini-batch (Geiping et al. 2020 Yin et al. 2021 Jeon et al.
2021 Li et al. 2022).
Gradient inversion jointly recovers private inputs and labels, whereas most works focus more on restoration of training samples. Label restoration is non-trivial, and it has been shown to be critical to high-quality data reconstruction. The optimization-basa
method for label recovery is not guaran- teed to succeed as well. Analytical extraction of the ground truth label from gradients produced by single sample (Zhao et al., 2020) was first made possible through an innovative observation of the gradient sign. Along this line, follow-ups (Yin et al. [202]] Dang et al.) (202]) extend this method to the recovery of labels in mini-batch with a high success rate. Despite remarkable progress, such attacks are applicable only when no two inputs in the batch belong to the same class. In real- world scenarios, there are multiple instances of each category, which means existing attacks can only determine which classes of samples are present at best. Moreover, most prior methods assume that the target model employs a non-negative activation function, and they fail to handle activation functions that might produce negative elements (e.g.. Leaky ReLU (Maas et al. 2013) and Swish [Ramachandran et al. 2017) in EfficientNet (Tan & Le (019
To this end, our work aims to identify the ground-truie truth label for each data point in one batch (i.e., instance- wisaeee-wsse labels). Firstly, we are able to recover class-wise averaged inputs (i.e., embeddings) to the final layer from its gradients with relative fidelity. The same approach can be proved perfectly correct in the single-sample case (Geiping et al. 2020). but here we require two empirical proper- ties (Sun al. (021)) make three approximations: intra-class uniformity and concentration of embedding distribution and inter-class low entanglement of gradient contributions. Then we derive that the gradient w.r.t. the network final logits equals the difference between the post-softmax prob- ability and the binary representation of the label, and expand it to a system of equations consisting of the gradients, probabilities and labels, where all three variables can be substituted or decomposed equivalently. We finally obtain Least Square Solution (ISS) of the Number of Instances (Nol) per class by the Moore-Penrose pseudoinverse algorithm.
Our main contributions are follows:
We propose an analytic method to recover the exact labels that a client possesses via batch- averaged gradients in FL. Following the approximate restoration of class-wise embeddings and post-softmax probabilities, a system of linear equations with the gradients, probabilities and la- bels is established to derive the Nol of each class by the Moore-Penrose pscudoinverse algorithm.
Our method outperforms prior attacks and poses a greater threat to the untrained model. In this case, it works large batch sizes of up to 4096, and handles classification models with partially negative activations as deep as ResNet-152 (He et al. (2016).
We demonstrate that gradient inversion attack can be combined with our batch label restoration to further improve its performance due to the reduced search space during optimization.
2
PREMILINARIES AND RELATED WORK
2.1 PROBLEM FORMULATION
Given a network with weights W and the batch-averaged gradient VW calculated from a batch of sample-label pairs, we expect to reveal instance-wise labels y via gradients. For each pair (x. y), we denote the embedding vector into the final layer as E RT the network final logits the post-softmax probability as p RC in range (0, 1), where m is the embedding dimension, C is the number of classes and here is the one-hot binary representation of the same shape as z. In the following sections, W E IR Cxm and b E Eº refer to the weight and bias of the final classification layer, respectively. Then we have 2 We b and p p= SooftMar
RC and
Threat Model: As prior works (Zhu et al. 2019 Geiping et al. 2020 Yin et al. 2021 Jeon et al. 2021 Li et al. 2022; Zhao et al. [2020] Dang al. | 12221). the adversary consider is honest- but-curious server with the goal of uncovering client-side labels, which gets access to the global model and shared gradients shown in Fig Ta). Our attack targets model architectures that contain
2

---

Published as a conference paper at ICLR 2023
Client
Server
Final Layer
SoftMax
Jay
Pandaa
Jay
Labels
Class-wise Probabilities
Jay:3, Punda:2, Gazelle:
Gazellle
Panda
Jay
Original Mini-Batch
Linear Equations/
VW vb
VW / vb
FL Model
Class-wise Embeddings
Gradients
(a) Thread Model
(b) Overview of The Proposed Method
Figure I: Illustration of the threat model and the proposed method.
at least one fully- connected layer and have a softmax activation with cross-entropy loss for clas- sification, such as fully-connected neural networks (FCN) and convolutional neural networks from shallow to deep L.Nett55 (LeCun et al. 1998). VGG (Simonyan & Zisserman 2014), ResNet (He et al. 2016), etc.
2.2 ANALYTIC LABEL RESTORATIONS
Prior analytical label restoration methods primarily rely on major observation. For a single sample, the derivative of the cross-entropy loss L w.r.t. the network final logit index i is Vz, pt -/i (See Appendix A for detailed derivation). This, obviously, leads to a unique negative sign for V able to access VW, instead of 22, While using the chain rule, we have VW; Va, x Vw, 2 Vaze"" As the embedding is independent of the class index i, the uniqueness of Vz sign is passed on to VW, Formally, we have V WW VW, V V2,, Vz. O. and Vatgee 0, such that the label
at the ground truth index However,
be identified by Because of the common use of non-negative activation functions (ensure that |/e|| 0), e.g., ReLU (Glorot et al. 2011) and Sigmoid, we can simply extract the ground-truth label whose VW, negative. This is exactly what iDLG (Zhao et al. 2020) does. Subsequently, the researchers (Yin al. 202T) observe empirically the magnitude of the negative gradient significantly exceeds that of the positive gradient assuming a non-negative non-linear activation function applied, which indicates negative sign can still stand out after averaging operations. Therefore, they search for negative signs using minimum values rather than summation along the feature dimension perform label restoration from batch-averaged gradients. However, without the assumption that ||el| 0, neither approach is viable any longer. Another batch label restoration method, Revealing Labels from Gradients (RLG) (Dang et al., 2021). offers a novel insight thus no need to satisfy that assumption. VW can be decomposed into PEQ by singular value decomposition, where P gmxs and Q E SxC are orthogonal matrices, E S*S in the middle is diagonal matrix with non-negative elements S rank( VWT) < min(m, C'.. If denote
inspecting whether VW; WWW I 0, Vjj +
the diagonal, and V2, then rQ V2, which means rq < O and r 0 (q' is the j-th column in Q). The problem of label recovery is then transformed into finding a classifier to separate qe from i by linear programming. Moreover,
VW can also be disassembled: VW Σ
K Vz'e
ZE where Z [Vz
Vz*]
1 je je'...,e" RmnK and K is the batch size. Assume that Z and E are full-rank RCCK E K
matrices, have K S min(m. C)2, the approach requires K not be large.
3

---

Published as a conference paper at ICLR 2023
2.3 SINGLE EMBEDDING RECONSTRUCTION
In deep neural network architectures, the fully-connected layer is vulnerable leakage from gradients for its simple design. A recent work, i.c., InvertngGradiemn (IG) (Geiping et al. 2020), has brought theoretical insights on this task by showing provable embedding reconstruction feasi- bility.
Theorem 1. For neural networks with a biased fully-connece layer (e.g. the final classification layer), presume the derivative of the loss L w.r.t. to the layer's output z contains at least one non- zero element, then the input to the fullyccnnnceee layers e can be uniquely reconstructed by analytic computation.
Proof. Consider the mapping z
We + b of biased full-connected layer without nonlinear dz 1 R²C. Due our assumption guarantees
Oz
activation, it's easy to observe that
OWe āb
0C
OC
OC
0z. 0C ac dC Oc x
* for some index i, we have
and ab. Oz dz, oW; 0z;
bb; Oz,
02, Dc e T
Oc e according to the chain rule. Therefore, e can be calculated exactly as db.
ow:
OC 1 ac
Ob; ow;
On the basis Theorem we are able to perfectly accomplish the analytic reconstruction a single input to fully fully-connected layer. Such a one-shot theoretical approach, however, cannot be extended directly to recover batch embeddings for unignorable information loss from the average operation.
3 METHODOLOGG
In this section, we propose method to restore instance-wise labels via batch-averaged gradients, which we refer to as instance-wise Labels Restoration from Gradients (iLRG). Our method consists of three main steps as shown in Fig I (b): (1) Reconstruct the class-wise embeddings by calculat- ing the quotient of two gradients of the weight and bias in the final classification layer; (2) Feed the embeddings into this layer to obtain the subsequent post-softmax probabilities; (3) Solve a sys- tem of linear equations for the number of instances per class by the Moore- Poorr-Penrose pseudoinverse algorithm.
3.1 CLASS-WISS EMBEDDING RECONSTRUCTION
Two crucial observations presented in Soteria (Sun et al., 2021) push the embedding reconstruc- tion towards deeper: (1) intra-class uniformity and concentration of embedding distribution; (2) inter-class low entanglement of gradient contributions, an empirical observation that i-class sam- ples mainly contribute to the i-th gradient row. Leveraging them, can attempt to reconstruct the average embeddings of each class, i.e., class-wise embeddings.
We first divide training batch B into subsets of C distinct classes, i.e., B = (BI, ..., Bc). Then, based on the observations mentioned above, we make two approximations. The first approximation has been formalized in the Appendix material of Soteria. We then further propose a theoretical account of the latter.
Approx (Intra-class Uniformity and Concentration of Embedding Distribution). The distri- bution of embeddings e is uniform and concentrated over certain class of samples B, in training batch, such replace them with the arithmetic mean of this categoty, i.e., the geometric center.
Consequently, the average gradient at index over B; can be represented as formula with Theorem

---

Published as a conference paper at ICLR 2023
JL
ac
ac
aci jEB, Ob! )
Bi Σ e²
2
OWiR, i.
BB
jEB, a
B
JEB,
Ol?
jEB,
aC
ep.-
Tb Br
(1)
where (-),, and (-), denote the mean of variable and the variable index for sample j across B,, respectively.
Untrained models are obviously more likely to satisfy this property. If we project the embeddings onto a 2D plane, their distribution over the entire batch is close to a uniform circle due to the rather poor classification ability. We discover that any embedding will yield a nearly uniform 1 I/n probability output at the beginning of training, where is the number of classes. When the model well-trained, although the various categories can be well separated. the internal distribution of a certain category may not be sufficiently uniform and symmetrical, and there will be some outliers.
OC
OC
We already know that 0b
Yis which means the gradient only goes negative at the P:
ac
(p: vn) = 0. In other words, the av (absolute -E
ground -ruth class index and
1=1 bb,
value) of the negative gradient at class index is equal to the sum of avs of the other positive gradients. Based on this derivation, another approximation is proposed.
Approx 2 (Inter-class Low Entanglement of Gradient Contributions))TTee batch-averaged gra- dient row at index i is mainly from i-class samples in a training batch. Specifically, we have:
JC bb, a
OL
B O
OL
1
OL
B
O
= B
B
bb
B
B,
OW
B
B
OW.n;
B
OW
R
(2)
2C ac ac_T_ eT, the latter in formula requires the variance of |||| over the whole batch to be
Since OW, ab.
smaller than the proportionality of the bias gradient. Due to the commonly used Input Normalization and Batch Normalization operations, this requirement is not difficult to meet, especially for untrained models. According to our derivation that Vb,- V2, = p. Vi. the bias gradient of i-class sample at index is pf 11, 1, while that of another class j is p². Here the superscripts correspond to the categories. Therefore, Approx 2 holds when |p!| < lp: - 1 for any j / i. Hence, the entanglement is related to the label distribution, i.e., it should not be extreme disparate. Furthermore, the magnitude of the gradients will be significantly reduced and get more sensitive to errors as training progresses.
JL
JC
OC
On the basis of Approx 2, we can derive that ab, B.
X
Of course,
OW
Jb:
OW
OL + 0 and
OC
is necessary to ensure that
+ 0 here. The occurrence of zero is uncommon,
0b but when it does occur, we replace it with a small enough number Combined with formula I finally get Cg.
bb 7,
we
UL
JL
to reconstruct the class-wiss embeddings.
0b
OW
Bypass Approx 2 when untrained. In Approx 2, if the emror terms for weight and bias gradients are not ignored, we have:
B
J
Σ
OC
Oc
1
ac
Σ
Bj
ac OW
0b:
B
ab
B:
jti
Ib:3,
OW, iB
WW
Wi,
iti
B
For untrained model, the average over any B, is almost equal. As result, have:
5

---

Published as a conference paper at ICLR 2023
Oc OW
ac Ob;
OC
+ Σ jzi BB]
0b: je
Since the restored embedding is the quotient of the two formula the former of the error terms hardly affect the proportional result this case, which means we can bypass Approx 2. Taking these two approximations together, we assert that our attacks on untrained models outperform trained models.
The improvement of our work over Soteria is that they just restore a linearly scale embedding VW; while ours more detailed and precise, where 7 scale influences by the local training steps (y in FedSGD and y > 1 in FedAVG (McMahan et al. 2016) and VW; is a brief notation for 0C
The reason is that they don't 't apply Theorem I to make use of Vb,.
OW;
3.2 INSTANCE-WISE LABEL RESTORATION
OL
If we extend Vz, P; Y: for single sample to the whole batch, get Σ
Σ P.
Ozh
Σ, v/" where (+) denotes the variable at index i for sample k in a batch of size K. After adjusting the order, it becomes Eert -
OC
E, v/. The right of this equation is exactly the total number of instances of class in a batch. Let k, denotes the number of j-class instances, and we can disassemble Σ.e P. into Σ, ky,,,,, From the class-wise embeddings that was previously deduced, it is possible to recover PB,, again based on intra-class uniformity and concentration of embedding distribution.
En
dz
Approx 3 (Average Probabilities from Average Embeddings). The average post-softmax prob- ability from j-class samples by classification model with softmax activation approximate to that produced by j-class average embedding.
Σ P2, [By
L.eB reB
SoftMar( (WMMar(We+ee N SoftMar(Wen, + b).
(5)
Additionally, we have Σ Oc
OL dzB
OC
K
K
KVb, where K is the batch size.
dz
Ib:
Therefore, we arrive to an equation:
Σ
kyPT KVb, = k,, -.j= 1,,.,, I,...,.. C.
(6)
This is equivalent to system of equations shown in
h + + k: + + kc K,
Σ
kyPIn, KVb, = ki
k,P28, KVb2 12
Σ,
k,PCE K KVbc
Kc.
Since the coefficient matrix this system is not square, we adopt the Moore-Penrose pseudo-inverse algorithm to get a LSS. And the final result also requires filtering of outliers and rounding. If the occurences of the class-wise labels can be obtained in advance, we can further simplify the above equation system through the prior works (Zhao et al.) 2020; Yin et al. 2021 Dang et al., 2021) ie., to discard unknowns k, and the corresponding equation where there IS no j j-class sample in the training batch.

---

Published as a conference paper at ICLR 2023
4 EXPERIMENTS
Setups. We evaluate our method for the classification task on three classic image datasets with ascending classes and four models from shallow to deep: (1) 3-layer FCN Couney-Coneected Net- work) and other variations on the MNIST dataset with 10-class grayscale images of size 28x28. (2) the 7-layer LeNet-5 on the CIFAR100 dataset with 100-classes color images of size 32x32. (3) the 16-layer VGG-16 and other variations on the large-scale 1000-class ImageNet ILSVRC 2012 dataset (Deng et al. 2009) at 224 x224 pixels. (4) the 50-layer ResNet-50 and other variations on the ImageNet dataset. We use the training set by default in the following experiments, and the images have been normalized during data loading stage. All statisties except those in Section 4.1 are averaged in a randomly selected batch on 50 repetitive tests. As mentioned previously, our at- tack is more effective on untrained models. Therefore, unless otherwise specified, we focus on the untrained model.
Evaluation metrics. To quantitatively analyze the performance of our label restoration attack, we propose the following two metries: (1) Label existence Securacy-LeAcee the accuracy score for predicting label existences; (2) Label number Accuracy-LnAcc: the accuracy score for predicting the number of instances per class. Furthermore, in Section [.4] we adopt the image reconstruction quality score Peak Signal to Noise Ratio (PSNR) and the perceptual similarity score Learned Per- ceptual Image Patch Similarity (LPIPS) Zhang et al. 2018) to measure the similarity between the restored images and the ground truth.
(a) PCN MNIST
VGG16 CIFAR100
100
100
90-
90
Postenage (N1
30
30
20
20
10
Lockce
Model Accuracy
10
10
50
90
Inrraions
Uppcchs
Figure 2: Performance comparison at different training stages.
4.1 COMPARISON OF DIFFERENT TRAINING STAGES
We first compare the attack results at different training stages shown in Fig We perform attacks on batches of size 64 and 8 on MNIST and CIFAR 100 with the FCN-3 and VGG-16 models, respectively. All LeAccs and LnAccs with the analysis in Section 3.1 the attack effect gets worse as training progresses. Moreover, The corresponding error analysis is given in Appendix D Approx is generally satisfied for both untrained and well-trained models, thus we speculate that the drop may be due to the larger error contributed by Approx 2.
the average of 20 repetitive experiments. Consistent
4.2 COMPARISON WITH PRIOR WORKS
Attack Baselines. We compare our attack with prior analytic approaches: (1) Improved Deep Leak- age from Gradients (iDLG) (Zhao et al. 2020): the single-sample label inference by finding the gradient row whose dot product with other columns yields a negative value; (2) GradInversion (GI) (Yin et al. (02T): the label restoration for the case of single-instance per class by the order of the minimum element in each gradient row; (3) Revealing Labels from Gradients(RiGG) (Dang et al.) 2021I: the extraction of a class-wise label set based on Singular Value Decomposition (SVD) and Linear Programming (LP). Owing to the limitations that iDLG and GI share, we scale them to the real-world settings of multiple instances per class in a batch for comparisons. For iDLG, we alter the selection of the gradient row with the smallest element after summation to all negative gradient rows. And we pick all negative gradients instead of the Top- K minimums in GI, where K is the batch size.
7

---

Published as a conference paper at ICLR 2023
Quantitative Comparison of our label restoration attack with prior works on diverse sce- narios. The batch size remains at 24. ": replace the activation function in LeNet-5 from ReLU to Swish (Ramachandran al. (017)) which applied in EfficientNet (Tan Le, 2019); : this met- ric is incapable of being calculated. CosSim: the Cosine Similarity for our recovered post-softmax probabilities.
Table 1:
iDLG
GI
RLG
Ours
Model
Dataset
LeAcc
LnAce
LeAce
LaAce
LeAcc
LnAce
LeAcc
LnAcc
CosSim
FCN-3
MNIST
0.514
1.000
0.932
1,000
0.994
0.979
LeNet-5
CTFAR 100
1.000
1.000
1.000
1,000
1.000
1,000
L
CIFAR 100
0.150
0.213
1.000
1,000
1.000
1,000
VGG-16
ImageNet
1.000
1.000
0.981
1.000
1.000
1.000
ResNet-50
ImageNet
1.000
1.000
1.000
1.000
1.000
1.000
Validity of Probability Reconstruction. The key our approach is the estimation of the class-wise average probabilities. Our results of the last column in Table Table[[shov show that recovery of the class-wise probability quite precise and corroborates with the label restoration accuracies. We even achieve a 100% CosSim on both CIFARIOR and ImageNet datasets, and the essential cause behind the fact that almost each class consists of at most two or three samples 24.
melectd batch of size
Results of Label Restoration. Table D compares the performance of our proposed iLRG with several prior attack methods. First and foremost, we drill down the ability of the attack from deter- mining the presence of labels to the number of instances for each class while the others are incapable of that. Our method achieves over 99.0% the whole models and datasets for the two evaluation metrics here. terms of LeAcc, GI performs best except our iLRG when a non-negative nonlincar activation function is utilized in the model. Nevertheless, once the activation in the network contains a negative element, its performance and that iDLG will plummet. The essential cause of this fact has been expounded in Section 2.2
FCN-3 MNIST
(b) LoNel- CIEARIDO
RewNel-50 ImaguNNtt
100
100
Percenaaee (Ng)
50
80
25
55
770
16
64
64
128
256
512
256
512
1024
2048
4096
Leccce
Batch Sizze
LuAcc
(4) FCN-strris on MNIST (B864)
(e) V.GG-ermisss en CIFARI00 (BS11024)
ReeRReN-- series on ImageNit (DS2048)
100
100
100
Percenage (%)
75
90
50
70
80
11
16 Model Depth
13
19
18 34
50
101
152
Figure 3: The percentages LeAce and LnAcc as batch size and model depth increase under various settings. The FCN series models distinguished by the number of hidden layers, where 2-layer model has no hidden layers and the basic FCN-3 consists of a hidden layer (See Appendix B for the FCN-3 network architecture). And BS is short for batchsize.
4.3 EFFECTS OF BATCH SIZE AND MODEL DEPTH
We next discuss the effect of increasing Batch Size and Model Depth/Layer Amount on the results. From Fig 3, we can observe that: (1) the LeAce score remains above 99% under all experimental settings; (2) raise the batch size, the attack capability decreases due the greater information
8

---

Published as a conference paper at ICLR 2023
loss caused by average operation; (3) the depth complexity of model likewise plays strong impact factor. The attack performance increases as the network deepens, which can be seen from the fact that the ResNet-sseries models more vulnerable our attack large batches than the shallow FCN-series. The results of various networks within the same family also confirm the claim. In Fig 3 (f), it appears contradict this that the attack against ResNet-50 is inferior that of ResNet-34. However, since the basic component of Resnet-50 and deeper networks switches from BasicBlock BottleNeck, the number of parameters of ResNet-50 actually less than ResNet-34.
003574 9
MNIST - Ground Truth
CIFARI00 Ground Truth
A
MNIST IG. PSNR1: 12.46, LPIPS|: 0.4269
CIFARI00 IG, PSNR1: 10.02, LPIPS 0.5997
574 9
MNIST Ours, PSNR1: 18.73, LPIPSJ: 0.1357
CIFAR100 Ours, PSNR1: 17.51, LPIPS|: 0,3439
Figure 4: Batch image reconstruction on MNIST (FCN-3, BS50) and CIFARI00 (ResNet-18 18, BS16) compared with IG (Geiping al., 2020). We assign specific label to each instance after label restoration at 100% accuracy. The 6 best visual images are selected to display and calculate the metries.
4.4 IMPROVED GRADIENT INVERSION ATTACK WITH OURS
Gradient inversion attacks perform joint optimization of model inputs and labels, thus labels may shift during optimization, which commonly leads poor recovery of the inputs. Naturally, occurs to us that the proposed method can be used to specify an optimization objective for each instance, so as to enhance the existing attacks. Since the adversary randomly initializes the dummy inputs of batch as the optimization objectives in the gradient inversion attack, which is originally unordered, we can assign any label to each instance according to the instance-wise label restoration results and they will eventually produce exactly the same batch-averaged gradients. Therefore, for each category with at least one instance, we simply select a subset with the capacity the number of instances of this class from the remaining randomly initialized dummy inputs and assign them labels of this category. Fig T illlstrraees the improvement both visually and numerically. We choose IG as the baseline because does not require substantial prior constraints.
CONCLUSIONS
This work proposes instance-wise Label Restoration from Gradients (iLRG), a method to reveal instance-wise labels via shared batch-averaged gradients FL. We build and solve system of linear equations over the labels by leveraging crucial derivation about the gradient of the network final logits and an approximate reconstruction of class-wise averaged probabilities. Our method performs extremely well for untrained models. We conduct comprehensive experiments on three classic image datasets with ascending classes and four models from shallow to deep (e.g., FCN on MNIST, LeNet-5 on CIFARI00 VGG and ResNet on ImageNet, etc) under the various settings of a large batch size up to 4096. The evaluations demonstrate the capability of iLRG with a high proportion of both Label existence Accuracy (LeAcc) and Label number Accuracy (LnAcc). It works even on models with an activation function that is not uniformly non-neg non-negative. Finally, We further facilitate the existing gradient inversion attacks by exploiting the recovered labels.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGMENTS
This work was supported by the National Natural Science Foundation of China (32071775, U21B2021). Finally, Kailang Ma would like to extend great gratitude to my younger colleague Gaojian Xiong for his contribution to the theoretical aspect of this paper.
REFERENCES
Theodora Brisimi, Ruidi Chen, Theofanie Mela, Alex Olshevsky, loannis Ch Paschalidis, and Wei Shi. Federated learning of predictive models from federated electronic health records. Interna- lional journal of medical informatics, 1 112:59-67, 2018.
Trung Dang, Om Thakkar, Swaroop Ramaswamy, Rajiv Mathews, Peter Chin, and Françoise Bea- ufays. Revealing and protecting labels in distributed training. Advances in Neural Information Processing Systems, 34:1727-1738, 2021.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. Ieee, 2009.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confi- dence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC confer- computer and communications security, pp. 1322-13333 2015.
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- how easy is it to break privacy in federated learning? Advances in Neural Information Processing Systems, 33:16937-16947, 2020.
Xavier Glorot, Antoine Bordes, and Yoshua Bengio. Deep sparse rectifier neural networks. In Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp- 315-323, JMLR Workshop and Conference Proceedings, 2011.
lan J Goodfellow, Jean Pouget-Abadic. Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C Courville, and Yoshua Bengio. Generative adversarial nets. In NIPS, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et Gradient inversion with generative image prior. Advances in Neural Information Processing Systems, 34:29898 299998999880- 2021.
Arthur Jochems, Timo M Deist, Johan Van Soest, Michael Eble, Paul Bulens, Philippe Coucke, Wim Dries, Philippe Lambin, and Andre Dekker. Distributed learning: developing a predictive model based on data from multiple hospitals without data leaving the hospital-a real life proof of concept. Radiotherapy and Oncology. 121(3):459-444 467, 2016.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- based learning applied to document recognition. Proceedings of the IEEE, 86(11):228-2322, 1998.
Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing privacy defenses in federated learn- ing via generative gradient leakage. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10132- 2022.
Guodong Long, Yue Tan, Jing Jiang, and Chengqi Zhang. Federated learning for open banking. In Federated learning, pp. 240-254. Springer, 2020.
Andrew I. Maas, Awni Y Hannun, Andrew Ng, et al. Rectifier nonlinearities improve neural network acoustic models. In Proc. icml, volume 30, pp. 3. Citeseer, 2013.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication learning deep networks from decentralized data. In Artificial intelli- gence and statistics, pp. 1273-1288 1282. PMLR, 2017.
10

---

Published as a conference paper at ICLR 2023
H Brendan McMahan, Eider Moore, Daniel Ramage, and Blaise Agüera y Arcas. Federated learning of deep networks using model averaging. arXiv preprint TrXiv:1602.05622. 2, 2016.
Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. 2019 IEEE symposium on security and privacy (SP), pp. 691-706. IEEE, 2019.
Prajit Ramachandran, Barret Zoph, and Quoe V Le. Searching for activation functions. arXiv preprint arXiv: 2017.
Adam Sadilck, Luyang Liu, Dung Nguyen, Methun Kamruzzaman, Stylianos Serghiou, Benjamin Rader, Alex Ingerman, Stefan Mellem, Peter Kairouz, Elaine O Nsoesie, et al. Privacy-first health research with federated learning. NPJ digital medicine, 4(1):1-8, 2021.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1409. 1556, 2014.
Jingwei Sun, Ang Li, Binghui Wang. Huanrui Yang, Hai Li, and Yiran Chen. Soteria: Provable de- fense against privacy leakage in federated learning from representation perspective. In Proceed- ings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 9311-9319, 2021.
Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural net- works. In International conference on machine learning, pp. 6105-6114, PMLR, 2019.
Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology (TIST), 10(2):1-19, 2019a.
Wensi Yang, Yuhang Zhang, Kejiang Ye, Li Li, and Cheng-Zhong Xu. Ffd: A federated learning based method for credit card fraud detection. In International conference on big data, pp. 18-32. Springer, 2019b.
Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 16337-16346, 2021.
Richard Zhang, Phillip Isola, Alexci A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features perceptual metric. In Proceedings the IEEE conference computer vision and pattern recognition, pp. 586-595, 2018.
Bo Zhao, Konda Reddy Mopuri. and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001. 022000000..2600,, 2020.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances neural infor- mation processing systems, 32, 2019.

---

Published as a conference paper at ICLR 2023
OL
A
THE DERIVATION OF V2; = Zzi = Pi yi
According to the definitions and notations given in Section 2.1 SoftMar(z) to model the mapping of the final layer and post-softmax process. First, the softmax
have We + b and
et
function defines transformation that p. SoftMar(z))
1,..., C. We denote
Σ e
Σ j=1 e Σg for convenience and discuss
Op: dzy
by situation:
c Ec c
2
-P: i= = P;
0p:
Σc
Ee
Øzj
1 X
C -6
6
e
Ec
Ec
Ec
PePj.
i i 3
where i andd] j are both members of C = {1,..., Cj. And the cross-entropy loss can be formalized L y) =-> - y,log(p:) -log(pe) (c represents the index of the ground-truth
OC dc
only if i = otherwise 0. Therefore, using the chain rule, class), which means 0p: dp. Pe
ac dz,
can be calculated as the following formula:
1
x (pe - Pe - Pe - i=
OC OC Op.
0+
Pe 1
0z,
Öpc
8z;
x (-pe Pe x pi) = -ii.
i c.
Pe
0L
Merging the two branches, we get our conclusion that V2
pi - Yc.
Ōz:
B THE ARCHITECTURE OF FCN-3
See Table
Table The details of shape for each FCN-3 layer.
Layer
Shape (In-Out)
Input
784-300
Hidden
300-300
Output
300-10
C PSEUDO-CODE OF OUR ALGORITHM
Algorithm D pseudo-code for the complete procedure of our method.
D APPROXIMATION ERROR ANALYSIS
For the experiment in Section 4.1 we conduct errоr analysis shown in the Table below. We choose the models at epoch 0, 40 and 100 respectively as the representatives the three stages of untrained, mid-training and well-trained. The three approximations and restored embeddings check items. And the evaluation metrics include MSE (Mean Squared Error). MRE (Mean Relative Error) and CosSim (Cosine Similarity), where MRE is the ratio of the error the ground-truth.
12

---

Published as a conference paper at ICLR 2023
Algorithm Class-Wise Embeddings Inference and Instance-Wise Batch Label Restoration.
Input: Gradients weight and bias in the final layer VW E RCxm Vb E RC,
Output: Class-wise averaged embeddings IE {e' i 1, 1,2, C} and the number of occurences for each class N (n' 1, 1,2,.. .., CJ} in training batch.
1: Initial = and N =
2: for = 1 to C do
3: Calculate e using VW and Vb;
4: Feed e' into the final layer get the network outputs z' and post-softmax probabilities p":
5: Add e' into E;
6: end for
7: Solve the system of linear equations in 7 to obtain N.
8: return and N.
Table 3: Comparison of the errors different training stages.
Approx
Approx
Approx 3
Embedding
Training Stage
MSE
MRE
MSE
MRE
MSE
MRE
MSE
CosSim
Untrained (Epoch 0)
1.6e-11
0.000
9.6e-5
1.377
6.1e-16
0.000
1.6e-5
0.978
2.4e-8
2.896
Middle (Epoch 40)
6.6e-5
0.668
5.7e-5
3.615
9.1e-5
0.157
1.8e-1
0.739
6.5e-7
1.391
Trained (Epoch 100)
2.8e-6
0.822
3.0e-7
13.218
2.6e-6
0.130
5.3e-1
0.734
4.0e-8
6.129
First of all, both Approxl and Approx3 are related to Intra-class Uniformity and Concentration of Embedding Distribution. Their MSE results are consistent with this property: best at the beginning, second at the end, and worst in the middle. However, since the gradient magnitude becomes smaller as the training progresses, the mid-term MRE may be less than the final (for Approx here).
Secondly, Approx2 represents Inter-class Low Entanglement of Gradient Contributions. Due to the complexity of weight gradient errors, we choose to analyze the bias gradient. the training pro- gresses, MSE decreases but MRE increases, indicating that the entanglement is actually increasing.
Finally, we note that the recovered embeddings for untrained model are the best. This is because it satisfies both properties and can even bypass Approx 2. In addition, we can also assert from the above results that the error Approx may be larger than that of Approx Since Approx 2 directly participates in the division calculation for restoring embeddings, which intuitively may also be reason.
Table 4: Comparison of the embedding reconstruction quality.
Soteria
Ours
Training Stage
MSE
CosSim
MSE
CosSim
Untrained (Epoch 0)
2.6e-4
0.978(-)
1.6c-5
0.978
Middle (Epoch 40)
2.0e-2
0.599(-)
1.8c-1
0.739
Trained (Epach 100)
1.9e-1
0.396(-)
5.3e-1
0.734
E COMPARISON WITH SOTERIA
We compare the quality of class wise embeddings at different training stages by Soterta (Sun al. 2021) and the proposed method's. The experimental setup remains the same as in Section 4. and Appendix [ Here (-) indicates that it is originally negative value. As shown in the Table
13

---

Published as a conference paper at ICLR 2023
method outperforms Soteria in terms of the cosine similarity metric. This suffices to demonstrate that our restorations are high quality. Moreover, we note that our restored embeddings are more precise than Soteria's 's when untrained, but it doesn't hold up well after training. In fact, MSE of the proposed method almost always less than that of Soteria. Only in rare cases, large MSE leads to large average MSE.
Table 5: The attack effect under the extreme distribution.
Per-Class NO1
Training Stage
BatchSize
Class 0
Class 18
Class 92
24
22
1
72
70
I
Untrained (Epoch 0)
216
214
1
648
646
1
24
18
1
72
57
1
Trained (Epoch 100)
216
155
9
648
371
65
(a) Differential Privacy on Untrained Model
(b) Gradient Sparsification on Untrsined Model
100
100
Perentage [%)
Percentage [9)]
90
90
70
70
16-4
10-3
16-2
10
20
40
80
Noise Std
Sparsification Ratio [%)]
(c) Differential Privacy Trained Model
(6) Gradient Sparsification Trained Model
100
100
Percentage [9%]
Percentage [9%]
50
50-
25
25
1e-3
1e-2
20
40
Noise Std
LeAce
LnAcc
Sparsification
Ratio [%)
Figure 5: The impact of two typical defense strategies Differential Privacy and Gradient Sparsifica- tion the label restoration results.
F EFFECT OF LABEL DISTRIBUTION
The inter-class entanglement gradient contributions significantly influenced by the label dis- tribution. In an extremely imbalanced case, the gradients of a minor category will be entangled with categories that consist of significantly more instances than it, i.e., the dominance of B, over the gradients at index is weakened. To prove the statement, we execute attacks CIFAR 100 with both untrained and trained VGG- models in batches ranging from 24 to 648. The results the Ta- 5 are the average recovered No/(Number of Instances) of 20 repetitive experiments. We simply select classes with class-id 0.18 and 92, whose Nols are 1, BS-2 and respectively (BS denotes the batch size). It can be that when the degree of imbalance exceeds certain threshold for the trained model. the recovery effect for minor classes 0 and 92 deteriorates significantly. However, method enables restoring labels of minor classes perfectly for such data distribution as
14

---

Published as a conference paper at ICLR 2023
626:1 when untrained. This is actually because in this case, the errors arising from entanglement can be bypassed.
G EFFECT OF DEFENSE STRATEGIES
The key to defending against our attack is to avoid exchanging precise gradients. We discuss two defense schemes: (1) Differential Privacy (Additive Noise): add Gaussian noise e~ NO o²I) to the gradients with different a; (2) Gradient Spasification: prune the gradients based on magnitude. We execute attacks CIFAR 100 with the untrained and well-trained ResNet-18 models, the batch- size is 24 and all results are the average of 20 repetitive experiments. As shown in Fig both LeAcc and LnAcc are reduced as the noise increases. For the untrained model, neither of these strategies affects the results much. Differential Privacy has a greater impact on the well well-trained model, while moderate Gradient Spasification even improves its performance little. We speculate that pruned gradients with smaller magnitudes are often insignificant and may reduce the errors yielded by using them to calculate for restoring labels.
H MORE VISUALIZATION EXAMPLES
As shown Fig we offer additional visual examples to illustrate our improvements of gradient inversion attacks.
Batch Size 8 Ground Truth
Batch Size 12- Ground Truth
Batch Size 8 IG, PSNR": 10.43, LPIPS]: 0.5808
Batch Size 12-IG, PSNR1: 10.42, LPIPSJ: 0.5620
Batch Ours, PSNR1: 16.30, LPIPSJ: 0,3853 Batch Size Ours, PSNR1: 17.52, LPIPS]: 0.3641
Figure 6: Additional contrast examples of inverting ResNet-18 gradients CIFARI00 demon- strate our improvements.
15


Reviews:
[{"review_id": "vas1fJtyxjd", "reviewer": "Reviewer_ngm7", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Gradient inversion in federated learning is often constrained by the lack of labels. Current label restoration methods are limited to class-wise label restoration, which is to infer the presence of a category. This paper introduces a new method to infer instance-wise labels in federated learning, i.e., the number of instances per class. Based on several approximations, the labels can be restored by solving a linear equation system using a pseudo-inverse algorithm. The authors then empirically explore how well this works in practice. Some results of the compatibility with model inversion attacks are also presented. ", "summary_of_the_review": "This is an interesting paper, but from my point of view, it relies on many assumptions to support the approximation and method proposed in this paper. There is a lack of evidence for these assumptions. Additionally, the improvement of this method compared with class-wise restoration seems limited. If the author can provide some motivation or results of the previously mentioned assumptions, I will raise my score.", "strength_and_weaknesses": "Strength:\n1. The proposed method is compatible with gradient inversion attacks and can be plugged in to enhance current optimization-based methods.\n\n2. Instead of optimization-based methods, this paper utilizes a method based on a pseudo-inverse algorithm.\n\nWeakness:\n1. Since the instance-wise label is the number of instances per class, how can this number be used with a model inversion attack? For example, IG attack assumes there is only one image per class in a batch, so it seems that with this attack, there is no large difference between previous class-wise label restoration and instance-wise label restoration.\n\n2. Continued with point 1, what is the improvement of instance-wise restoration compared with class-wise restoration? Could you please give some application scenarios where this method surpasses the class-wise one?\n\n3. I do not quite understand some of the approximations or assumptions in this paper as follows. \n  (1) In the last of the Approx 1, you mention that \"it is observed that the variance of \\|e\\| over the whole batch is so small\". Could you please provide any theoretical analysis or any empirical results to explain this?\n  (2) Approx 2 is based on the assumption that the gradients in $\\mathbb{B}_i$ is dominant in the approximation of the gradients at index $i$. But what is the influence of label distribution in a batch to the restoration results? What if the number of class $i$ is much smaller than other classes (i.e., an extremely unbalanced batch)? Are there any results for this?\n  (3) Approx 1 assumes the embeddings $e$ and the gradients of $L$ w.r.t. $z$ are similar over a certain class. The Approx 2 assumes the gradients in $\\mathbb{B}_i$ is dominant. It is easier to understand this in a well-trained model. But what is the performance in the early training stage? Or could you please figure out whether the model used in the experiments is pre-trained or randomly initialized?\n  (4) Could you please explain more about the Approx 3 of softmax? Why or when does this approximation hold?\n\nMinor comments:\n1. Superscript $j$ is used in Approx 1 without explanation, although it is explained in section 3.2.\n\n2. In section 3.2, I think $k_j$ is the same as $|B_j|$. Is it correct?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "gXWWqg_0_53", "reviewer": "Reviewer_9FpD", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents to perform instance-wise batch label restoration from only the gradient of the final layer, to extract labels from gradients. The core idea is to establish linear equations of the gradients, probabilities and labels to derive the Number of Instances (NoI) per class by the Moore-Penrose pseudoin-verse algorithm. For this purpose, this paper designs two metrics and performs empirical studies that achieve state-of-the-art performance on three benchmark datasets.", "summary_of_the_review": "Please see Q1 and Q2.", "strength_and_weaknesses": "Strength：\nThis paper considers the more real-world settings in gradient inversion attacking of Federated Learning (FL), where there are multiple instances of each class in a training batch. Besides, this paper derives the equation to design the algorithm.\n\nWeakness：\n- The paper is somewhat clear, but some important details are missing or unclear. For example, does the model of server share the same network architecture with the model of clients in Figure 1？Moreover，in Figure 2，how do servers and clients interact？Is the iLRG method run on the server side?\n- The authors leverage Intra-class High Similarity and Inter-class Low Entanglement. However, this may assume that the server can obtain the labels of clients, which violates the privacy setting of FL.\n- There are missing ablation experiments with the experimental part. For example, which of the intra-class high similarity and inter-class low entanglement contributes more to the result？\n\nQuestion:\nWhat judgment does the server use to determine similar or dissimilar classes in section 3.1？\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "O7PfAWNDhu", "reviewer": "Reviewer_CT8P", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This manuscript studies the instance-level label restoration in mini-batch training under the federated learning structure. The authors proposed a strong method that is capable of restoring labels via gradient inversion attack even when batch size is as large as 4096, which was usually considered a challenging task. This is achieved by estimating the class-wise averaged embedding (to which authors improved over [1]) to estimate the class-wise averaged predicted probabilities, and then using the Moore-Penrose algorithm to solve the linear equation systems formulated by the class-wise averaged predicted probabilities and the bias gradients.\n\n[1] Sun, Jingwei, et al. \"Soteria: Provable defense against privacy leakage in federated learning from representation perspective.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.", "summary_of_the_review": "Overall, this is a well-written paper which I'm leaning towards accepting. The authors' proposed method makes intuitive sense and the motivation is clear, the experiments are comprehensive. The score will be increased upon the satisfactory and convincing rebuttal regarding the questions in “Cons”.", "strength_and_weaknesses": "Pros:\n1. Authors studied a non-trivial research question, which is how to recover the training labels in federated learning through the gradient inversion attack when the batch size is large and the number of classes is more than two. With such information, the features of training samples could be better inferred, hence posing more server threats to the security of federated learning. \n2. Compared with existing work, this work does not need the strong assumption that the categories in the same batch must be small or equal to two.\n3. This work empirically shows that the training labels can be accurately inferred even when the training batch is 4096, to the reviewer’s best knowledge, this is a new record and can without doubt boost the performances of most of the gradient inversion attacks.\n4. Authors insightfully leverage the averaged post-softmax probabilities, to link the label recovery and class-wise averaged embeddings via Equation (4) and (5). \n\nCons:\n1. Authors pointed out that existing work might fail when the activation function can yield negative values. However, I did not see how the authors' proposed method can solve this.\n2. I’m interested in the situation when there is no bias for the FC layer since the absence of bias is rare - but not impossible. In that case, is the reconstructed class-wise embedding reduced to the embedding produced by [1]? Also, while the authors make the justification that leveraging bias gradients can be helpful, I recommend authors make ablation studies to compare the quality of the class-wise embedding learned by [1] and authors’ method, which could make the authors’ contribution more convincing. \n3. After we know the number of instances per class within a batch, how do we assign the labels to each individual instance? If we don't do so, can authors elaborate on how only knowing the count of each class within a batch can help recover features?\n4. When there are some basic defensive strategies applied (such as DP noise and gradient pruning), what are their influence on the authors' method?\n\nThe aforementioned \"Cons\" are not necessarily the limitations, but some clarifications/ablation studies that I'm interested in.\n\n[1] Sun, Jingwei, et al. \"Soteria: Provable defense against privacy leakage in federated learning from representation perspective.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster