FedInverse: Evaluating Privacy Leakage in Federated Learning
Authors: Di Wu
Jun Bai
Yiliao Song
Junjun Chen
Wei Zhou
Yong Xiang
Atul Sajjanhar
Venue: ICLR 2024 poster (2024)
Keywords: Federated learning
Model Inversion Attack
Privacy-Preserving
Primary area: societal considerations including fairness, safety, privacy

Abstract: Federated Learning (FL) is a distributed machine learning technique where multiple devices (such as smartphones or IoT devices) train a shared global model by using their local data. FL claims that the data privacy of local participants is preserved well because local data will not be shared with either the server-side or other training participants. However, this paper discovers a pioneering finding that a model inversion (MI) attacker, who acts as a benign participant, can invert the shared global model and obtain the data belonging to other participants. This will lead to severe data-leakage risk in FL because it is difficult to identify attackers from benign participants.
In addition, we found even the most advanced defense approaches could not effectively address this issue. Therefore, it is important to evaluate such data-leakage risks of an FL system before using it. To alleviate this issue, we propose FedInverse to evaluate whether the FL global model can be inverted by MI attackers. In particular, FedInverse can be optimized by leveraging the Hilbert-Schmidt independence criterion (HSIC) as a regularizer to adjust the diversity of the MI attack generator. We test FedInverse with three typical MI attackers, GMI, KED-MI, and VMI, and the experiments show our FedInverse method can successfully obtain the data belonging to other participants. The code of this work is available at https://github.com/Jun-B0518/FedInverse

Published as a conference paper at ICLR 2024
FEDINVERSE: EVALUATING PRIVACY LEAKAGE IN FEDERATED LEARNING
Di Wu Jun Bai Yiliao Song**1, Junjun Chen', Wei Zhou', Yong Xiang', Atul Sajjanhar School of Mathematics, Physics and Computing, University of Southern Queensland*
School of Information Technology. Deakin University?
The University of Adelaide
Computer Center, Peking University*
School of Science, Computing and Engineering Technologies, Swinburne University of Technology di wuêun sq. edu. au, (bai jun, yong x ang, atul. sa jjanaara i n edu au
1 lia. songe addelidellde edu. au, chenjunjun@pel edu. edu. en, peizhou@swing edu. au
ABSTRACT
Federated Learning (FL) is a distributed machine learning technique where mul- tiple devices (such as smartphones or IoT devices) train a shared global model by using their local data. FL promises better data privacy as the individual data isn't shared with servers other participants. However, this research uncovers a groundbreaking insight: a model inversion (MI) attacker, who acts as a benign participant, can invert the shared global model and obtain the data belonging other participants. such scenarios, distinguishing between attackers and benign participants becomes challenging, leading severe data-leakage risk in FL. In addition, we found even the most advanced defense approaches could not effec- tively address this issue. Therefore, is important to evaluate such data-leakage risks of an FL system before using it. Motivated by that, we propose FedInverse to evaluate whether the FL global model can be inverted by MI attackers. particu- lar, FedInverse can be optimized by leveraging the Hilbert- Schbmtt-Schhidt independence criterion (HSIC) as a regularizer adjust the diversity of the MI attack generator. We test FedInverse with three typical MI attackers, GMI, KED-MI, and VMI. The experiments show that FedInverse can effectively evaluate the data leakage risk that attackers successfully obtain the data belonging to other participants. The 1/FeeInvees
code of this work available at https://github.com//uu
INTRODUCTION
Federated Learning (FL) is a machine learning technique where multiple participants collaborate train a global model on central server while keeping their data locally on devices Li et al. 2000); Kairouz et al. (2021) 1). FL has been applied to many real-world applications such as medi- cal informatics Salim & Park (202)), the Internet of Things Nguyen al. (202T), and mobile edge computing Lim et al. (2020) because FL is advanced in solving data isolation problems and user privacy-preserving Nguyen al. (2022). For example, FL leveraged to preserve patient data pri- vacy for medical informatics Salim & Park (2023). FI. claims itself to be able to naturally protect user privacy as each participant trains the model locally McMahan et al. (2017). i.e., different partic- ipants do not need to share their private data. In fact, FL might be still vulnerable with regard to its capability for privacy protection Zhu et al. (2019). few studies found that attackers could hijack the gradients when benign participants communicate with the server Huang al. (2021) mas- querade as a server to receive gradients uploaded from participants Geiping et al. (2020) to reveal the local data of other participants.
However, no studies discuss whether attackers can reveal data from other participants via a partici- pant role. This will lead to severe data-leakage risk in FL because it is difficult to identify attackers from benign participants if the attacker plays a participant role. In this paper, we identify and eval- uate this undiscovered but more severe privacy leakage issue in FL that an attacker, who acts as
Equull contribution. 'Corresponding author:di. wu wwwwwuusssuuuuu lia. @ www.aade..a.aa...mm

---

Published as a conference paper at ICLR 2024
(ottacker)) a
Attack
O
2
Global Modal
Inverted Images belonging parioppants impeementnng MI attacks on the glabial model
5
O
3
4/
Central Server
Original images belonging to the attheker
Figure I: MI attacker can cause FL data-lcakage. PI, P2, and P3 denote three FI. participants, respectively, wherein P3 is an MI attacker. At the heginning, P3 only has images digits to 9, however, P3 can invert images of digits 0 to 4 from Pl and P2 through the MI attacks.
reveal data from other participants with fewer conditions. Motivated by that, we draw attention to the recently developed model inversion (MI) attacks that can expose sen- sitive private information directly from well pre-trained models Fredrikson al. (2015) : Khosravy
benign participant,
eet al.] 2022); Kahla et al.] (2022); |igakii & Garcia (2020). We let MI attacks act as henign partici- pants and aim reveal the private image of other participants. Specifically,, we use three typical MI Baacks--enerrtivy MI attack (GMI) Zhang et al. (2020), Chowledge-Enrichhe
Distributional MI
attack (KED-MI) Chen et al. (202T) and Variational MI attack (VMI) Wang al. (202 and find they can successfully recover images of other participants from FL global models. As is shown in Figure. [ P3 (the attacker) recovers images belonging to the benign participants P1 and P2.
Knowing that FL undergoes such data-leakage risk by MI attacks (Figure. [ we question if the current defense approach can address this issue. We test two advanced defense approaches, MID Wang et al. (2021b) and BiDO Peng et al.] (2022) in FL settings, on the three typical datasets MNIST, CelebA, and CIFAR-1O, respectively. The results show that these SOTA defense meth- ods cannot defend against the attacks MNIST and CIFAR-IO. We also observe that the FL and defense performance have a significant trade-off on the different parameter settings, indicating that SOTA MI-defense approaches are oriente and thus not always applicable to FL (See Appendix A.(7.8,14,15,18,19))
Given that the data-Icakage risk cannot be eliminated, propose FedInverse, novel privacy leak- age evaluation method to evaluate the boundaries of privacy protection in the FL system from the participant's perspective, whether one participant can obtain data from other participants. An at- tacker pretending to be a participant in FedInverse can conduct the Black-box attacks via global model prediction in each federated training round. In addition, MI attacks sometimes obtain less diverse data when inverting the model, making it challenging to evaluate the data data-leakage risk. To verify the efficacy of the attack performance, we propose dependency constraint in FedInverse by introducing the filberi-Schmice independence criterion (HSIC) Gretton et al. (005) to adjust the diversity of the attacker generrted images Radford et al. 2015))
We test FedInverse with three typical MI attackers, GMI, KED-MI, and VMI on two typical datasets including CelebA [iu al. (2015) and MNIST et al. (1998). The experimental results show that FedInverse can effectively evaluate the data leakage risk that attackers successfully obtain the data belonging to other participants. Specially, GMI, KED-MI, and VMI can achieve high attack performance target global models including VGG16 Simonyan & Zisserman (2014), ResNet- 34 He et al.] (2016), and MCNN Cui et al.] (2016) and reveal the data from other participants. By the end, compare the performance of FedInverse with and without HSIC, and find that the attack performance improves significantly when increasing the diversity of images that attackers generated.
2 PRELIMINARY
2.1 TRAINING PROCEDURE OF FEDERATED LEARNING
FL. has made significant benefits to the fields of the Internet of Things Savazzi et al. (2020), network security Chen et al. (2022), and medical care Huang et al. 2019), but it faces the challenge that the global model in FL can be poisoned by uploading malicious parameters to the server Zhang et al. (2019): Zhu et al. 2019 However, attackers are pretended to be benign users. This paper mainly discusses the vulnerability of federated learning from the perspective of attackers obtaining user privacy the FL participants.
studies pay attention to the data leakage problem when the
Unlike traditional server-client training schemes, in each training round of FL, clients are selected as participants and receive the global model w,. All the participants train the model parameters on
2

---

Published as a conference paper at ICLR 2024
their own local private data and return trained parameters w/f back to the server. The server averages all the parameters w and constructs the new global model W(+1 for the next training round. In the FL training mechanism, every participant contributes local updates w trained by their sensitive local data. Even though the new global model w++1 is generated after the average algorithm, it still contains the key information from all the participants which could be a good target for MI attacks. This paper aims to evaluate and quantify the risk of sensitive information being leaked in FL by MI attacks.
2.2 MODEL INVERSION ATTACKS
According different attack strategies, privacy attacks machine learning can be divided into membership inference attacks (hhkri et al. (2017), parameter extraction attacks Ateeiese et al.] (015)), and model inversion attacks Liu al. (2020). This paper mainly focuses on model in- version attacks. The first model inversion attack was proposed by FFredrikson et al. (2014) which demonstrates that even an attacker only has access privilege to the global model,
possible
to obtain users' sensitive data. Hitaj et al. Hiiaj et al. (2017) proposed a model inversion attack in collaborative learning scenarios showing that as long as the local model accuracy of the partic- ipant is high, good attack performance can be achieved. Ateniese et al. AAteieee et al. (2015) constructed a new meta-classifier (meta-classifier) and trained to attack other classifiers to obtain sensitive information about their training data sets. Wang al. |Wang et al. (2019) proposed model inversion attack for FL. This method designed a multi-task generative controntation model as the attack model and successfully realized the user-level privacy attack. Recent model inversion attack are optimization based methods, such as GMI ZZang et al.] (2020), KED-MI [Chen et al.] (2021), and VMI Wang al. (2021a), which obtain private data in the global model by training GAN. The details of these attacks will be described in the next section.
2.3 HILBERT- INDEPENDENCE CRITERION
HSIC Gretton et al. (2005) is a kernel-based measure to evaluate the statistical dependence be- tween various random variables. Let Ø X + F represent nonlincar feature transformation and kr (x, x') = (o(x), ø (x²)) denote a positive kernel function showing the inner product between fea- tures. So the structure of reproducing kernel Hilbert space (RKHS) can be represented by feature space F. We can also define another transformation vi y + G and the corresponding positive definite kernel function ky (y, 3/) (v)), va (v/)), which has a similar process with the former transformation. Then, a cross-covariance operator Czy G + FF between the two transformations exists and can be defined linearly in the following equation:
Czy Faay [((()) p2) s (vi()) pyy]]
wherein denotes tensor product between vector space Pe [z(( and vector space My = (vbv)). Then HSIC, which is squared norm of the cross-covariance operator Czys can be represented
HSIC (F, G, Poy) [|Cvv 1
Given m pairs of data sets Z {x11 ....... (am. ym)) from datasets X E Rmxd and Y Rmxdy, the empirical estimator of HSIC can be written as
HSIC (F, = m² TI HH),
(3)
wherein m x m is the size of the empirical HSIC, K2 and K, represent the corresponding kernel matrices for and y with (k=),,g kr (z) and (ky)a, by (vi, (Vr,,)), Tr is the trace of the matrix, and H centers and in feature space F and G.
METHODOLOGY
This section first introduces the proposed FedInverse method and how it embeds MI attackers. We have shown cases of FedInverse using three typical MI attackers Generative MI (GMI) (GMI)Zhang al. 2020), Knowledge-Ennen Enriched Distributional MI (KED-MI) Chen et al.] (202I). and Variational MI (VMI) Wang et al. (2021a), which will be presented separately in the following sections. Then,
3

---

Published as a conference paper at ICLR 2024
Portappmtt 1
Portidiant2
Farssporck
Take Images
Pabe Imagge
Latenc
Ganentor
Real imgges
KIT OUERE
Recovmc
Bulk lateal
labe
Target tabel
Mestll bele
642Targo0
liwarrsoon GAN
Shop D'satiillion Plooeers
GMI
KED-MI
Figure 2: FedInverse: Model inversion attacks against FL, taking GMI KED-MI as examples. VMI is not shown in this figure because it has a similar training schema to KED-MI.
introduce optimized FedInverse which leverages the Schhmit independence criterion (HSIC) a regularizer to increase the diversity of MI attack generators and thus improve the evaluation performance.
3.1 FEDINVERSE
The main idea of FedInverse method is presented in Figure. where Attackers (GMI) and Attacker 2 (KED-MI) pretending be benign participants to get the necessary information from the central server, i.e. pre-trained models, training tasks, target labels, etc. In the meantime, Attacker and also pre-train GAN models by leveraging public images that are structurally similar the target images to launch an attack in a white-box setting. Clearly, we can obtain qualified public images by using historical target images. Next, we will analyze the attacker case by case. Attacker is GMI and Attacker 2 is KED-MI. We will also analyze Attacker 3: VMI, which has a similar scheme to KED-MI, and thus is not shown Figure. 2
Attacker 1: GMI attack against FL. To reconstruct the sensitive image from other participants, Attacker utilizes public structurally similar images to train Wasserstein-Gan GGN AArjossy et al. (017)) as shown in Equation which learns generic prior knowledge.
min max Tragan (G, D) = [D(x)] - R. [=((((()))
The goal of Attacker 1 is to find the latent vector z' that maximizes the likelihood under the FL global model wy limited the data manifold learned by as z' arg min, Lprior + (z)). Prior loss (2) penalizes unrealistic images and the identity loss Lia(2) promotes the generated images have high likelihood under wi. Equation 5 gives the details of z'.
z' arg min(- min(-D(G(2)) + Fo (G(2))))
(S)
wherein Fw, (G(z)) indicates the probabiltiy of G(z) output by the FL global model wi-
Attacker 2: KED-MI Attack against FL. To distill better private information from other FL par- ticipants, Attacker launches the attack in two steps. In the first step, a customized GAN is trained. To adopt the discriminator D that can discriminate the class labels under FL global model w,, dis- criminator includes (K + 1) classes, where classes correspond to the labels of the w., and (K + 1)-th class indicates fake samples. A soft label Fu, (x)) is generated for each image from the public set. The training loss for D is represented in Equation 6
Lo = - Ezrpam (x) 2 | (x) log Prise (y = l: [x]
(6)
-(E (x) [log [x)] + Ez-paie [log(1 - ((G())))
wherein Pdata represents the distribution of public structurally similar images, and (aiee x)
indicates the probability that predicts as class y. Fut (x) is the k-th dimension of the soft label produced by the global model wi. The training loss of generator G is illustrated in Equation 7
LG E [[(=)] Ex-paa mcis [[(G()))]] + A Le
wherein f(z) is the learned features encoded in an intermediate layer of the discriminator and Trettrop is an entropy regularizer Graniivaerrraalleet..t.. & Bengio (2004).
4

---

Published as a conference paper at ICLR 2024
Algorithm 1 FedInverse Algorithm. K indicates the number of participants and & represents the participant number; represents the local batch size, E indicates the local training epochs. C is the participation rate of participants, while 7) is learning rate; G and D denote Generator and Dis- criminator respectively, Paux represents the auxiliary dataset used to pre-train GAN, .V' denotes the Gaussian distribution, while 2, indicates the set of generated images by FedInverse.
I: Server Initialization: 40
20:
x + G(z)
2: for each training round t= 1,2 do
21:
split into æ1 and
3: m max(C K. 1)
22:
compute HSIC(z1, 222
4: S, (random set ma participants including
23:
update z' for diversity optimization
a single Attacker)
24:
end for
5:
for each participant & E St in parallel do
25:
x' G(z')
6: wi f ParticipantUddateee.. wt)
26:
Q - 0.U
evaluate on Attacker(ws)
27:
end for
8: end for
28: return Q
9: We+1 < I 25
29:
end function
10:
end for
30:
11:
31: function PARTICIPANTUPPDATEG w)):
function ATTACKER(()):
32: +- (split Ps into batches of Size B)
13: if needed then
33: for each local epoch from 1 to do
14:
pretrain G and D with wi Paur
34:
for batch 6 E B do
15:
else
35:
We (ww;bb
16:
load pretrained and end if
36:
end for end for
17:
37:
18:
for each attack epoch do
38: return wy to server
19:
for batch E . do
39:
end function
To launch the attack, given class label l from the global model wt: the attack loss is T, = Txprior + Tid, which is similar to GMI, and the details are represented in Equation
-By [log D (G (=")) E FFa (G (=')).,
(8)
wherein z' is sampled from Pgen = =N(H, o²). After reparameterization, &' can be represented as Equation 9 to directly estimate and o² through back-propagation.
oE p. N(0,
(9)
Attacker 3: VMI attack against FL. Attacker 3 demonstrates a similar attack procedure to At- tacker 2. Compare to KED-MI, StyleGAN is used for VMI attack due to its capability of "style mixing". The synthesis network can generate "mixed" image when given a mixture of two w's in the expanded space, where represents the mapping vector of the input via f : w.
The objective of VMI with StyleGAN is shown Equation
10
L3 Dg-vai (4) : =BB(t (.( loog Fw, (u S (1f(2)))
(10)
7 DEEIDDKL (g) (zi) |lauu (zi)).
wherein q(21,..., 21) is the joint density over 2i,.... ZL and ((())) is the marginal density over 2]. Additionally, Paur represents the auxiliary data used to pre-train GAN.
3.2 FEDINVERSE WITH DIVERSITY OPTIMIZATION
It is more difficult to invert the model when the MI attacks obtain less diverse images. To alleviate this issue, we use the Hilbert-Schmidt independency criterion (HSIC) as a regularizer with MI attack (termed MI-HSIC) to adjust the diversity of the attack generator, as shown in Figure 3] For each attack epoch, the attack generator will generate x images from G(z) based on the latent from data distribution Q., we equally split x: into 21 and 22 and compute HSIC(z1, 2:2) which is used to update the z' E Q', for diversity optimization. The optimized attack loss T. = T.prior + Tsg (TT( which is shown in Equation
Lppiirr + Lid -E (x) 22)
(11)
wherein m half of the batch size of the generated images, and d is the dependency measure. To evaluate the relationship between HSIC and the diversity of generated images, adjust the
5

---

Published as a conference paper at ICLR 2024
L
Conprrorr
Torget
Deneritor
Global Parget
baile
Step Inserdoos Specttic GAM
Stop 2 Dnairbutional Racowary
KED-MI
Figure FedInverse with Diversity Optimization by Using HSIC GMI and KED-MI.
Targer
Target
2
3
4
{
2
5
9
MI
MI
3
4
Figure 4: (a) Qualitative comparison of the proposed MI-HSIC attack with the corresponding MI attack against FL on CelebA. (b) Qualitative comparison of the proposed MI-HSIC attack with the corresponding MI attack against FL on MNIST.
parameter À to optimize the performance of generated image diversity. The algorithm of FedInverse shown in Algorithm T
Figure. (a) and Figure. bbb compare some sample images generated from CelebA and MNIST respectively. According Figure. a)), the generator MI has lower quality on the generated images compared to MI-HSIC, ie., regarding the generating quality in the fourth column from the left side, MI-HSIC is better than MI itself. Even the inverted image cannot be completely alike the original image. However, the biometric identity (c.g. face) can be successfully reconstructed to break into otherwise secure systems even if humans do not recognize the model-inverted examples look much alike the true examples Wang et al. (222a)). Figure. b compares different generation performance between MI and MI-HSIC on MNIST. The first line indicates the target images from MNIST digits 0 to 4, and the attackers have the prior images from MNIST digits 5 to 9. The result shows that MI has less diversity compared with MI-HSIC, which means the generator always has bias on the prior images with attackers, i.e. the generator with MI generates the digit digit 9. In conclusion, the HISC can affect the generating diversity and quality for MI attacking purposes.
4 EXPERIMENT SETTINGS
In this section, we discuss the experimental settings for verifying the efficacy of FedInverse against FL in white-box settings. We do not focus on black-box attacks because in this study the attacker plays a participant role which can naturally obtain the model structure. Therefore, the training task cannot be in a black-box setting.
4.1 DATASETS
We use three typical datasets, CelebFaces Attributes Dataset (CelebA) Liu al. (2015), MNIST dataset LeCun et al. (1998). and CIFAR-10 Krizhevsky et al. (2009) (More experiment results on different datasets See Appendix A) evaluate the FedInverse attack performance with different classification tasks. The three datasets cover, face recognition(CelebA). handwriting recognition (MNIST), and object detection (CIFAR-10). For all datasets, we randomly select a part as the historical target images and use these images as the prior public dataset to pre-train the GAN, as we have discussed Section 3.1 Specifically, for CelebA, we first randomly select 1000 identities and select all images belonging to these identities from CelebA. These images will be used as private data in FL. In this paper, we finally have 30,027 images the private data set. In addition, we also randomly select 30,000 images from the rest part of CelebA. This data is used to pre-train the GAN. For MNIST, as it has fewer classes, we directly select the images from MNIST digits 5 to 9 as the prior public data and use images from MNIST digits 0 to 4 as the private data. CIFAR- 10 has the same settings as MNIST, five classes (airplane, automobile, bird, cat, deer) are selected as the private data, and the rest of the classes (dog, frog, horse, ship, truck) used the prior public data.

---

Published as a conference paper at ICLR 2024
4.2 FEDERATED LEARNING GLOBAL MODELS
We adopt different global models with different classification tasks to evaluate the performance of different FedInverse attacks. For CelebA (face recognition tasks), we apply VGGI6 Simonyan & Zisserman (2014) to evaluate the performance of GMI and KED-MI attacks in FedInverse and apply RezNet-34 34 He al. (2016) to evaluate the performance of VMI attacks in FedInverse. For MNIST (hanwwinadiiiuung recogmition tasks), we apply MCNN Cui et al. (016) as the global model to evaluate the performance of GMI and KED-MI attacks.
4.3 FEDERATED LEARNING SETTINGS
We adopt different FL settings for CclebA and MNIST to evaluate FedInverse.
For CelebA, we choose 5 participants joining every training round. The local training batch size is 64 and the local training epoch is 50. We evaluate all the FedInverse GMI, KED-MI, and VMI. We choose VGG16 as the FL. global model for GMI and KED-MI, and ResNet34 for VMI, respectively. Every participant except the attacker averagely shares the private data set in FL training setting.
For MNIST, 100 participants are chosen to join the FL, However, only 10 out of 100 participants can join the training in each training round. The local training batch is 10, and the local training epoch is 5. We evaluate the FedInverse leveraging GMI and KED-MI. We choose MCNN as the FI. global model. The FL data training setting is similar to CelebA.
4.4 EVALUATION METRICS
To evaluate the performance of FedInverse, we assess the extent of sensitive information regarding a target label that disclosed through the synthesized images. Our evaluation approach involves both quantitative metrics and visual examination. The quantitative metrics utilized for evaluating the attack performance are presented below.
Attack accuracy (Attack Aec) To evaluate the attack effectiveness, we construct an "'valuation classifier" to identify the identities of the reconstructed images. The evaluation classifier well- trained by using the whole dataset with very high testing accuracy which achieved around 98%. These metrics evaluate the similarity of the generated samples to the target class. the evaluation classifier exhibits high accuracy, the attack is considered successful. To guarantee comprehensive and impartial evaluation, the evaluation classifier should be highly accurate across all classes.
Fréchet inception distance (FID) We utilize the commonly used FID metric Heusel al. (2017) to evaluate the quality and diversity of reconstructed images. This metric allows us to gauge the level of detailed information that may be present in the reconstructed images. FID determines the likeness between real and fake images within the embedding space, which is based on the features of a convolutional neural network (i.e., the evaluation classifiers in the defense task). Essentially, FID calculates the variances and means of the features, assuming multivariate normal distribution, and compares the differences between them.
5
EXPERIMENT EVALUATIONS
5.1 FEDINVERSE ATTACK PERFORMANCE ON CELEBA
Face recognition is widely applied in different real scenarios for public security purposes. We eval- uate and compare the efficacy of FedInverse attack methods with and without HSIC on CelebA for privacy leakage on face recognition data in FL.
The results of FedInverse using GMI and GMI-HSIC are illustrated in Figure S a), GMI-HSIC con- sistently achieves better attack performance and FIID since the first FL. training round, indicated by improvement of 10% of the attack accuracy, 2% of the top-5 attack accuracy, and FID. FL training accuracy has been increased and stabilized the second round from 66.05 to 80.48, and it is worth noting that GMI-HSIC achieves the highest attack accuracy and top-5 attack accuracy, which outper- forms GMI by 5% of the attack accuracy, 5% of the top-5 attack accuracy, and smaller FID. When compared with the GMI and GMI-HSIC GMI can partially leak images from other participants. and the attack performance can be significantly improved by GMI-HSIC, in which the diversity of the generated images has been optimized by HSIC.
7

---

Published as a conference paper at ICLR 2024
Accumay (86
Acsurayy
Accurary (90)
Acsuney
Accuraay A5
Acouragy
(15)
Altok PNNOAAAA Apc 180)
R. H. F.F. R. F.E.E. p
Allack
Altack
GMI-HSCI Alzack Ace
Attack
VMI--SCI Altack Ape
VMI Altack Ace
KED-MI-HSCI Attack Ace
Altock Accd5
GMI Attack Accs
AftHOC Andd
GMI-HSIC Attack Acch
VMI Attack Acc5 VMI-HSIC Attack Accs
KED-MI Aftack Accs
KED MI-HSIC Attack Acc5
GMI FID
VMI FID VMI-HSIC FID
GMI-ISIC FID
Communication Rounds
Communicatin Rounds
Communcation Rounds
(C)
Figure 5: FedInverse CelebA. Columns (a)(c) present the relevant curves for three chosen MIMII-SIIC attacks CelebA under specific FL conditions. The first row of subplots illustrates global model accuracy changes over communication rounds. Rows two to four display comparative results using Attack Acc, Attack Acc5, and FID metrics for these attacks across ten federated rounds.
The performance evaluation of FedInverse using KED-MI attack on CelebA is presented in Figure 5(b), where we use the same attack settings as the GMI attack. Compared to GMI, KED-MI com- pletely penetrates the mechanism of FL personal privacy protection, and the best attack accuracy dramatically increases from 11.33 in Figure 5(a) ()) to 57.80 in Figure 5(b), and the best top-5 attack accuracy booms from 25,40 Figure 5 a) 85.47 Figure b). The best result of attack accuracy and top-5 attack accuracy also increases from 11.93 in Figure Sta) to 60.13 13 in Figure 5ib), and 26.77 77 in Figure 5(a) a) to 85.80 in Figure (b)),, respectively. When compare the attack performance between KED-MI and KED-MI-HSIL
improves 4% of the attack accuracy, 2% of the top-5 accuracy, and smaller FID in FL training rounds 9 and 10, respectively. According to the results, participants' privacy in FL. can be easily revealed by the KED-MI, and HSIC plays an important role increasing the diversity of the generated images where the attack accuracy can be improved.
KED-MI-HSS
We also evaluate the FedInverse performance of VMI in Figure with ResNet-34. The highest at- tack accuracy of VMI appears in FL training round 10 is 36.70 and the highest top-5 attack accuracy appears in FL training round 9 is 63.30. The VMI-HSIC further improves the attack performance by 3% and the top-5 attack accuracy by 0.7%, which are 37.95 and 63.80, respectively, with smaller FID. The results validate the promised privacy leakage by VMI attacks.
5.2 FEDINVERSE ATTACK PERFORMANCE ON MNIST
Handwriting is another important user privacy information in real scenarios. therefore, we further evaluate the FedInverse using GMI and KED-MI attack performance on MNIST dataset in Table D and Table 2 respectively. As shown in Table GMI performs better MNIST than the attack performance on CelebA, which achieves the attack accuracy of 56.00 and the top-5 accuracy of 98.00 in FL training round 5. GMI-HSIC further improves 7% of the attack accuracy to 60.00 and 4% of the top-5 accuracy to 100.00 in FL training round and respectively. The results demonstrate that GMI performs better on the handwriting dataset. As shown in Table 2 the attack accuracy reaches
8

---

Published as a conference paper at ICLR 2024
Table 1: FL privacy leakage indicated by Attack Acc/Acc5 standard deviation(%) and FID on MNIST via FedInverse using GMI and GMI-HSIC with prior training dataset MNIST. Bold values denote the hest metric results obtained by GMI or GMI-HSIC throughout the FL training epoch. The symbol ((1) denotes that smaller (larger) values are favored.
Metrics
Methods
FLAR01
FLAR02
FL4R03
FLARN4
FLAR05
Accunacy
83,34
97.59
98.27
98.4
98.52
GMI
34.019.66
38.00:22.01
34.00s16.47
50,0010.544
56.00:20.66
Attack Ace
GML-HSICC
44.00m1577
44.00=12.65
42.00114.6
56.00m8:4
60.0029.43
GML
94,0029.66
98.0026.32
98.0026.32
96.00s8.43
98.0026.32
Attack Acc5
GMI-HSIC:
96.00+8.41
98.00+6.22
96.00+6.32
100.0000.00
98.00+6. 32
GMI
20.1373
23,1598
22.3839
17,1018
16.7486
FID
GMI HSIC'
19.0645
21,1116 21.5377
15,0066
14.469
Table 2: FL privacy leakage indicated by Attack Acc/Acc5+ standard deviation (%) and FID MNIST via FedInverse using KID-MI and KED-MI-HSIL MI-HSIC with prior training dataset MNIST. Bold values denote the best metric results obtained by KED-MI or RED-MI-HSIL throughout the FL training epoch. The symbol L(1) denotes that smaller (larger) values are favored.
Metries
Methods
FLAR01
FLAR12
FLAR03
FLAR04
FLAROS
Accuracy 1
83.34
97.59
98.27
98.4
98.52
KED-MI
64.0028.66
60.0064.55
80.0020.00
80.0029.00
79, 80020.00000
Allack Ace
KED-MI-HSIC
80,0000.00
64,00+8.3
80.00+0.00
80.20+2.00
KED-MI
1000000000
100,000.00
100,0000.00
100.01H0.00
100.01=0:000
Attac
HED-MI-HSIC 100,000000
1000050.00
100,0060.000
100.0160.000
100.00110:00
KED-MI-HSIC 204.5017
175.9532
161 161,0252
160.9891
80.00 and the top-5 accuracy keeps 100.00 with KED-MI attacks on MNIST dataset, which are extremely high, and KED-MI-HSIC can still slightly improve the attack accuracy to 80.20 which is 0.2% of improvement to the attack accuracy.
6 RELATED WORKS
FL has made significant benefits to the fields of the Internet of Things Savazzi et al. 2202)), network security Chen et al. (2022), and medical care Huang et al.] (2019), but it also faces some challenges. No studies pay attention to the data leakage problem when the attackers pretend to be benign users and attack by the model inversion attacks. Typical model inversion attacks, including Zhang et al. (2020) Chen et al. (021) Wang et al. (2021a), can be leveraged by the attacker attack the FL system. In addition, to evaluate the impact on the diversity of the generated data, Hilbert-Schmidt independency criterion (HSIC) Gretton al. (2005) is introduced, which is statistic dependency measure metric that is well established in statistics. For more detailed related works please refer to Appendix B.
7 CONCLUSION
This is the first study that discovers model inversion (MI) attackers, who act normal partici- pants, can invert the FL global model and obtain the data belonging to other participants. This finding indicates severe data-leakage risk in FL, especially considering FL claims itself to be natu- rally privacy-protected To evaluate this data-leakage risk, we propose FedInverse that can evaluate whether MI attackers can invert the FL global model. We test FedInverse by leveraging three typi- cal attackers, including GMI, KED-MI, and VMI on face recognition and handwriting recognition datasets. The experiment results show that the privacy-preservve MI attacks and it is difficult to prevent this risk if the attackers are acting as normal participants in FL. We further evaluate the efficacy MI attacks with the diversity generated images by using Hilbert-Schmice independence criterion (HSIC) as the regularizer. The results prove that the attack performance significantly improved when increasing the diversity of the generated images. Based on that, consider promising future works for this topic would focus further increasing the diversity of the generated images of an attacker and how to protect the user privacy from the MI attacks on FI..
mechanism of FI. vulnerable to

---

Published as a conference paper at ICLR 2024
REFERENCES
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International conference on machine learning, pp. 214 223. PMLR, 2017.
Giuseppe Ateniese, Luigi V Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, and Giovanni Felici. Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers. International Journal of Security and Networks, 10(3):137- 150, 2015.
Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. Reconstructing individual data points in federated learning hardened with dif- ferential privacy and secure aggregation. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pp. 241-257. IEEE, 2023.
Junjun Chen, Qiang Guo, Zhongnan Fu, Qun Shang, Hao Ma, and Di Wu. Campus network intrusion detection based on federated learning. In 2022 International Joint Conference on Neural Networks (IJCNN) pp. 1-8. IEEE, 2022.
Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enrichen distributional model inversion attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16178-16187, 2021.
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (ICCNN) pp-
2921-2926. IEEE, 2017.
Zhicheng Cui, Wenlin Chen, and Yixin Chen. Multi-scale convolutional neural networks for time series classification. arXiv preprint arXiv:1603.06995, 2016.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confi- dence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC confer- ence computer and communications security, pp. 1322-1333, 2015.
Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogennties: An end-to-end case study of personalized warfarin dosing. In 23rd (USENIX) Security Symposium ([USENIX) Security 14), pp. 17-32, 2014.
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- how easy is it to break privacy in federated learning? Advances Neural Information Processing
Systems, 33:16937-16947, 2020.
Yves Grandvalet and Yoshua Bengio. Semi-supervised learning by entropy minimization. Advances in neural information processing systems, 17, 2004.
Arthur Gretton, Olivier Bousquet, Alex Smola, and Bernhard Schölkopf. Measuring statistical de- pendence with hilbert-schmidt norms. In Algorithmic Learning Theory: 16th International Con- ference, ALT 2005, Singapore, October 8-11, 2005. Proceedings 16. pp. 63-77. Springer, 2005.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. Deep models under the gan: infor- mation leakage from collaborative deep learning. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp. 603-618, 2017.
Li Huang, Andrew L Shea, Huining Qian, Aditya Masurkar, Hao Deng, and Dianbo Liu. Patient clustering improves efficiency of federated machine learning to predict mortality and hospital stay time using distributed electronic medical records. Journal of biomedical informatics, 99:103291, 2019.
10

---

Published as a conference paper at ICLR 2024
Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient in- version attacks and defenses in federated learning. Advances in Neural Information Processing Systems, 14.7232-7241, 2021.
Marcus Hutter. Distribution of mutual information. Advances in neural information processing systems, 14, 2001.
Kaggle. Covid-19 et scans, http:///www.kkkgooooooooooooo/e/
2019.
Mostafa Kahla, Si Chen, Hoang Anh Just, and Ruoxi Jia. Label-only model inversion attacks via boundary repulsion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 55045-15053, 2022.
Peter Kairouz, Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Ad- vances and open problems in federated learning. Foundations and Trends@ in Machine Learning, 14(1-2)11-210 2021.
Mahdi Khosravy, Kazuaki Nakamura, Yuki Hirose, Naoko Nitta, and Noboru Babaguchi. Model inversion attack by integration of deep generative models: Privacy-sensitive face generation from face recognition system. IEEE Transactions on Information Forensics and Security, 17:357- 372. 2022.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 86(11):2288-232, 1998.
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE signal processing magazine, 37(3):50-6)) 2020.
Wei Yang Bryan Lim, Nguyen Cong Luong, Dinh Thai Hoang, Yutao Jiao, Ling-Chang Liang, Qiang Yang, Dusit Niyato, and Chunyan Miao. Federated learning in mobile edge networks: A comprehensive survey. IEEE Communications Surveys Tutorials, 22(3):00312206 2020.
Ximeng Liu, Lehui Xie, Yaopeng Wang, Jian Zou, Jinbo Xiong, Zuobin Ying, and Athanasios V Vasilakos. Privacy and security issues in deep learning: A survey. IEEE Access, 9:4566-4593, 2020.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference computer vision, pp. 3730-3738, 2015.
Romain Lopez, Jeffrey Regier, Michael Jordan, and Nir Yosef. Information constraints on auto- encoding variational bayes. Advances neural information processing systems, 31, 2018.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. cummunication-efffiiee learning of deep networks from decentrulized data. In Artificial intelli- gence and statistics, pp. 1273-1282. PMLR, 2017.
Dinh C Nguyen, Ming Ding, Pubudu Pathirana, Aruna Seneviratne, Jun Li, and H Vincent Poor. Federated learning for internet of things: A comprehensive survey. IEEE Communications Sur- veys & Tutorials, 23(3):1622 1658, 2021.
Dinh C Nguyen, Quoc- Quet Viet Pham, Pubudu N Pathirana, Ming Ding, Aruna Seneviratne, Zihuai Lin, Octavia Dobre, and Won-Joo Hwang. Federated learning for smart healthcare: A survey, ACM Computing Surveys (CSUR), 55(3):1-37, 2022.
Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. Eluding secure aggregation in federated learning via model inconsistency. In Proceedings of the 2022 ACM SIGSAC Conference on Com- puter and Communications Security, pp. 2429-2443 2444,,224,,222 2022.
Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against inodel-inversion attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1358-1 1367, 2022.
11

---

Published as a conference paper at ICLR 2024
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv: 2015.
Maria Rigaki and Sebastian Garcia. A survey of privacy attacks in machine learning. arXiv preprint arXiv:2007.07646, 2020.
Mikail Mohammed Salim and Jong Hyuk Park. Federated learning- -ased secure electronic health record sharing scheme in medical informatics. IEEE Journal of Biomedical and Health Informat- ics, 27 2023. doi: 10.1 109//BHL.2022.31742222
Stefano Savazzi, Monica Nicoli, and Vittorio Rampa. Federated learning with cooperating devices: A consensus approach for massive iot networks. IEEE Internet of Things Journal, 7(5):4641- 4654, 2020.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEFE, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogmition. arXiv preprint arXiv:1409.1555 2014.
Le Song, Alex Smola, Arthur Gretton, Justin Bedo, and Karsten Borgwardt. Feature selection via dependence maximization. Journal of Machine Learning Research, 13(5), 2012.
Jean Ogier du Terrail, Samy Safw-n Ayed, Edwige Cyffers, Felix Grimberg, Chaoyang He, Regis Loeb, Paul Mangold, Tanguy Marchand, Othmane Marfoq, Erum Mushtaq, et al. Flamby: Datasets and benchmarks for cross-sile federated learning in realistic healthcare settings. arXiv 2022.
preprint arXiv:2210.0444
Huayan Wang and Qiang Yang. Transfer learning by structural analogy. In Twenty-Fifth AAAI Conference on artificial intelligence, 2011.
Kuan-Chieh Wang, Yan Fu, Ki Ashish Khisti, Zemel, and Alireza Makhzani. Variational model inversion attacks. Advances in Neural Information Processing Systems, 14:9706-9719, 2021a.
Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving robustness to model inversion attacks via mutual information regularization. In Proceedings of the AAAI Conference Artificial Intelli- gence, volume 35, pp. 11666-1 1673, 2021b.
Tinghua Wang, Xiaolu Dai, and Yuze Liu. Learning with hilbert-schmidt independence criterion: A review and new perspectives. Knowledge-Bert Based Systems, 234:107567, 2021c
Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. In IEEE IN- FOCOM 2019-IEEE conference on computer communications, pp. 2512-2520. IEEE, 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist. a novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint arXiv:1708.0774;; 2017.
Chen Zhang, Yu Xie, Hang Bai, Bin Yu, Weihong Li, and Yuan Gao. A survey on federated learning. Knowledge- Based Systems, 216: 106775, 2021.
Jiale Zhang. Junjun Chen, Di Wu, Bing Chen, and Shui Yu. Poisoming attack in federated learning using generative adversarial nets. In 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/113 IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDattaSt pp. 374-380. IEEE, 2019.
Yin Zhang and Zhi-Hua Zhou. Multilabel dimensionality reduction via dependence maximization. ACM Transactions on Knowledge Discovery from Data (TKDD), 4(3):1-21, 2010.
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li. and Dawn Song. The secret vealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEFF/CVF conference on computer vision and pattern recognition, pp. 253-261, 2020.
12

---

Published as a conference paper at ICLR 2024
Joshua Christian Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H Ezzeldin, Salman Aves- timehr, and Saurabh Bagchi. Loki: Large-scale data reconstruction attack against federated learn- ing through model manipulation. In 2024 IEEE Symposium Security and Privacy (SP), pp- 30-30. IEEE Computer Society, 2023.
I Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural infor- mation processing systems, 32, 2019.
A APPENDIX
A.1 EXPERIMENT IMPLEMENTATION DETAILS
We will elaborate more on the experiment implementation details in the appendix. We conducted the FedInverse experiments on the extra datasets such as EMNIST et al. (201)) and Fashion- MNIST (FMNIST) Xiao et al. (2017) rather than MNIST, CelebA and CIFAR-TÓ with different attack settings. EMNIST an expansion of the original MNIST dataset, encompasses a richer variety of handwritten characters. It goes beyond digits to include letters, both lowercase and up- percase, thereby offering a more comprehensive view of handwritten character recognition. The dataset has been carefully partitioned into multiple subsets, each tailored to specific tasks - rang- ing from digit recognition, balanced character sets, to datasets designed for by-class and by-merge recognition tasks. With the inclusion of alphabetic characters, the complexity and variability in the data increase, offering a more challenging playground for machine learning models. Additionally, Fashion-MNIST is alternative to the original MNIST digit dataset, curated to serve a more challenging problem in the domain of image classification. Designed by Zalando, a European e- commerce company, the dataset contains grayscale images of 28x28 pixels each, encompassing 10 fashion categories, such as T-shirts, trousers, pullovers, dresses, and more. Each category is popu- lated with 7, 7,000 images, leading training set of 60,000 images and a test set of 10,000 images, mimicking the exact structure of the classic MNIST.
A.2 MORE EXPERIMENTAL RESULTS ON MNIST TYPES DATASETS
A.2.1 IMPACT OF PRIOR DATA WITH FEDINVERSE++MI ON EMNIST AND FMNIST
To assess the influence of prior data on the efficacy of GMI attacks FL., we employ EMNIST and FMNIST datasets as prior data for GMI, respectively. Pertinent findings from our empirical investigations are presented in Table 3 The results of FedInverse attack using GMI and GMI-HSIC are illustrated in Table 3. where we have the attack performance with varying GMI attack settings and FL training rounds. As shown in Table Similar to the results reported on MNIST and CelebA in our paper, GMII-SIC consistently achieves better attack performance and FID since the first FL training round on EMNIST, indicated by improvement of the attack accuracy (60.00 vs 62.00), the top-5 attack accuracy (92.00 vs 96.00), and FID (13.4053 vs 11 11.064). FL. training accuracy has been increased and stabilized in the second round from 83.34 to 98.52, and it is worth noting that GMI-HSIC achieves the highest attack accuracy and top-5 attack accuracy, which outperforms GMI as attack accuracy (70.00 vs 72.00), both reaches 100% top-5 attack accuracy and FID (6.3623 vs 5.5718). On FMNIST, the results show the same trend, in which GMI-HSIC outperforms the GMI as as attack accuracy (52.00 vs 58.00), top-5 attack accuracy (98.00 vs 90.00), and FID (18.3514 vs 16.8608)
A.2.2 IMPACT OF PRIOR DATA ON REDINVERSE+KEDAA ON EMNIST AND MNIST
To assess the influence of prior data on the efficacy of KED-MI attacks on FL., we employ EMNIST and FMNIST datasets as prior data for KED-MI, respectively. Pertinent findings from our empir- ical investigations are presented in Table 4 Compare to GMI, KED-MI completely penetrates the
mechanism of FL personal privacy protection on both EMNIST and FMNIST. For EMNIST, the best attack accuracy dramatically increases from 70.00 in Table to 88.15 in Table 4 The best result of KED-MI-HST attack accuracy also increases from 72.00 in Table [3 to 99.99 in Table 4 where all the best top-5 accuracy can achieve 100%. The results of FMNIST have similar trend EMNIST,
13

---

Published as a conference paper at ICLR 2024
Table 3: FL privacy leakage indicated by Attack Acc/Ace5+ standard deviation %) and FID on MNIST via FedInverse using GMI and GMI-HSIC with two diverse prior training datasets: EMNIST and FMNIST. Bold values denote the best metric results obtained by GMI or GMI-HSIC throughout the FL training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Metrics
Methods
FLeR01
FLYRO2
FL
FLAR04
FLAK05
FLeR01
FLARO2
FL4R03
FLARN
FLAROS
Prior Data
EMNIST
FMNIST
Acvuracy 1
83.34
97.39
98.27
98.40
98.52
83,49
97.87
96.36
98.73
GMI
00,00423009 64 0000000066 1.9.0 (8.59996800011111 68.00166.87 70.06.77770000000 70.00:19.44
58.00 11
42.00A 10..00111.70000
18.38
46,0019.06 06
$2, 13.00
Altick Acc
GMI-HSIC 62.00422.01 6600+16.47
(8800009.32 72.00:
50.00H
0000000111..00 56.001155 58.00=144.76
92,00:10.33 94.0019.66
96.00s8433
100.00:0.00
90.00:10.44
Alback Ace5
GMI-HSIC 96,0048.43
98.0026.32
100.00:0.00 100.00:0.00 011000000000000000000 100.00::00000
64.00815.78 78 88, 18.001100.50 100.3399000000 10,
98.0026.32
GMI
13,4053
11,3012
11,1458
9.9356
6.3623
20,9196
19.0771
18,4007
18,4105
18,3514
FID
GMI-HSIC
11,64 10.2641 9.9451
9:1239
5.5718
19,2656
17.9661 17.1093
17,6389
16,8608
in which the best attack accuracy dramatically increases from 52.00 Table 3 to 86.83 in Table The best result of KED-MI-HSIC attack accuracy also increases from 58.00 in Table 3 to 99.80 in Table 4 In addition, we also compare the attack performance between KED-MI and KED-MI- HSIC, KED-MI-HSIC improves the attack accuracy (88.15 vs 99.99) and smaller FID (127.9106 vs 116.5144) on EMNIST. and attack accuracy (86.83 vs 99.80), and smaller FID (192.0721 vs 185.9508 on FMNIST, respectively.
Table 4: FL privacy leakage indicated by Attack Acc/Acc5t standard deviation(%) ()) and FID on MNIST via FedInverse using KED-MI and KED-MI-HSIC with two diverse prior training datasets: EMNIST and FMNIST. Bold values denote the best metric results obtained by GMI or GMI-HSIC throughout the FL training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Metrics
Methods
FLAR01
FLAR02
FLAR03
FLARN
FLAROS
FLAR01
FLER02
FLARE
FLER04
FLARe5
Prior Data
EMNIST
FMNIST
Accuracy
$3.34
97.59
98.27
98.40
98.52
83,49
97.87
98.36
98.73
98.94
KED.M
14.1742.21 80.0000000 24.2443.21
85.00=8.34
88.1562.77
73.9084.49
78:2344722
81,4963.077 KINE11L.51
8683e1.71
Attack Ace
KFD-MI-HSIC 7O 07.09900.299 86.79666660000 6700.00
80+5.8
99.11+3.08
99.99+0.29
76.24+
82.46-7
87.6944.28
87.00+9.55 56
99.80=1.82
KED
$1,7618.33 95.0744.7777
100.00:9.00 100.00::0.00 100.00:0.00
100.0010.00
100,0000000
100.0010.00
100.0010.00 100.0000.00
KHD-MI-HSSE
VZ. 1266. 12.3.99 100.00500.00
100.00:0.00
100.0009).0
100.00H0.00
10000000000
100.00600:00
100.0050..00
100,0000000
KED
155.4555
151.3636
141.9426
139.4965
127.9106
235.5265
213,3955
210.1306
199.6505
192,0721
FID
KED-MI-HSIK
146.2689
140.6991
333.3661 116.8525
116.5144
223.582
202 285
199.2425
198.5916
185.0508
A.3 IMPACT OF PARALLELISM ON FEDINVERSE+GMI ON MNIST
We investigate the influence of FL parallelism by modulating the active fraction of participants on the attack performance of GMI within the context of FL. Pertinent observations are detailed in Table We adjust the numbers of the participants in FL. settings from 10% to 100% to monitor the parallelism impact attacks. We observe that the attack performance varies, and GMI has similar results when 10%, 20%, and 50% participants join each training round from 56.00 to 58.00. However, the attack performance decreased to 48.00 when 100% participants joined the FL round. The same trend happens on EMICHSIC, the attack accuracy varies from 60.00 to 58.00 when 10%, 20%, and 50% participants join each training round and decrease to 49. 20 when 100% participants join the FL round. In addition, the top-5 attack accuracy remains stable from 98.00 to 100.00 on GMI and keeps 100 GMI-HSIC, respectively.
14

---

Published as a conference paper at ICLR 2024
FL privacy leakage indicated by Attack Acc/Ace5+ standard deviation %) and FID MNIST via FedInverse using GMI and GMI-HSIC with varying active fractions of participants. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the FL training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Table 5:
Metries
Methods
FLAR01
FLARO2
FL
FLAR04
FLeROS
FL4R01
FLAR02
FL
FLARN
FLAROS
Praction of Participants
0.1
0.2
Accuracy
83.34
97.59
98.27
98,40
98.52
83,49
97.87
98.36
98.73
34.0049.06
28.00=22.01
57.0010.77 56.00:20.60
$4.00%166.
001 46.00 16.00
41.00415.78 65.0012.55 (2.00:14.76
56.0018.43
60.00:9:43
56.00
44.00015.778466
18..3....0000000..000 (8.0012) 58.00:177.5
GMI
94,00e9.66
98.0026.32
98.00s6.32
96.0018.43
98.00=6.32
96.0069.43
43
96.00+8.43
00.0006662
100.0000.00
100.00=0..0
Altack Acc5
GMI-HSIC
96.00e8.43
98.00s6.32 32
98.00s6.32
32
100,0000.00 98 00e6.32
00:00:443
98.0016.3. 32
100.0000.00 100,0000.00 100.00.0.00
GMI
20.1373
23,2598
22.3839
17,1018
16.7486
20.9278
19,8334
18,8355
17,5003
14.791
FID
GMI-HSIC
19,0845
21.1116
21,5377
15,6066
14,409
1899699
18.5146
18.4547
16,5750
12.7691
Fraction of Participants
0.5
1.0
Accuracy
87.37
97.78
98.46
98.87
99.10
80.38
97.89
98.52
98.85
99.02
GMI 38.00425.73 40.0011........33 46.00 50.000011.11 58.0233300..00
10.00066.8777 1000001111133 44,0025 48.00
Allock Ace 1
44.00422771 46.00 48.0020999....0000.557 28.0000222.0.000000020000
42.00s 1.33
46.00:99.6
49.20l26.50
96.0018.45
94,00g9.66
96.0016.32
98.00s6.32
94.0049.66
96.0048.43
98.0026.32
98.00s6.32
100.00:0.00
Altack Acc5
GMI-HSIC 98.0066.32
98.0066.32
96.00s8.33
98.00166.22
100.0000.00
00.0066633
96.00+8.43
100.00s0).00 100.0000.00 100.00+0.00
GMI
20.3550
20.1785
19,7692
19.3438
14,0115
24.7496
22,3330
20,7582
20,6225
18:5714
FID
GMI HSIIC
19,9560
19.4090
18,8257
17,3110
12,0485
23.1585
20.9507
19,8762
19,4196
17.8631
A.4 IMPACT OF PARALLELISM ON FEDINVERSE+ ON MNIST
We investigate the influence of FL parallelism by modulating the active fraction of participants on the attack performance of KED-MI within the context of FL. Pertinent observations are detailed in Table Unlike GMI, the KED-MI shows more stabilized attack performance, the attack accuracy varies from 80.00 to 79.97, when 10%, 20%, and 50% participants join each training round. And only decrease to 73.33 when 100% participants join each training round. Like KED-MI, the KED- MI-HSIC has the same results, varying from 80.20 79.95, when 10%, 20%, and 50% participants join each training round. And decrease to 75.85 when 100% participants join each training round. However, the top-5 attack accuracy remains 100.00 on both KED-MI and KED-MI-HSIC.
A.5 IMPACT OF LOCAL COMPUTATION ON FEDINVERSE++MI ON MNIST
The influence of local computation on each client plays a crucial role in determining the incorpo- ration of local knowledge present within client data. This influence is governed by two primary hyperparameters E and B. Consequently, we manipulate the values of E and B across a range of settings assess the performance of GMI attacks on FL global models across various communica- tion rounds. The results and pertinent observations from these experiments are presented in Table We adjusted the local computation hyperparameters and observed that the local computation on each client has less impact on FedInverse using GMI and GMI-HSIC. The highest GMI attack accuracy is 56.00 when we set E 1 and B = 10. The attack accuracy on the rest of the settings varies from 42.00 to 48.00 except the E' 2 and B = 60, which reaches 52.00 attack accuracy. For the GMI-HSIC, the highest attack accuracy is 60.00 when we set = and B = 10 or E = 2 and B = 60. The top-5 attack accuracy for GMI and GMI-HSIC stabilized between 98.00 to 100.00.
A.6 IMPACT OF LOCAL COMPUTATION ON FEDINVERSEE+KED--NN ON MNIST
Table g shows the results and pertinent observations from experiments by adjusting the values of E and B to assess the performance of KED-MI attacks on FL global models across various commu- nication rounds. Similar to GMI, We adjusted the local computation hyperparameters and observed that the local computation on each client has less impact on FedInverse using KED-MI and KED-
15

---

Published as a conference paper at ICLR 2024
FL privacy leakage indicated by Attack Acc/Ace55 standard deviation %) and FID on MNIST via FedInverse using KED-MI and KED-MI-HSIC with varying active fractions of partici- pants. Bold values denote the best metric results obtained by KED-MI KED-MI-HSII throughout the FL training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Table 6:
Metries
Methods
FL4R01
FLAR02
FLAROS
FLYRN
FLAROS
FLAR01
FLeR02
FLAR03
FLAR04
FLEK0S
Praction of Participants
0.1
0.2
Accurary
83.34
97.59
98.27
98.4
98.52
83.49
97.87
98.36
98.73
98.94
KBD-MI
64.60188446
60.6064444
50.0020.00
80.00=0.00
79.8012.000
57.7564.88
66.0962299
66.67=0.00
67.45566.95
Attack
50.00,0.00
68.4068.33
39.6342.70
74.32
79.37,3.32
79.59g1.60
79.95=0.59
KED-MI
100,00+0.00 100,0000000 100,0100.00
000000000000
100.00+00000 (00
10000001.00
100,0000.00
100.00601000
100,0000.00 10000000.00
Atlack Aoc5
KRD-MI-HISIC
100,0010.00 100,0000
100,00+0.00 100.00 00:0.00000000000000000
100,00+0.00
(00,00+0.00 100.0000.0000000000 00
100,0000000000000000
100,00+0.00 100.00s0
KED M1
209.1448
206.0789
195.1807
184.995
175.9532
206.817
196.2008
199.594
189.9266
170.3652
FID
KBD-MI-HSIC
204.5017
198.6938
175.9532
16102252
160.9891
200.2681
195.9936 9936
190.2452
187.61
131,5852
Fraction of Participants
U.S
1.0
Accuracy
$7.37
97.78
98.46
98.87
99.10
80.38
97.89
98.52
98.85
99.02
KED-MI
60.0010.00
54,0426.33
68.8511 73,8710007
80, 00.00.0.00
51.3917.35
59.9111.0
58.9116.52
60.6312.40 40
73.33:0.00
Attack Ape T
00.0540:42
62.96adi.30
09.91211.55
75.2528.30
80.00:0..00
58.1246.30
6000050000
60.08&1.08
06.0926.50
75.85=2.57
99.9620.71 100.00:0.00
100.0010.00 0000:400..000.00:00000000 10000000000000000000000000000000 100.00:0.000
100.0010.00
100.0000.00 100.0010.000
100.0010.00 100.00.0.00
Attack Acc5
KHD-MI-HSIC
99.00e1.9 100.00#0.00
100.00se0.00 100.00:0.00 100.00e00.00
10.00000.0
10010000.00
100.0000.000
100,0000.00 10000000000
KED-MI
200.696
179.1579
173,4662
1586515
156,9115
223,7763
218.7452
219.0277
199.7431
195.0272
FID
KED MI HSIC
187.3081
165.0061
158,7922
138.1317
145,5453
220.3384
198.8252
193.7816
19L,4311
184.3157
MI-HSIC. The highest KED-MI attack accuracy is 86.67 when we set E' = and B 60. The attack accuracy on the rest of the settings varies from 78.89 to 83.17. For the KED-MI-HSIC the highest attack accuracy appears E 1 and B 120, which 93.33. Others vary from 80.00 to 87.64. The top-5 attack accuracy keeps 100.00 on all settings.
A.7 IMPACT OF DEFENSE METHODS ON FEDINVERSE+ ON MNIST
To evaluate the performance of FedInverse against SOTA defense methods, vailing defense methods, MID Wang et al. (2021b) and BiDO Peng et al. (0022). to train the FL models. Mcanwhile, we launch the GMI attacks the updated global models in each federated communication round to see if these defense training schemes can still work in FL settings. The relevant observations are summarized in Table 9 The FedInverse with GMI and GMI-HSIC suc- cessfully attacked the FL with MID on the fourth training round and reached attack accuracy of 50.00 and 58.00, respectively. Similar to MID settings, GMI and GMI-HSIC successfully attacked the FL with BiDO on the fourth training round and reached attack accuracy of 40.00 and 42.00, re- spectively. For top-5 attack accuracy, GMI reached 100% in round 3, and GMI-HSIC reached 100% in round 2 with both MID and BiDO defense settings. The results show that the SOTA defense approach cannot defend against FedInverse+GMI attacks on FL. settings on MNIST dataset.
two latest pre-
A.8 IMPACT OF DEFENSE METHODS ON SEDINVERSE+KED.EEE ON MNIST
Table TO illustrates the impact of defense methods on FedInverse+KED-M on MNIST. The Fed- Inverse with KED-MI and KED-MI-HSIC successfully attacked the FL. with MID on the fourth training round and reached attack accuracy of 71.57 and 74.03, respectively. Similar to MID set- tings, KED-MI and KED-MI-HSIC successfully attacked the FL with BiDO on the fourth training round and reached attack accuracy of 61.01 and 66.85 66.85, respectively. For top-5 attack accuracy, KED- MI reached 100% since round 1, and KED-MI-HE DED-MI-HSIC also reached 100% in round with both MID and BiDO defense settings. The results show that the SOTA defense approach cannot defend against FedInverse+ KED-MI attacks on FL. settings MNIST dataset.
16

---

Published as a conference paper at ICLR 2024
Table 7:
FL privacy leakage indicated by Attack Acc/Ace5# standard deviation %) and FID on MNIST via FedInverse using GMI and GMI-HSIC with varying local computation. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the FL. training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Metries
Methods
FLAK01
FLARO2
FLAK03
FLAR04
FLek05
FLeK01
FLAR02
FLER03
FLARM
FLARO5
Local Computation
(E. B) = (1. 10)
(E. B) = (2, 10)
Accuracy 1
83.34
97.59
98.27
98.4
98.52
97.64
98.15
98.81
98.91
99.02
34.00
38.00=22.01 34,00416.47 5000E10.044
56.00:20.60
12.0001199 34..99933344.4108.92 38.07/388000008000 19.00 40,0049.02 42.00=17.551
Attack. Aes
GMI 1.1000015..74..0011.... (2.00:14.76
56,0018.43
60.00:9:43
36.00s112.65
10.00216.33-120000 (1.00115.77 48.0222500
GMI
94,0099.66
98.0026.32
98.0056.32
96.0058.43
98.00=6.32
13.90
94,00+9.66
96.00e9443
94,0069.66
98.00e6.32
Altack Acc5
GMI-HSIC
96.00e8.43
98.00
32
98.00s6.32
100,0000.00
98 00e6.32
96.00:8:43
98,00+6.32
98 38.00a6.37
100.00s0.00 100.0009.00
GMI
20.1373
23,2598
22.3839
17,1018
16.7486
23:7213
23.6720
22,8779
21,4082
20.7127
FID L
GMI-HSIC
19,0845
21.1116
21,5377
15,6066
14,469
21.3812
21.4645
21 23.2353
20,7013
19.7279
Local Computation
(E. (B) (1. 30)
(E, BB
(2. 300
Accuracy 1
85,30
95.77
97.37
98.22
98.18
95.07
98.03
98.61
98.46
98.92
36.00-18 38000000000000000022202000 42.000442000406666666600
18.00188.777 36,00122.71
58 000 19.89 44
Attock Acc
GMI-HSIC 38.00114.7640.00000 717.00000147744444557777778888
36.00u22
18.00
40.00s18
42.00:14.76455000222
GMI
94.00+9.66
96.00-8.43
98.00+6.32
08.00+6.32
100.0000.00
94.00+9.66
66
98.0046.32
98.0066322
96 96.00+8:43
98.0066.32
Attack Acc5
GMI-IIIC 100,00:0,00 100,0010.00 98.0046.32
100.0040.00 100.00:0.00
94,00g9.66
98,0016.32
100,0000.00
98,0046.32
100.0010,00
GMI
23,9145
22.6867
21,1273
20:2517
18,1435
20.4775
19,0410
18.6166
18,2479
16.4464
HD L
GMI-HSIC
22,7100
20.5478
1888782
20.1115
17.4279
19.6434
17,3692
18 1270
17,3406
16.0987
Local Computation
(E. B) = (1, 60)
(E, B) (2, 60)
Accurcy 1
86.35
90.40
95.79
96.40
97.52
90.48
96.65
97.17
98.09
98.38
GMI
34.00+23 36 00-1000115500
00+1 48.00
19.32
10. 17.
00+ 50.0000000000005550--- 1,0
Attock Acc
GMI 36.00118.38 18.00 (8.00116.87
44.00115.75 50.00:17.00
+2.00
11.35
00001113.50000011700000000 0T000/1177.0022011116.6.. 11116666660000-1111 69.00116..33
GMI
86.0K81899 3.. 96.00=8.43
94.0059.66
96.00=8.43
94.00e9.66
9% 99.0086.32 96.00=N.43
100.00:0.00 96.0088.44
Attack Accd
GMI SMM-HSIC
94,0099.66 92.00210.35 98.0085.32
96,00A8.43
98.00:6.32
96.00s8.43
98,0026.32
100.0050.00 100.00:0.00 100.00:0.00
GMI
22,6974
19.9287
17,0055
16,6408
15,4819
22,5858
21,0912
17,7921
15.3665
12.30899
FID L
GMI-TISIC
20,9624
18,3025
17,490
15.6629
15:4757
21.2270
20.7513
15.6794
15,5562
10.6041
Local Computation
(E, B) (1. 120)
(E, B)
(2, 120)
Accurecy 1
51.34
56.95
68.00
78.90
92.08
61.04
82.81
92. 02.33
95.99
97.27
GMI
30.00 34.00000343300022111 10 13.33 42.0422...3333 44,00
30.00s 49 001000011110000 98 00 38.38.000 50..8800000111344200000111
Altock Ace
GMI HSIC 34.0011 12.0014447700.000..........6000. 101.14144.777000011887777777 01.000011...744000999..333 48.00:19.32
30.00
38.008220000000000 01 N0.06:25.00944400022000
GMM
92.00H13.88 26.6012.66 98.0056.32
06.00+8.43 08.00=6.22
90.00
54 96.0H+N.4
96.00H9.43
94.00+9.66
96.00+9.43
Attack Acc5
GMI-IISIC 96.0011265
98.0016.32
100.00:0.00 100.0010.00 100.00:0.00
98.00u6.32
98,0016.32
96.0018.43
98.0066.32
98.0016.32
GMI
21,2109
21.4954
19,8025
19,1230
18,9499
25.0463
23.8215
23.4771
23,5279
22,0935
FID L
GMI HSIIC
19,5419
20.4106
18,4925
18.7281
17.7968
22.6472
22,4640
22.4177
21,9816
21.0760
A.9 FEDINVERSE ATTACK PERFORMANCE ON CELEBA
The results of FedInverse using GMI and GMI-HSIC are illustrated in Table IT where we have the attack performance with varying GMI attack settings and FL training rounds. As shown in Table II GMI-HSIC consistently achieves better attack performance and FID since the first FL training round, indicated by improvement of 10% of the attack accuracy (8.50 vs 9.43), 2% of the top-5 attack accuracy (22.07 vs 22.70), and FID 198.1281 vs 96.9064). FL training accuracy has been increased and stabilized in the second round from 66.05 to 80.48, and it is worthy noting that GMI-HSIC achieves the highest attack accuracy and top-5 attack accuracy which outperforms GMI by 5% of the attack accuracy (11.33 vs 11.93), 5% of the top-5 attack accuracy (25.49 vs 26,77), and smaller FID (104.0733 101.0956). When compared with the GMI and GMI-HSIC, GMI can partially leak images from other participants and the attack performance can be significantly improved by GMI-HSIC, in which the diversity of the generated images has been optimized by HSIC.
17

---

Published as a conference paper at ICLR 2024
FL privacy leakage indicated by Attack Acc/Ace5+ standard deviation %) and FID on MNIST via FedInverse using KED-MI and KED-MI-HSIC with varying local computation. Bold values denote the best metric results obtained by KED-MI KED-MI-HSIC throughout the Fl. training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Table 8:
Metries
Methods
FLeK01
FLAR02
FLER03
FLYRO4
FLAROS
FLAR01
FL4R02
FLAR03
FLAR04
FL4R05
Local Computation
(E, B) = (1, 10)
(E. B) = (2. 10)
Accuracy
83.34
97.59
98.27
98.4
98.52
97.64
98.15
98.81
98.94
99.02
KED-MI
14.04t8846
60.60144445
$0,00:0.00
80.00=0.00
79.80+2..00
60.1541.73
61.3564911
74.17=9926
78.4845.77
78.89:1.48
Attack
MI-IISIC
80,00:0.00
64.4018.33
80.0010.00
80.20:2.00
80.20:2.00
60.5243.16
61.8515.71
79.51a1.10
79.9916.63
85.09.4.14
KED-MI
10000000.00 100,0000.000
100,0000.00
100.0050000
100,00+0).0
100,0000.00
100.00+0.00 1000000000
100,00H00000
100,00+0.00
Altack Acc5
KED-MI-HSIC
100,00:0.000 100,0000.00
100,00+0.00 100.0000.00
100.00+0.00
100,00+0.00
100.00+0.00
100,0000.00
100,00+0.00
100.00s0.00
KED
MI
209.1448
206.0789
195.1807
184.995
175.9532
189.0635
182.2778
178.8578
173.078
167.2463
FID
KED-MI-HSIC
204-5017
198.6938
175.9535
1610225
160,9891
182.813
18099875
175.1939
160.6834
162.9299
Local Computation
(E, B) (1. 800
(E. B3) (2, 30)
Accuracy
85.30
95.77
97.37
98.22
98.38
95.07
98.03
98.61
98.46
98.92
KED-MI
62,00=5575
64.5545.66
71.20=3.11
78.35=2.88
80.00=11.00
60,0000000 64 64.00111999 66.886662
76.5346.47
83.1767.21
Attack Acc
KED-MI-HSIC
63
65, 65.52+2.51
72.55+3.70
80.0000.00
62,67.6. 39 65 2.0 68.8549.77
79.40x3.32
83.64.7.69
KRD-MI
100.0000.00 100,0000.00
100.00+0.00
100,0000 100.00+0.00
100.0008.00 100.0000.00 100.0000000
100.00+8.00
100,0000.00
Altack Acc5
KED-MI-IISE
100.0000.001000000000
100.0010.00
100.00.0.00 100.00.0.00
100,00+0.00 100.0010.00 100.00.0.00
100.00.0.00
100.0010.00
KED-MI
191.3177
186,0394
175 8877
169.0031
162.7329
217,0403
210.2183
204.235
183.4357
180.9140
HID
KFD-MI-HSIC
08.9649
185.2330
172.8691
164.9772
160.6046
206.0624
203 1168
196,6099
178-4203
162.7005
Local Computation
(E, B) = (1. 60)
(E. B) (2, 60)
Accurscy
86:35
90:40
93.79
96.40
97.52
90,48
96.65
97.17
98.09
58.3W
KFD-MI
90.92-0 72 19+4.02
67.31+6.49
77 30
86.6740.00
59.7242.30
71.00+12.85
75.33+8
79.72-2.2896
80.00=0.00
Attack: Ace
MI-1ISIC
12.17 66.67200.00
38.001338221
80,0000000
87.6810.42
60.0010.00
15.1.88.89
76.90.9922
79 79.6912.25
$0.00:0.00
KED-MI
10000:0000 10000000000
100.0000.00
100.0000
100.0060.0X
100.0000.00 100.0000.00
100.00H00.00
100.0000.00
Attack Acc5
KED MI-HSSC
1000000.00 100,0040.00
100.0020.00
100.0000.00
100.0000.00
100,0040.00
100.0050.00 100,000000
100.0040.00
100.0010.00
KED-MI
1943352
188.9867
198.0894
179.0765
170.3807
203,035
192,8933
179.7266
173.2627
154.8155
FID
MI--MC-
6016
163.9228
163.4239
148:2069
131,0884
185.054]
173.8115
171.704
163.2503
15366553
Local Computation
(E. B) (1. 120)
(E, B) (2, 120)
Accuracy
$1.34
56.95
68.90
78,90
92.08
61.04
82.1
92.53
95.99
97.27
KED-MI
5664447
60.0310.42
669121.50
79.6521448
80.0010.00
46.8911 82 53 10.80
66.35a1
66.6740.00
80.00:0.00
Attack
KED
50.0000000
66.6710000
73.3350.00
80,0050000
93.3320..0
60.3342.50
63.73111.20 66.6750.00
75.7743.21
$0.01:0.29
KFD-MI
100,0000.00 100,000.000
100,00H0.00
100,0000
100.0000.00
100.0000.00
100.0000.00 100,0000
100.80H8.00
100,0000.00
Attock Apc5
KED-MI-IISIC
100.0000.00 100,0010.00
100.0010.00
100.00.0.00
100.00.0.00
100.00+0.00
100.0010.00 100.00.0000
100,0010.00
100.0010.00
KED-MI
243.4333
230.6205
212.6278
192,4796
185,4447
243.9973
228 1217
214,8240
200.3790
184.5743
FID
KED MD HISIC
216.9471
215.6928
200.0319
182,6337
170.4385
196.2384
187.2983
179.7032
162.6797
160.1287
The performance evaluation of FedInverse using KED-MI attack on CelebA is presented in Table 12 where we use the same attack settings as the GMI attack. Compare to GMI, KED-MI completely penetrates the mechanism of FL personal privacy protection, and the best attack accuracy dramati- cally increases from 11 1.33 in Table to 57.80 in Table [2] and the best top-5 attack accuracy booms from 25.40 Table [T to 85.47 Table 12 The best result of attack accuracy and top-5 attack accuracy also increases from 11.93 in Table to to 60.13 in Table [2] and 26.77 in Table [1 to 85.80 in Table 12 respectively, compared to GMI-HISC and KED-MI-HSIC. When we compare the attack perfor- mance between KED-MI and KED-MI-HSIC, KED-MI-HSS (57.80 vs 60.13), 2% of the top-5 accuracy (82.73 vs 84.73), and smaller FID (244.159 vs 239.4701) in FL training round 9 and 10 respectively. According to the results, participants' privacy in FL can be easily revealed by the KED-MI, and HSIC plays an important role in increasing the diversity of the generated images where the attack accuracy can be improved.
improves 4% of the attack accuracy
18

---

Published as a conference paper at ICLR 2024
FL privacy leakage indicated by Attack Acc/Ace55 standard deviation %) and FID MNIST via FedInverse using GMI and GMI-HSIC with two diverse defense methods: MID and BiDO. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the Fl. training epoch. The symbol ((t) denotes that smaller (larger) values are favored.
Table 9:
Metriies
Methods
FLAK01
FLARO2
FLAK03
FLAR04
FLeROS
FL4R01
FLAR22
FL4R03
FLARM
FLARO5
Defense Method
MID
BIDO
Accuracy
86,69
97.85
97.97
98.59
98.54
95.79
96.20
97:47
97.93
96.51
GMI
01
40.0029.43
42.00 50.0011..4 60.00 18000011...000 18.80
$2.002
34.00213 34..44994...00.0 34.00221.
40,00=13.33 38.00219..88
Acc
GMI-HSIC 40.00+21 42.00+14.780 24.76644.001111 14.00-188..00
58.000-11.35 2.00:110...000222111
000
36.00H12.65
36.00 48..7822000-99.89
96.00s8433
98.0016.32
100.00:4.00
100.00a0.00
100.00:0.00
00.800383
100.00:0.00
Attack Acc5
GMI-HSIC 98.00166332
100.0040.00 100.00:0.00 100.00s0.00 100.00:9.00
98.0066.32
100.00:0.00
190.00s9.00 100.00:0.00 100.00=0.00
GMI
23,9977
21.4223
20.1756
20,9989
19,9425
26.3337
25.0333
24.2407
23,7480
21.6887
FID
GMI-HSIC 23.4958 20.1026 19.8077 19.2872
18,2523
25.5310 24,3883
23. 1513
22,8132
20.1309
Table 10: FL privacy leakage indicated by Attack Acc/Acc5+ standard deviation (%) and FID on MNIST via FedInverse using KED-MI and KED-MI-HSIC with two diverse defense methods: MID and BiDO. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the FL training epoch. The symbol L(t) denotes that smaller (larger) values are favored.
Metries
Methods
FL4R01
FLAR02
FLAROS
FLERO4
FLARDS
FLAK01
FL4R02
FLAK03
FLAR04
FLER05
Defenze Method
MID
BIDO
Accuracy
86.69
97.85
97.97
98.59
98.54
95.79
96,20
97.47
97.93
96.51
KED-MI
5K 159199
62.223385
64.6016.99
71.57=10.33
67.8824.06
43.1247.23
46.6720000
49.76688777
61.0115.01
5000g0000
Attack Apc
KED-MI-HSIC
59.6746.11
64.9347.22
65,5748.69
74.0368.47
73.25+13.19
45.4548.33
85
56.32x8
66.85x3.64
14.11+9.5
KED-MI
100,00.0.00
100.0000:00
100.00.0.00
100.00:0.00
100.00.0.00
100.0010.00
100.00.0.00
Avc5
KED-MI-HSSC
100.0000
000.0000:00000000000000000000000
100.00+0.00
100.00+0.00
100.00+0.00
100.00:0
KED MI
205.2746
190,9697
184,2229
173,4399
172.9889
256.3345
237.0378
233.1300
220.3506
196.9305
FID
KED-MI-HSIC
200.1239 187,4048 179.6035
165.1414
166.0872
235.8799
235 8799
213,6232 200.4665 179.0025
We also evaluate the FedInverse performance of VMI in Ta with ResNet-34. The highest attack accuracy of VMI appears in FL training round 10 36. 70 and the highest top-5 attack accuracy appears in FL training round 9 is 63.30. The VMI-HSIC further improves the attack performance by 3% and the top-5 attack accuracy by 0.7%, which are 37.95 and 63.80, respectively, with smaller FID (0.8942 vs 0.891). The results validate the promised privacy leakage by VMI attacks.
Table 11: FL privacy leakage indicated by Attack Acc/Acc5tstandaat deviation (%) and FID on CelebA via FedInverse using GMI and GMI-HSIC. Bold values denote the best metric results ob- tained by GMI or GMI-HSIC throughout the FL training epoch. The symbol l(t) denotes that smaller (larger) values are favored.
Metrics
Methods
FLAR01
FLAR02
FLAR03
FLER04
FLAROS
FLAR06
FL#RO7
FLAROS
FLAR099
FL#R10
Accuracy 1
66.05
80.48
81.11
81.64
81.68
81.84
X2.41
82.44
82.74
82.54
GMI
8.5043.26
9,8064.000
ON
10,07=3.11
10.3744
10.1043.6
10.174387
10.53+3.00
10.943322
11.3364.7
10.20+3.62
Attack Acc
GMI-HSIC 9,4343.78
10.5363.35
10.61=3.66
10.8343.55
58
11.0043.91
11.5754.06
11.1343.98
11.7344.17
11.9344.33
10.97:4.91
GMI
22.07144.62
23.8045.24
23.80.5.63
23.9346.03
24.0745.73
24.20a5.42
24.4714.99
24.8346.57
25.4047.35
25.20
Attack Acc5
GMI-HSIC 22. 22.7455.4 24.9345.47
35.00=5.60
25.0345
25.2345.18
25.63=5.68
25.6345.03
25.5746
26.77+5.84 25.90=6.54
108.2603
108.5283
107.6128
108.7106
107.0249
106.814
103,0706
97.1281
104.7775
FID
GMI-HSIC 106.3502
104,8022
105.0613
106.6671
104.0582
101.0956
96.9064
102.5457
19

---

Published as a conference paper at ICLR 2024
FL privacy leakage indicated by Attack Acc/AccStstandard deviation(%) and FID on CelebA via FedInverse using KED-MI and KED-MI-HSIC. Bold values denote the best metric re- sults obtained by KED-MI denotes that smaller (larger) values are favored.
Table 12:
throughout the FL training epoch. The symbol J(T)
Metries
Methods
FL4R01
FL4ROZ
FLAR03
FLAR04
FLAROS
FLAR06
FL#RO7
FL4ROS
FLAR09
FLARI0
Ascuracy
66.05
80.48
81,11
81.64
81,68
81.84
82.41
82.44
82.74
82.54
KED-MI
39.53=187
$3,472291
55.60+2..4
56.9343.19
56.8064,54
54.6733400
16.002297
53.13-3.33
57.801s4004
56.73-2.62
Attack Ace
KED-MI-HSIC
41.73e1.76 57.80e3.07
55.0774.31
59.3943.45
57.47+2.42
57.07+3.88
59, 13..99
58.73=2.77
60.1333.53
59,47=3.30
KED-MI
67.67=2.90
80.0742.32
81.40s2.93
83.7342.38
82.07+2.75
81.73+2.66
82.53a3.27
81.60s2.17
85.47=2.39
82.73=2.02
Attack Acc5
KED-MI-HSIC
67.53-2.07 80.39+3.26
82. 13-2782.74
13.13+2.88
81 11.8022,11 18
83.47+2.00
83 #3.40+2.49
82.87-2.17
N5.80)22.27
84.73-0.97
KED-MI
241.0025
243.3093
235.3072
249.9985
247.8074
247.2511
227.6555
241 8614
244.159
248.9721
FID
KED MI-HIIC
232.7846
242.5915
232.5486
245.5304
241.8464
241.6832
225,5088
238.4409
239.4701
248.7714
Table 13: FL privacy leakage indicated by Attack Acc/Acc5tstandant deviation %) and FID CelebA via FedInverse using VMI and VMI-HSIC. Bold values denote the best metric results ob- tained by VMI or VMI-HSIC throughout the FL training epoch. The symbol l(t) denotes that smaller (larger) values are favored.
Metries
Methods
FLARD1
FLPR02
FLAR003
FLARD4
FLOROS
FLAR066
FLARO7
FLERUS
FLAR09
FLARI0
Accuney
38.17
47.78
49.03
59.33
5835
39.55
65.54
65.5
65.24
66.16
VMI
1685214.6 4,80
27 27.29
25.75a17.66
29.05116.8 85
31.00=20.62
18.1882081
33.10621.21
36.45=21.25
36.6512083
36.70:20.31
Atteck Auc
VMI-HSIC 19008818.51
27.65178006
25.75818422
29.75616.85
31,05=21.40
32 32.61420225
33.0821.3 22
37,
27.20420.44
37.11821.08
37.95420.35
VMI
23.20+23.8 48.9 48.05-27.1 10
46.00+27.71
50,70422.51 51
54.00+28.0 94.
55 55.35+26.11 17
58.75+25.61
62.75=23.26
63.30:21.55
63 63.30022.80
Attack Acc5
VMI-ISIC 38.75123.97
30.20u26.89
45.65128.84
53.30622.56
$1.75a28.35
56 36.45126.85
61.70123.51
63 10.23823778
63,80221.75
63.75123.58
VMI
1.0615
0.963
0.9677
0.9466
0.9377
0.9508
0.9669
0.8989
0.8957
0.8942
20

---

Published as a conference paper at ICLR 2024
Table 14: FL privacy leakage indicated by Attack Acc/AccStstandard deviation(%) and FID on CelebA via FedInverse using GMI and GMI-HSIC with varying active fractions of participants. Bold values denote the best metric results obtained by GMI GMI- throughout the FL training epoch. The symbol ((1) denotes that smaller (larger) values are favored.
Metries
Methods
FLAR01
FLAR02
FLER03
FLARO
FLAROS
FLER06
FL,R077
FLAROS
FLER09
FLARIO
Fraction of participants
C 0.4
Accuracy
67.65
80.35
81.68
$2.08
82:44
82.41
82,67
82.91
83.11
$2.51
GMI
10.6744.12
17.175387
10,3343,4 40
12,6744.90
33.338886
9.00=4.68
10,5043/78
12.3863,32
8.8364.8
13,00:3.87
Attack Ace 1
GMI-HISIC
12.00
12.83a5.35
12.1724.64
12.00u2.65
12.83a6.57 11.8343.06
11.0043.91
11.6744.61
12.00a:1.80
12.83x4.18
GMI
25.83e6.03
33
25.83=7.200
23.00+8.61 61 25 25.33e4.72
23.17=3.84
24.17+7.25
25.67+7.17
23.67=7.70
27.1756.64
Allack Acc5
GMI-HSIC
25.00e...60 60
26. 26.0026.01
25.5026.77
73
98 27 8326.36666
25.90026.5 54 26, 26.5024.27
27
29.00k88445
29.33a8.88
26.85+7.03
GMI
157,5960
187.9938
148.8573
154.4189
155.4286
150.9164
150.3699
146,8032
141.5987
144.3315
L
GMI-HSIC
152,7228
149.6889
147.5066
147.9429
147.9600
147.2307
144.5968
146,9599
135.7852
141.4002
Fraction of participants
0.6
Accuracy
69.28
80.68
81.38
81.51
82.01
82.18
82.21
82.44
82.61
82.71
GMI
9.501-4446
9.83+4.02
11.5024.44
8.3345.26
10.33:4.46
7.83:3.06
10.5015.19
11.3364611
11.6724.98 13.0015.65
Allack
GMI-HSIC
10.17+4.47
10.67=5.17
10.50+3.25
11.6743.98
11 11.17+4.51
12.17=5.37
12.6747:07
13.00+6.07
14.33e4.77
13.67+4.66
21,83+7.01
21 21.50=6.67
21.67=6.23
24.50+8.16
16 24.00+6.26
26.81=7.91
26.50+6.51
27 27.00+5.26
27.33=5.18
26.50+5.99
Attack Acc5
GMI-HSIC
25.331:4.92
26.33:9.00
27.33s8.07
27.5016.00
37.6724.95
27.67
28.3315.46
17:1077
29.00s5.04
17.11766.8
GMI
151,0542
152.
152.2443
150.9182
149.3314
150.4244
147.8318
142.7556
140.6171
143.4548
HDD L
GMI-HSIC
149.0826
146.6641
144.3291
141,4766
143.3411
142,9232
143.2222
141.6792
134.0685
139,9209
Fraction of participants
Accuracy
66.05
80.48
81.11
81.64
81668
81.84
82.41
82.44
82.74
82.54
GMI
8.50+3.26
9.8084.08
10.07=3.91
10.3744.10
10. 10.1963.9
10.17=3.87
10.5343.90
10.9343.82
11.3344.7 10.70+3.62
Atlack Ace 1
GMI-HSIC
9.43+3.78
10.53e3.35
10.63:3.66
10.83+3.58 58 11 11:00:391 11,57a4.06
11,1343.98
11,7364.17
11.93a4.33 10,9744991
GMI
22.0774.66
23. 80+8.24
23.80+5.63
23.9346603 24.07=5.73 24, 24.20=5.42
24.47+4.99
24.8346.57
25.40=7.35
25,20
Attack Acc5
GMI-HSIC
24.9325:47
25.0015.66 60 25.03 26 25 23.23355.1
25.63:5.68
25.6345.03
25.57726118
26.77a5.84
25.9006.55 54
GMI
108.2603
108.5283
107.6128
108.7106
107.0249
106.814
104.0733
103.0706
97.1281
104.7775
HID
GMI-HSIC
106.3502
104.8022
105.0613
106,8688
106.0671
104.0582
104.044
101.0956
96,9064
102,5457
A. IMPACT OF PARALLELISM ON FEDINVERSE+ ON CELEBA
We investigate the influence of FL parallelism by modulating the active fraction of participants on the attack performance of GMI within the context of FL. Pertinent observations are detailed in Table
14 The results show similar trends as MNIST parallelism experiments. The number of participants does not greatly impact the attack performance, whereas GMI has a similar attack accuracy of 13.00 when 40% and 60% of the participants join the FL training round. The results also show that GMI-
HSIC has less impact on the attack performance, where the highest attack accuracy is 14.33 when 60% of the participants join the FL training round, and the lowest attack accuracy is 11.93 when 100% of the participants join the FL training round. Comparing top-5 attack accuracy between the number of training participants, the highest GMI top-5 attack accuracy is 27.33 when 60% of the participants join the FL training round, and the lowest top-5 attack accuracy of GMI is 25.40. Same GMI-HSIC, the highest top-5 attack accuracy is 29.33, and lowest top-5 attack accuracy is 26.77.
A.11 IMPACT OF PARALLELISM ON FEDINVERSE+ KED-MI ON CELEBA
Table 15 shows that KED-MI and KED-MI-HSIC achieved better attack performance than GMI and GMI-HSIC. The number of participants does not greatly impact the attack performance as well. The highest attack accuracy of KED-MI is 61.93 when 40% of participants join the FL training round, and the lowest attack accuracy is 57.80 when 100% of participants join the FL training round. KED- MI-HSIC reaches the highest attack accuracy of 64.80 at 40% of participants and the lowest attack accuracy of 60.13 at 100% of of participants. For top-5 attack accuracy. both KED-MI and KED- MI-HSIC have similar patterns. The highest top-5 attack accuracy appears participant 10%,
21

---

Published as a conference paper at ICLR 2024
FL privacy leakage indicated by Attack Acc/Acc5tstandard deviation(%) and FID on CelebA via FedInverse using KED-MI and KED-MI-HSIC with varying active fractions of partici- pants, Bold values denote the best metric results obtained by KED-MI KED-MI-HSIC throughout the FL training epoch. The symbol L(t) denotes that smaller (larger) values are favored.
Table 15:
Metrics
Methods
FLORO1
FLORO2
FLAR03
FLAR04
FLARO5
FLAR06
FLAR07
FLVROS
FLAR09
FLARIO
Fraction participants
Accuracy
80.35
81.68
82.44
82.41
82.91
83.11
KED-MI
42.13
53.5343.59
54.60&3.70
55.2724.89
56.53a3.94
58.8744.96
61.9355.26
54.00
58.7343.34
61.0723.68
Attack Acc T
KED-ML-SSIC 45.07=3.88 59.5344.22
55,73+3.72
58.13=3.66
60.1344.33
59.3364.33
64.80s44112
55,80+3.57
57,53+2.72 07.0722334
KED-MI
71.67:2.90 81.7343.38
80.3312..0
81.53:3.46
83.2012.82
82.53x3.31
87.7353.20
81.07:2.94
83.40:2-48
Attack Acc5
KED MED-MI-RSIC 73,4043.67 83.4743.999
81.73x2.57
82.7362.86
83.5342.73
85,20&3.06
88.7362.55
82.2043.35
82.13 85.4012.85
KED-MI
236.8327
241.7872
229.6966
232.1761
226.5052
232.3101
247.5734
227.7192
225.6284
232.9999
FID L
KED-MI-HSIC
228.8435
227.7244
250.3745
241.7729
242.425
233,486
224.7654
221.1877
222.9146
221.6223
Fraction of porticipants
C 0.6
Accunecy
69.28
80.68
$1.38
81,51
82.01
82,18
82.24
82.44
82.64
82.71
KED MI
49.47a4.53
57.60s4.81
53.4764.24
39.1393.39 58.3345.02 02 56.80a3.56 56 56.67a4.47
55.47a4.47
56.5364.06 59.73a3.16
Attack Acc 1
KHD-MI-HSIC
50.60+3.95 58.6743.71
36.40+3.73
59. 19.13-4.82
89.20+4 89 600.40+4.93
60.33e5.1 18 56,53+3.09
56.40+3.24 58.47+3.97
KED-MI
77.6722.35 82.0012.78 78 79.0713.25
33.33
83.3312.95
84.27133611
84.4022.60
82.2712.56
80,8712.20 20 84.7323.70
Attack Acc5
KED-MI-HSIC 78.4043.08
83.3342.50
82. 82.40+2.777
82 82.20=2.51
82.53.2.54
83.8743.51
84.6023.50
83.1222.78
82.00+2.32 32 82.7363.34
KED MI
255.9901
237.3064
238.6159
239.4178
254.6535
251,7509
210.175
243.6961
210.3951
234.203
FID L
KED-MI-HSIC
229.8925
231.906
239.4226
249.6141
245.5274
230.4824
240.9596
235.8868
226.1562
227.872
Praction of participants
C
Accumay
80.48
81.11
81.68
81.84
82.44
82.74
KED 39.53a1.87 53.4742.91
55.60&2.64
56.93=3.19
56.80s4.54
54.6743.40 56.60=2.97
53.1343.33
57,80+44.04 56.73+2.62
Attack Acc 1
KED MI-HSIC
41.73a1.76 57,80s3.07
55.0714.31
59.3313.45
57,47a2.42
57.07 59. 39.1313
55.73a2.87
60.13 59.4713.30
KED-MI
67.67a2.90 80.07.2.32
81.4012.93
83.7322.38
82.07.2.75
81.7312.66
82.5313.27
81.6012.17
85.47.2.39 82.7312.02
Attack Acc5
KED-MI-HSIC
67,53+2.07 80.3343.26
82. 1322.74
83.13
81.80+2.18 18 83.47+2.00
83.40=2.49
82.87=2.17
85.80+2.27 84.7360.97
KED-MI
241.0025
243.3093
235.3072
249.9985
247.8074
247.2511
227.6555
241.8614
244.139
248.9721
FID 1
KED-MI-HSIC
232,7846 242.5915
232,5186
245.5304
2418464
241.6832
225.5088
238.4-109
239,4701
248.7714
which are 87.73 and 88. 73, respectively. The lowest top-5 attack accuracy appears at participant 60%, which are 84.73 and 84.60, respectively.
A.12 IMPACT OF LOCAL COMPUTATION ON FEDINVERSE++MI ON CALERA
The relevant experimental results are summarized in Table 16 We adjusted the local computation hyperparameters E and B and observed that the local computation on each client has less impact on FedInverse using GMI and GMI-HSIC. The highest GMI attack accuracy is 12.67 when we set E 30 and B- 128. The attack accuracy on the rest of the settings varies from 10.50 to 12.17. For the GMI-HSIC the highest attack accuracy appears E 50 and B = 32, which is 13.17. Others vary from 1 11.50 to 17. The top-5 attack accuracy varies from 24.00 to 27.80 and 24.67 to 30.00 for GMI and GMI-HSIC, respectivll.
A.13 IMPACT OF LOCAL COMPUTATION ON FEDINVERSE+KED-MN ON CELEBA
The relevant experimental results are summarized in Table 17 KED-MI and KED-MI-HSIC per- formed better than GMI and GMI-HSIC on CelebA. The highest KED-MI attack accuracy is 66.60 when we set E = 50 and B- = 32. The attack accuracy on the rest of the settings varies from 57.80 to 61.40. For the KED-MI-HSI the highest attack accuracy appears E = 30 and B 128, which
is 82.80. Others vary from 60.13 to 66.67. The top-5 attack accuracy varies from 84.27 to 88.40 and 84.87 to 89.27 for KED-MI and KED-MI-HSIC, respectively.
22

---

Published as a conference paper at ICLR 2024
Table 16: FL privacy leakage indicated by Attack Acc/AccStstandard deviation(%) and FID on CelebA via FedInverse using GMI and GMI-HSIC with varying denote the best metric results obtained by GMI or GMI-HSIC throughout the FL training epoch. The symbol l(T) denotes that smaller (larger) values are favored.
local computation. Bold values
Metries
Methods
FLARO1
FL4RO2
FL#R03
FLAR04
FLAR05
FLAR06
FLAR07
FLAROS
FLER09
FLAR10
Local Computation
(EE
(30, 322)
Accuracy
67.25
81.15
81.44
81,68
82.38
82.51
82.67
82.57
82.67
82.74
GMI
8,0033688
8.8322.55
888343.43
9,6743.88 8.80
9.8364.52
9,33e3.98 98 9,833301
11 336555552
11.83a4.79
10.1743.29
Atlack Ace
GMI HSIC
9.83
10.00
10.3343.84
10.8345.39
11.3323.99
11.1743.98
11.50.4.11
12.00u2.85
12.17a4.91
11.3345.30
GMI
22 22.3964
22.00=6.71
71
24.33+8.04
23. 17:5545.54
22 17s4.81
21.1
774.62
23,50+4.8 84 23 33.00e5.69 69
36.3366.26
27.83+7.42
Allack Ace5 1
GMI-HSIC
24.67s4.66 66 25. 5026.83
26.83+4.92 92 24. 24.1766.55 58 24.8 24.8384.66 69 27.0049
11
24.35+5.70
70 24 24.00166.66 66 26.83:66.8
66
27.5016.55
GMI
150,3791
181.9222
148.9057
153.0103
155.1253
154.3783
148.0305
149.3648
140.6815
139,4663
GMI-HSIC
142,8629
148.9581
144.2583
149.5401
147.4151
150.0513
151.2198
148.6511
135.5822
126.5875
Local Computation
(E. (3)
(30, G4)
Accuracy 1
66.05
80:48
81.11
81.64
81.68
81.84
$2,41
82.44
82.74
82.54
GMI
8.5013.26
9.8024.08
10.0713.91
10.3714.10
10.10:3.96
10.17:3.87 10,5343.90
10.9343.82
11.33s4.67
10.7013 62
Allack Acc
GMI-HSIC
9.43+3.78
10.53+3.35
10.63+3 66
10,8343.58
11.00=3.91
11:57=406
11.1343.98
11.7364.17
17 11.93e4.33
10.9744.91
22.0764.66 23.80-5.24
23,804563
23.93+6.03
24.07=5.73
24.20+5.42
24.4764.99
24.6576
25.40=77335
25,20+5.
Attack Acc5
GMI-HSIC
22.70 24.93:5:47
25.0015.60 60 25.0315.26
25.23:5.18
25.6315.68
25.6315.03
25.57166.1
26.77a5.84 25 25.9016.54
108.2603
108.5283
107.6128
108.7106
107.0249
106.814
104.0733
103,0706
97.1281
104.7775
FID
GMI-HSIC
106.3502
104.8022
105.0613
106.8688
106.6671
104.0582
104,404
101.0956
96.9064
102.5457
Local Computation
B)
128)
Accuracy
68.21
81.11
82.01
82.24
82.61
82.54
82.67
82.81
82.91
82.94
GMI
8.83+3.99
8.1755.15
6.17+3.82
8.6742.70
12.67s4822
9.83a4.37
17.1743.84
9.5064.72
9.83=5.05
10.5045.22
Allack Acc
GMI-HSIC
10,50664499
10.83=5.77
12,83
10:3564.46 12:67e4.58
12.67=3.58
12,6754.84 84 13.8644.53
9.67=3.08
11,83+3999
GMI
21.67+5.74
22.67=7.03
21.33+7.34
34
23.50+6.08
25, 25.1776.77
24.1
34.1748.57
24.50H6.47
27 50+7.36 16
27.67=6.99
24.6774.55
Attack Acc5 1
GMI-HSIC
25. 5016 80 25.3316.65
65
25.83366
48
25.3315.55
26.3324499
93
20
26.8315.25
28 28. 1718.77
30.00:26.27
27.6716.94
GMI
157.4958
155.0116
151.5519
149.7776
149.2006
147.1125
147.2644
148.8404
138.1305
143.8590
FDD
GMI-HSIC
148.6452
147.9373
1460020
145.2726
144.5028
143.5818
141.7064
142,0568
135.0851
138.9605
Local Computation
(E, B)
(GD, 32)
Accuracy 1
68.05
82.08
82.51
82.81
83.44
83.64
83.74
83.97
83.97
84.17
GMI
10.50+4.00 08
10.50e4.78
10.5044.94
94
10.33+4.30
10.83e3.12
11.00=5.46 11,3343.66
12.1764.29
11,50+5.22
12,00+4.03
Allack Acc
GMI-HSIC
10,50:5.58
10.83:5.68
68
11.33+4.57
12.6714.45
11.1764.27
12.50:5.17
12.8345.21
13.1754.36
12.0024..50
2,0013.62
GMI
24.83+5.20
20
22.83=7.10
83.7212
25.0064.44
24:00-66.9
22.83+6.22
23.6764.55
26.67+5.64
64
27.67=8.17 24.3346
Attack Acc5
GMI-HSIC
25.6747.35
26. 26.17.5.08
25. 25.1777.86
25. 1747.99
24.83=7.30
26. 36.1745.32
27.5048
28.33+7.47
26.50=5.78
27.8346.76
155.4550
152.0929
148.4526
144.9996
149.4272
151.4114
140.2202
144,2916
139.5381
147.8779
HID
GMI-HSIC
146.01044
143.0022
146.3147
151,5006
146.7224
143.4877
143.0034
153.7981
145.4033
135.2016
Local Computation
(JE,
(G0, 64)
Accuracy 1
80.11
80/75
81.58
81.54
82.08
82.14
82.48
GMI
6.834.14
10.17e4.59
8.33+3.56
9,0042.76
10.17H2.48
10,5046.10 10 9,1744.17
1L1764.85
9.17-4.65
9,8343.74
Attack Acc
GMI-HSIC
9.8313.82
10.83:3.19
9.6712.97
9,8313.92
10.6724.11
11.3315.15
10.8343.94
11.6753.89
10.00:2.66
6666
10.0013.05
GMI
20.50s6.23
22.83=5.11
21.00s4.48
22.8346.19
25.50+5.34
23.50&7.69
25.3384.64
25.33344.13
23.50=7.55
21,8346.55
Attack Acc5
GMI-HSIC
22 33+5777
24.33=6.69
33.33
24.33+5.91
23.8364.52
33.00+5.95
24.33+5.24
24 24.33+5.15
26.000:7.36
24.6746.64
GMI
161.0902
158.4809
159.8758
149.9713
154.8924
154.7554
157.3184
142,5553
145.9331
154.8426
FID
GMI-HSIC
154,5773
154.9725
131.9411
156.5869
151,3188
146,3411
150.6333
149.2364
144.2459
143.9670
Locat Computation
(E, (3)
128)
128)
Accuracy 1
68.21
79.42
80.35
80.71
81.21
81.48
81,44
81.54
81.78
81.94
GMI
8.5043.30
8.1 17433.1
9.1745.62
7,8344 36
9.00+2,78
8.8344.99
10.1745.05
9:3343.90
8.33=4.34 34
10.5054.76
Attack Acc
GMI-HSIC
10.5014444
10.8323.65
9,1743.86
9.6713.67
9.5024.60
10.8316.02
11.1715.58
11.5014.82
10.8324.78
11.1713.63
GMI
20.83:4.34
20.33e5.49
22.83+7.005
21.8343.33
22.3368.31
22.6746.03
24.1747.43
22.3348.93
24.00=7.17
23.5084.48
Attack Ace5
GMI-HSIC
22.8345.53
22.67=8.51
22.8345.15
22,8346640
24.33+7.90
23.33+7.03
24.0066.90
24.3366.75
24.67=4.86
24.3344.20
155,7808
157.3235
156.1449
153.3072
153.2049
150.1078
140.1049
147.2408
150.4086
144.1966
FID
GMI-HSIC
150.0434
146.9458
149.4768
148.7402
148.6756
148.4312
147.1038
146.8517
145.7551
135.8389
23

---

Published as a conference paper at ICLR 2024
Table 17: FL privacy leakage indicated by Attack Acc/Acc5tstandard deviation(%) and FID on CelebA via FedInverse using KED-MI and KED-MI-HSIC with varying local computation. Bold values denote the best metric results obtained by GMI or GMI-HSIC throughout the FL training epoch. The symbol J(1) denotes that smaller (larger) values are favored.
Metrics
Methods
FL4RO1
FLOR02
FLAR03
FLAR04
FLARO5
FLAR06
FLAR07
FLAROS
FLAR09
FLARIO
Local Computation
(E. (30, 32)
Accuracy
81.15
81.44
82.38
82.51
82.57
82.67
KED-MI
35.4043.31
56.40+4.23
58.00&4.41
57.47.4.91
56.1333.08 59.00u5.79 54.4765.76
55,20a4.62
60.2743.66
61.40:3.22
Attack Acc T
KED-ML-SIIC
57,00+2.56 $3.7345.20
56.076.36
56, 56.33-5.27
58.2744.64
64 59.7343.11
11 55.2764,46
46
56.67=2.64
58.8744.4 61,0754.43
KED-MI
64.07:3.92 81,5343.35
82.07:3.75
82.07:3.79
81.2774.17
83.47433.00
82.87:3.29
82.33:3.78
84,20:3.12
84.27:2.53
Attack Acc5
KED MED-MI-ESIC 66.1343.10 81.0743.76
80.93&3.18
82.6043.18
82.6043.18
63,2742.90
82.9362.22
82.6724.50
84,20a2.52 84,8722.33
KED-MI
250.8308
237.7906
239.5953
225.7612
231.51
247.7834
219.4812
236.7981
230,0569
232.8372
FID L
KED
242.823
235.9567
232.2535
220.7007
233.6536
244.4438
214,8885
233:2556
223,4137
230.3397
Local Computation
(F, B3 (30, 64)
Accunecy
66.05
80.48
81.11
81.64
81.68
81.84
82.41
82.44
82.74
82.54
KED MI
39.53&1.87 53,4742.91
55.60&2.64 56.93a3.19 56.80a4.54
54.6743.40 56.60a2.97
53,1323.33 57.80 56.73a2.62
Attack Acc 1
KHDD-M-HSIC
41.73+1.76 76 57,003.07 55.0764.31 31 59.33-3.45 57.47+2.42
52.07+3.88
59. 18+3.95
55,73+2.77 60.13+3.53 59.47+3.30
KED-MI
67.6722.90
80.0712.34 32 81. $1.4022,93 93 83.73 82.0712.75
73122.66666
82.5313.27
81.6022. 17 85.47722.99 82.73:2.02
Attack Acc5
KED-MI-HSIC 67.53a2.07 80.3343.26
82. 13+2.74 83 83.13:2.88
81.80a2.18 18 83.4742.00
83.40:2.49
82.87=2.17
85.8012.27
84.7350.97
KED-MI
241.0025
243,3093
235.3072
249.9985
247.8074
247.2511
227.6555
241.8614
244.159
248.9721
FID L
KED-MI-HSIC
232.7846
242.5915
232.5486
245.5304
241.8466
241.6832
225.5088
238.4409
239.4701
248.7714
Local Computation
(E,, B) = (30, 128)
Accumcy
81.11
82.01
82.24
82.61
82.54
82.67
82.81
82.91
KED
40. 40.1364.23 59.00+4.31
51.7325.32
54.33a4.31
55.1344444
74.7344475
58.00=3.32
60.00s5.155
58.4044.58 59 39.8013.21
Attack Acc 1
KED HI-ICCC
44.0013.16 1344005
57.53b44337
56.7333.81
57.73a2.90
38.47.3.30
58.2013.47
82.80
13a1 59.7333.74
KED-MI
67.1713.89 83.9332.73
77.201-4448
82.0013393
84.5313.54
84.2711.43
81.3313.64
84.87a2.12
83.7313.85
80.413445
Attack Acc5
KED-MI-HSIC
70.4763.34 83.3342.90
83.87+3.78
83.67=5.08
84.13+2.52
62.8743.69
84.07a2.07
85.40::4.08
83.6743.12 84.4763.03
KED-MI
250.4548
247.27
233.0923
257.5443
239.2134
236.8182
244.7302
226.5913
239.1755
234.661
FID 1
KED-MI-HSIC
250.0051
231.995
242,9628
248.1224
235.5339
227.7765
233.6334
233.3821
239,8843
225,5299
Local Computation
(E, B)
(50, 32)
Aocumey
68.05
82,08
82,51
82.81
83.44
83.64
83.74
83.97
83.97
84.17
KED-MI
40 40.8023.80 80 57,7343.51
55. 20.5.83
61. 63.0334
58 38.6013.47
56.40144 99 60.53:3.67
60:4743.50
62,00
66.60122994
Attack Acc 1
KED MI HSIC 42. 42.8044.90 57.6743.42
57.53e5.26 26 62, 62.73 58.9342.52
59.53a3.24
24 64.67a4.09
62.87a4.11
62.80u3.75 75 66.6725.43
KED-MI
68.6013.45
82.6742.97
80.93.11412
12.27 82,3343.64
82.0743.85
81.2712.63
$4.0023.11
85.3333.14 14 88.4012.73
Attack Acc5
KED-MI-HSIC
69.53+3.34 82.6743.10 10 84, 13+3.46
85.93=3.83
85.4743.11
83.4742.16
87.33=1.73
86.07=2.34
86.00+2 89 89.2753.01
KED-MI
23300825
237.9213
219.7000
251.326
245.0408
235.0954
234,5587
216.0964
220.189
209.7383
FID 1
KED-MI-HSIC
228.1920
234.2204
221.8825
228.2933
242.7171
230.3700
226.0333
215.3089
220.931
210.3917
Local Computation
(E, B) (50, 64)
Accuracy T
67.58
80.11
80.75
81.05
81.58
81.54
81.1
82.08
82.14
82.48
KED-MI
39.9312.87
51.9344.53
53.931-4.93
55.8723.39 51.0013.28
54.7311155
55.4723-19
58.40:3.47
57.9313.48 57, 37.299
Attack Acc 1
KED HSIC
43.33+3.07
54.5343.69
52.60:3391
57 8..4.444 53.7344104
13.5.11.13
60.00=3.60
60.3364.76 59 39.80=5.00
KED MI
66.53a2.26
78.5343.30
79.6013.48
82.0772.81
79.60a3.12
12 81.6742.85
80.2013.81
84.33a3.10
82.53a2.41 83.0713.36
Attack Acc5
KED-MI-HSIC 69.7313.76
80.6011.22
79.4712265
82 82.6012.77
80.2714.05
83,53113.04
82.2013.68
83.73=2.01
84.97:2.48
83.5312.557
KED-MI
230.4009
231
261.1751
241.4455
228.279
233.7109
235.3763
245.8801
214.8504
246.8346
FID 1
KED KED-MI-HSIC
231.0736
228.223
258.8327
239.9759
221.3416
231,2333
230.7373
236.4309
211.564
242.5012
Local Compulation
(E. B)
(50, 128)
Accuracy
68.21
79.42
80.35
80.71
81.21
81.48
B1.44
81.54
81.78
81.94
KED-MI
43.0013.09 09 53.6013.417
53.7313.93
54,0013.10
56.6013.85 59.6014.30
56.5313.86
57.8743.74
56.001-1.97 56.9314.02
Attack Acc f
KED-MI-HSIC
42.20s4.02
53.67+4.72
55.00e3.78
58.07=4.97
56.20s3.22 22 61.20e44.35 58.27=3.34
58.67=2..9
57.8044.222 25 57. 57.00=3.54
KED-MI
69.67+3.8 79.6022.68
31.6763.59 81 31.00733.99
81,33+4,34 34 83.0044.27 82.73+2.51
85. 13.2..2
82.0743362 62 X1 60-3.3
Attack Acc5
KED-MI HSIH
71.80 71.8922.99
79.8013.15
83.5313345
84.0013.05
82.7342.74 74 85.2743.68
83.5312.55
84..102.330
83.6012.. 90 82.3313.19
KED-MI
251.7551
245.1883
240.308
245.6284
244.8232
226.9266
236,3251
229.9813
238.5785
244,5951
FID 1
KED KED-MI-HSIC
241.6745
243.0175
233.0712
244.5804
237.807
222.5282
233.1085
227.386
231.779
238.2023
24

---

Published as a conference paper at ICLR 2024
A. IMPACT OF DEFENSE METHODS ON FEDINVERSE+GMI ON CELEBA
We used two latest prevailing defense methods, MID and BiDO, to train the FL models. Meanwhile, we launch the GMI attacks on the updated global models in each federated communication round to see if these defense training schemes can still work in FL settings. The relevant observations are summarized in Table 18 The FedInverse with GMI and GMI-HSIC attacked the FL with MID on the third training round and reached attack accuracy of 35.67 and 38.67, respectively. Similar to MID settings, GMI and GMI-HSIC attacked the FL with BiDO on the third training round and reached attack accuracy of 34.33 and 36.83, respectively. For top-5 attack accuracy, GMI reached 56,00 in round 3, and GMI-HSIC reached 56, 36.83 in round 3 with MID. Additionally, GMI reached 56.83 in round 3, and GMI-HSIC reached 59.00 in round 3 with BiDO. The attack performance decreased dramatically, which shows that the SOTA MI defense approaches can partially defend against FedInverse+ attacks on FL. settings on CelebA dataset. According to the results from MNIST; the experiments show that the SOTA MI defense approaches are data and model-oriented to defend against Fe attacks.
Table 18: FL privacy leakage indicated by Attack Acc/Acc5# standard deviation(%) and FID on CelebA via FedInverse using GMI and GMI-HSIC with two diverse defense methods: MID and BiDO. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the FL. training epoch. The symbol f(t) denotes that smaller (larger) values are favored.
Metries
Methods
FLERO1
FLAR02
FLAR03
FL4R04
FLAROS
FL4R06
FLAR07
FL4ROS
FLAR09
FLARIO
Defouse Method
MID
Accuracy
0.13
0.09
62.1
$2.38
84.77
84.77
85.2
85.8
85.6
86.13
GMI
0.0000:00 3.6763.41
35.6767.01
15.3314.3 39 7.67.3.01
7.332.81
8.3314988
6.1764366
6.3365.21
7.0022.17
Altack Ape
GMI-H5IC
0.330046 5.8333811
38.6758.50
15, 7-44 38 10.67
8.83-4555
55
9.6743.63
7.50+3888
8.00+3.34 8.00+4.11
GMI
0.17.0.37 14.0014.37 56.00
17.. 20.00.0...55144
77.836673 16.8316.52 19.00
Attuck Acc5
GMI-HSIC
1500003 15.00544.9 56.8166.885663
20.6754
GMI
262.1850
304.7803
144,9108
151.2462
169,7602
175.6377
170.8262
179.5037
178.1989
183.8218
FID
GMI HISIC
239.9734
300.0943
140.8861
147.7921
155.8281
163.6006
171.9034
173.3850
177.6978
181.2256
Defonse Method
BIDO
Accuracy
0.09
56,88
83.87
84.90
85.03
85.53
85,50
86.00
86.07
85.97
GMI
0.33 1,33=0 75 34.3348.44 8,50+5.79
5.50e3.13 13 6,50+2.54
6.17:3.56
7.843.24
5.33300
5.50+2,70 70
5.0064
Antckk Ace 1
GMI-11SIC
03330-16636.83474777 9.6764.19
8.671:4000
8,5014.65
6.8322993
7.6733.95
8.1763.56
7,6763.26
7.6743.88
GMI
1.5000 56.5006..1122.3354440000
1683-5 09 19.67+6.71
19.33+5
19.00+5.62
18.67-4 19.1745.52 19.67-7.5
11810
55000.33 59.0005.544445555.. 222.2220011...222222222222
19.0015
10200.6711.9950666666. 21..5.663 19.17
GMI
A07,7120
154.6888
181,7940
200,6795
198.4003
195 2061
196,4883
199,7902
202.7657
206,0921
FID
GMI-F15IC
280,9487
154,2095
180.0081
196 7448
193,8378
187.7461
193,5657 198.5558 194,2287
195.0553
A.15 IMPACT OF DEFENSE METHODS ON FEDINVERSE+KED-MN ON CELEBA
We used two latest prevailing defense methods, MID and BiDO, to train the FL models. Meanwhile, launch the KED-MI attacks on the updated global models in each federated communication round to see if these defense training schemes can still work in FL settings. The relevant obser- vations are summarized in Table [9 The FedInverse with KED-MI and KED-MI-HSIC attacked the FL with MID on the third training round and reached attack accuracy of 0.40 and 0.47, re- spectively. Similar to MID settings, KED-MI and KED-MI-HSIC attacked the FL with BiDO on the third training round and reached attack accuracy of 0.13 and 0.53, respectively. For top-5 at- tack accuracy, KED-MI and KED-MI-HSIC both reached 1.07 in round with MID. Additionally, KED-MI reached 0.93 in round 2, and GMI-HSIC reached 2.07 in round I with BiDO. The attack performance decreased dramatically, which shows that the SOTA MI defense approaches can suc- cessfully defend against KedInverse+KED-M. attacks on FL settings on CelebA dataset. According to the results from MNIST; the experiments show that the SOTA MI defense approaches are data and model-oriented to defend against KEDD-MM attacks.
25

---

Published as a conference paper at ICLR 2024
Table 19: FL privacy leakage indicated by Attack Acc/Acc5+ standard deviation(%) and FID CelebA via FedInverse using KED-MI and KED-MI-HSIC with two diverse defense methods: MID and BiDO. Bold values denote the best metric results obtained by KED-MI KED-MI-HSIC throughout the FL training epoch. The symbol l(f) denotes that smaller (larger) values are fa- vored.
Metries
Methods
FLAR01
FLAR62 FLFR03
FLAR04
FLAROS
FLFR06 FLARO7
FLAROS FLER09 FLFRI0
Defense Metkod
MID
Accuracy
0.39
82.38
84.77
84.77
85.2
R5
KED-M MI
0.40 100.0.00000000000000000 0.1360.18 18 0,0060.000000000
00,
Attack Ace
KED-MI-HSIC
0 0.4000 0. 0.2000) 2.20000011111000000000 154777888 0.07H0 14 0.200H0035500000000 000.
00 33
KED-MI
L0070046 0.2000030000
73,0 74 1360
13..1.3000000... 290.7
180.0000.0.04444000000 6030 44
Alback Acc5
KED-MI-HSIC
1,0700.33 0...000..30.000 34400000....0.0.4441111111--1111 n.8-- 02 80000 04000.840000 07-00 1...0..0.0000000 (7..0004-4404..00 73000000.0...444
KED XI
1096,2796 584.8376
625 5133 494.0431
702.2928
641.6901
691.3997
748.0615
748.39M
563. 3676
MSIC
1014.4789 585,5836
604.0114
725.212
667.3054
608.4476
755.4100
735.7304 571.0013
Defense
Accuracy 1
83.87
R5.53
$5.50
KED-MI
0.00:0.00 01t.:000...110..000000000000
Attack Acc
KED
0.4060.62 0.5300640.000..8 18 0.1340.18 0.004000000020033033000000000000 http://0000.770110000001100000.0 000.3:0000.0000000000000000000.0 00400.114
KED-MI
0.53e0.69 0.9.3.0.7 0.550 42 020.00000000000000000 300.0002..............0000000000 0tt.://......00.0..0000000000000
Attack Acc5
KED BED-MI-1SSCC
2.0700.7 400.0.60073300 740.8060. 48, 0.6740.63 1.20 320.330..00 A4..0....0..3ddl 0707082
KFD-MI
419.2799
738.1138 1139
876
206
1001. .16
940.0064
594 5001
591.23
741 6033 624 6006 582 4685
FID
KED ME-IIIIISIC
415.9628 73049202 880.1697 858.9176 91667539 575.2857
465.46666 748.6841 596.2671 570,9718
Table 20: FL privacy leakage indicated by Attack Acc/AccStisanddar deviation(%) %) and FID on CIFARIO via FedInverse using GMI and GMI-HSIC. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the FI. training epoch. The symbol L(T) denotes that smaller (larger) values are favored.
Metrics
Methods
FLAR01
FLAR02
FL4R03
FLAR04
FLAR05
FLAR06
FLAR07
FL4ROS
FLAR09
FLARI0
Accuracy
69.16
76.36
$0.36
80.76
70.48
$4.44
82.39
$5.88
$6.60
86.60
GMI
10.00 14.00133301 13000 16.00.011... 16.00
16.0028.43 43 12.00 20.0011 14.00
Attack
GMI-HSIC 200.::11.....244400:2000000
18.00 20..6660.000066336
54.00413.55554.001133555555
19.32
56.00=8.43
Acc5
GMI 11L.1 111.11...566..113300000000
7.9437
7,8648
7.1638
FID
GMI-HSIC 7,8270
7,2996
7.2069
7,4807
7.0648
6.6097
6.1103
6.8338
6.8324 6.0622
A.16 FEDINVERSE+GMI ATTACK PERFORMANCE ON CIFAR-
To further evaluate the FedIverse performance, we tested the FedInverse+GGMi on CIFAR-10 Krizhevsky et al. (2009). The results of FedInverse attack using GMI and GMI-HSIC on CIFAR-10 illustrated in Table 20 The GMI achieved the highest attack accuracy in FL training round ten, which is 22.00, and GMI-HSIC further improved the attack accuracy to 30.00, which is an improve- ment of 36%. For top-5 attack accuracy, GMI reached the pick of 66.00 in FL training round eight, and GMI-HSIC is 72.00, which improves 9%.
A.17 FEDINVERSE- ATTACK PERFORMANCE ON CIFAR-10
Comparing to FedInverse+GMI, FedInverse+KED-M successfully attacked the FL settings. The performance evaluation of FedInverse using KED-MI attack on CIFARIO is presented in Ta- ble 21 The FedInverse+KEID-M attack accuracy achieved 51.92 in FL training round seven.
26

---

Published as a conference paper at ICLR 2024
Table 21: FL privacy leakage indicated by Attack Acc/AccStstandarr deviation(%) and FID CIFARIO via FedInverse using KED-MI and KED-MI-HSIC. Bold values denote the best metric results obtained by KED-MI KED-MI-HSIC throughout the FL training epoch. The symbol L(T) denotes that smaller (larger) values are favored.
Metrics
Methods
FL4R01
FL4R02
FLAR03
FL+R04
FLAROS
FL4R06
FLAR07
FLAROS
FLeR09
FLARI0
Accunay
69 16
76.36
$0.36
80.76
70.48
$4.44
82.39
85.88
86.60
86.60
KED MI
24.01a11 8.85 42.85214,
43.
44212.
12.
32.77a12
12.
98
48.53415.4
00 12.95 955115511111
$1.92:16.49
24.1128.27
35 35.28a12.85
21,5749.44
Anack Acc
KED-MI-HSIC 30. 10..66100.79 49.11.99999.....
49.13.
20+1
4014
13
KED-MI
81.8827.05 05 73.27=11
828446699
99
77.27=10.89
88.0545.92
98.2424.96
92.8543.57
75.09:12.7272.51:1lll 21t.::222227211110.7222.222222..
Attakk Ace3
KFD-MI-HSIC 37.28+7.10
85.15+8.61
97.23w6.33
96.84+7.15
99.09s4.12
93.6564.70 70
86.75+8.85
80.51
74.61+15.72
KED-MI
8,0518
10,2236
7,5784
5.7769
8,3396
5,5596
5.5913
9:4793
744885
10.4272
FID
KED-MI-HSIC 5.7466 6,0592
5.3121
5,3495
7.6287
6.419
10.1933
FedInverse+KEE- -MI-MMI-CCC further pushed the attack accuracy to 63.25, which is 21% im- provement. For top-5 attack accuracy, both FedInverse+KED and Bellnvers++KD-MMIHHBB achieved extremely high performance, which are 98.24 and 99.09, respectively.
A.18 IMPACT OF DEFENSE METHODS ON FEDINVERSE+ ON CIFAR-10
We used latest prevailing defense methods, MID and BiDO, train the FL models. Meanwhile, we launch the GMI attacks on the updated global models in each federated communication round to see if these defense training schemes can still work in FL settings. The relevant observations are summarized in Table [2] The FedInverse with GMI and GMI-HSIC attacked the FL with MID on the ninth training round and reached attack accuracy of 24.00 and 28.00, respectively. Similar to MID settings, GMI and GMI-HSIC successfully attacked the FL with BiDO on the ninth training round and reached attack accuracy of 28.00 and 38.00, respectively. For top-5 attack accuracy, GMI reached 66.00 in round 6, and GMI-HSIC reached 68.00 in round 6 with MID, and GMI reached 66.00 in round 9, and GMI-HSIC reached 70.00 in round with BiDO defense settings. The results show that the SOTA defense approaches has less impact defending against FedInverse+GMI attacks on FL settings on CIFAR-10 dataset.
A.19 IMPACT OF DEFENSE METHODS ON FEDINVERSE+KED
The relevant observations are summarized in Table 23 The FedInverse with KED-MI and KED-MI- HSIC successfully attacked the FL. with MID the ninth training round and reached attack accuracy of 45.17 7 and 63.75, respectively. Similar to MID settings, KED-MI and KED-MI-HSIC successfully attacked the FL with BiDO and reached attack accuracy of 63.75 and 72.25, respectively. For top- 5 attack accuracy, KED-MI reached 97.43 in round 10, and KED-MI-HSIC also reached 99.23 in round 10 with MID. In addition, with BiDO defense settings, KED-MI reached 87.53 round 7, and RED-MI-HSIC also reached 99.89 in round 4. The results show that the SOTA defense approach cannot defend against SedlvverseKKED-M. attacks on FL settings on CIFAR- 10 dataset.
B MORE RELATED WORKS
B.1 FEDERATED LEARNING
With the rapid development of machine learning technology, applications such as automatic driving, face recognition, and natural language processing have brought great convenience to people's 's lives. Machine learning data-driven, which learns a model from large amount data to achieve various tasks. Traditional machine learning adopts a centralized architecture that collects training data, trains models, and deploys them in various application scenarios after the model training is completed Zhang et al. (222)) ). Although centralized machine learning has excellent learning performance, it also faces problems such as data silos and data privacy problems. Data silos refer to the phenomenon that data is stored in different forms and managed by different agencies, resulting in these data that
27

---

Published as a conference paper at ICLR 2024
Table 22: FL privacy leakage indicated by Attack Acc/Acc5 standard deviation(%) and FID CIFARIO via FedInverse using GMI and GMI-HSIC with two diverse defense methods: MID and BiDO. Bold values denote the best metric results obtained by GMI GMI-HSIC throughout the Fl. training epoch. The symbol i(t) denotes that smaller (larger) values are favored.
Metrics
Methods
FLAR01
FL#K02
FLAROS
FL4R04
FLAKOS
FLAR06
FLeR07
FLAROS
FL4K09
FLAR10
Defense Method
MID
Accuracy
66.67
75.22
79.92
$3.80
82.59
$4.84
84.56
86.11
87.14
79.97
GMI
12.00.10.33 33 18.00 11.35
12.00
16.00118.30 18.38
16,00412..6 12.65
20.0049.88
18.00219
0011
24 24.00 15.00
18.00+1 18.00
18.00-
4.76
16.0015 24.00
00
8.33
(XH22.71
28.00=
50.00
76.66666000
Allack
GMI HSIC
64.00220..06
60.00
13,300133,3322 62.0002000
14..114...0220 07766220021144 008.8960.000888.8888 (ww.:000081888666006 66.866666..012226
GMI
8.1742
8.6436
8.2033
7,7860
6,8375
7,8042
7.1293
7,4087
6.7212
8,4500
FID
GMI-HSIC
7.5186
7,5998
7.3009
7.2506
6.9614
7.0091
7.4085
6,4709
6.6456
8.3597
Defense Method
BIDO
Acconcy
71.16
$1.08
89.52
$2.86
83.02
86. 32
86 58
87.40
87. 36
86.28
GMI
4.00 43 1800017.511 14.00+1 3.50
10.17.51
10:00
A000000113.0000 13.50
20.00 43
20. 20.00113 3.33
20000061...320000006600222 28.00 12.001
Attack Ace
GMI HSIC
16.00 211.:55.77.22.0001111 1.35 28.00222.01
18.00
1.35
18.00
14.
20.00
0011 88 8.38
38.00EE88888.8000001008110100030 38.00 2..00
(18H-16.87.8000-11111 50.00-21
54.00
16.47
00+
GMI-115CC
18.00
4,7611466644
54,0023
GMI
8.7736
8.0881
7:7029
6.2580
7,6331
7.2277
7,5003
7.4346
FID
GMI-HSIC
8.1356 7,6322 7,4147 7.1645 6,1716
6.9755
7,1300 7,0099 7,0535 8.1704
Table 23: FL privacy leakage indicated by Attack Acc/Acc5+ standard deviation (6) and FID on CIFAR10 via FedInverse using KED-MI and LED-MI-HST with two diverse defense methods: MID and BiDO. Bold values denote the best metric results obtained by KED-MI or KED-MI-HSIC throughout the FL. training epoch. The symbol L(t) denotes that smaller (larger) values are favored.
Metrics
Methods
FL4R01
FLAR02
FL4R03
FLARG4
FLAROS
FL.R06
FLARO7
FL4ROK
FLAR09
PLARI0
Defouse Method
MID
Accuracy
66.67
75.22
79.92
$3,80
$2.39
84.84
84.56
86.11
87.14
79.97
23.31
30.79110455 10.75
37.7369
58.20 0.5771111111
14.41
30.81
27t
45.
17
45
Altick:
29 19.04 43.27+9.08
40.52-12.70
88+
49.022
76 3.98
68441122.36 82.53a7.21
95.5127.76
88.2343.71
65.71
18.17.11.72
85.9119.55
Attack Acc5
KED-MI-HSIC
27.12=1322 96.6745.57
97.1554486
92.2169.22
98.5745.07
07
96
96.3966.99
94.1959.66
87
57.41=10881
96.6387.4 75
99.23e33.30
KFD-MI
10,0500
10.1391
7,6529
7.1021
6.1316
7.1951
5,8090
5,8956
5.0637
8,1110
FTD
KED MI-IISC
8.0914
6,9088
S,6072
5.3786
7.4237
3.7721
4.9038
$.6893
5.0551
5.8501
Defense Methol
BIDO
Accuracy
71.16
31.08
83.52
$2.96
$3.02
86.32
86.58
$7.40
87.56 56
$6.78
KED-MI
45.0011191
41.2546.44
21.96=1288P 59.511155111...
62.3541
73.75313.92
56.0367.4
Attack Acc
KED-MI-HISIC
54 14.23.1
16.1147.48
12:1229991111
65.33
85
72.2516.54
79.83+1.40
79.91+9.18
40+6.88
02,15+4.38
83.3747.55
83
83.15+3.33
87.63+3.14
72+2.21
79.69+2.40
78.59+4.99
Ace5
94.2747.88
94.00u2.32
93.00110.11
85.71a6.38
79.9740:42
86.5340.93
KED-MI
6.7435
8.1078
52210
8.6067
4.8333
5.8224
2.2666
3:7742
4.2176
5.4706
HDD
KED-MI-HSIC
6,1733
7,1471
58914
3.8114
4,0433
5,8198
3.1937
4.0076
3,7809
3.5632
cannot be integrated and utilized. The data privacy problem is because the data owner does not want the data to be shared with a third party, making it difficult for centralized machine learning to utilize all the data. In response to the above problems, FL. was proposed McMahan et al. (2017).
28

---

Published as a conference paper at ICLR 2024
FL uploads model parameters to the central server instead of training data, thereby ensuring the data privacy of participants and reducing communication costs. Although FL has made significant benefits to the fields of the Internet of Things Savazzi et al. (2020), network security Chen et al. (2022), and medical care Huang et al. (2019), but also faces some challenges. First of all, the global model in FL can be poisoned by uploading malicious parameters to the server ZZhan et al. (2019). In Zhang et al. (2019), the malicious party leverages the global model as a discriminator to train the GAN, where the generated data can be used to poison the global model. The poisoning attack aims to reduce the performance of the global model rather the leak user privacy. For obtaining user privacy, attackers can recover the local data from the gradients Zhu et (0119) when all participants upload the trained model gradients to the central server. However, no studies pay attention to the data leakage problem when the attackers are pretended to be benign users. This paper mainly discusses the vulnerability of federated learning from the perspective of attackers obtaining user privacy as the FL participants.
B.2 GRADIENT INVERSION ATTACKS
Pasquini et al. 2022) discusses the "gradient suppression attack", a method where a malicious server exploits model inconsistencies to bypass Secure Aggregation and extract a specific user's 's model up- date. Central to this attack is the "dead-layer trick," which manipulates ReL.U layers by inducing the dying-Rel.U .U phenomenon, where a network's ' parameter derivatives become zero. This is achieved through malicious parameters that exploit the ReLU function's non-differentiaabilty, allowing the server to nullify the model updates of non-targeted users. Consequently, the server isolates and leaks the targeted user's model update, undermining the integrity of the model training process. Moreover, Boenisch et al. (2023) investigates an attack on Federated Learning (FL) systems that use Distributed Differential Privacy (DDP) and Secure Aggregation (SA). The attack involves circum- venting SA by introducing Sybil devices, controlled by the server, into the FL process. These devices manipulate the outcome by returning arbitrary gradients, allowing the server to isolate and extract the target user's gradients. The paper also points out the limitations of DDP, where the noise added for privacy is often insufficient, especially compared to Local Differential Privacy. By exploiting these vulnerabilities, the attacker cusses using "trap weights" to create redundancy in the data, facilitating higher-fidelity reconstruc- tion. Experiments with datasets like CIFARIO and IMDB demonstrate the attack's effectiveness, using techniques like similarity clustering and leveraging gradient sparsity to improve the quality of reconstructed data. The study further notes that higher gradient norms lead to more significant data leakage, which the attack exploits. This comprehensive analysis reveals critical weaknesses in FL systems enhanced with DDP and SA, showing that private user data can still be extracted despite these privacy measures. Additionally, /Zhao et al. (2023) presents a sophisticated attack in Federated Learning (FL.) environments, greatly surpassing previous methods in data leakage efficiency. LOKI can leak 76-86% of data samples in single training round, targeting both FedAVG and FedSGD systems. The attack, designed for a cross-device FL setting with secure aggregation, manipulates the model architecture and parameters, enabling data recovery from hundreds of clients. A key tactic is using customized convolutional kernels to create separate identity mapping sets, maintaining distinct weight gradients for different clients. LOKI resolves scalability issues in FedAVG by introducing a convolutional scaling factor (CSF), which aids in precision during reconstruction and addresses neuron activation overlap. The attack also cleverly utilizes biases in the FC layer to learn and uti- lize data characteristics like average pixel intensity. This technique enables the identification of data ownership post-aggregation and requires significantly fewer parameters compared to previous meth- ods, enhancing efficiency. LOKI is effective even in the absence of full model inconsistency among clients, marking a significant advancement in data reconstruction techniques in FL systems.
reconstruct individual users' training data. The paper dis-
B.3 MODEL INVERSION ATTACKS
Unlike gradient inversion attacks, model inversion attacks do not need to reconstruct original im- ages from the feature maps, but gradient inversion attacks need to. According to different attack strategies, privacy attacks machine learning can be divided into membership inference attacks, model inversion attacks, and parameter extraction attacks. The membership inference attack refers to the attacker trying to determine whether a piece of information exists in the training data set of the global model Shokri et al. (2017). Model parameter extraction means that when the global model parameters not public, the attacker knows part of the model structure information and attempts
29

---

Published as a conference paper at ICLR 2024
to access the global model to get the parameters Ateniese et al. to inverting some or all attribute values of a target data in the training set through the model's output Liu ct al. 2020). Among them, membership inference attacks and model inversion attacks can be regarded as direct attacks, and model parameter extraction attacks are indirect.
(2015). Model inversion attack refers
This paper mainly focuses on model inversion attacks. The first model inversion attack was proposed by Fredrikson et al. |Frddrikon et al. (2014). They used demographic information as auxiliary information and linear regression model of drug dosage as the global model recover patient genomic information. This research demonstrates that even if an attacker only has access privilege to the global model, it is possible obtain users' sensitive data. Hitaj et al. Hitaj et al. (2017) proposed a model inversion attack in collaborative learning scenarios. In this attack, the attacker is a participant in collaborative learning. By actively participating in the training of the global model, the model parameters are obtained so that the attack under white-box conditions can be realized. The experimental results show that as long as the local model accuracy of the participant high, good attack performance can be achieved. Ateniese et al. Ateniese al. (0055) constructed new meta- classifier (meta-classifier) and trained it to attack other classifiers to obtain sensitive information about their training data sets.
Due to their excellent data generation ability, generative adversarial networks are widely used in various deep learning tasks. Wang et al. [Wang al. (2019) proposed model inversion attack for FL. This method designed a multi-task generative confrontation model as the attack model and successfully realized the user-level privacy attack. In addition, some optimization-base
methods have been proposed, such as GMI ZZang et al. (2020), KED-MI et al. (202I), and VMI Wang al. [202 which obtain private data in the global model by training GAN. The details of these attacks will be described in the next section.
B.4 STATISTICAL DEPENDENCY MEASURES
Mutual information Hutter 200T) and ScilmettSSchmitt independency criterion (HSIC) al. 2005 are statistic dependency measure metries that are well established in statistics. Unlike mu- tual information, the HSIC does not need to estimate two variables' probability density but directly convert it into sampling. Due to its effectiveness and high efficiency, HSIC is widely used in ma- chine learning. such as dimensionality reduction Zhang & Zhou (2010), feature selection DallectoonSong et al.) (012),, transfer learning [Wang& & Yang (201T). and deep learning Lopez et al. (2018). The central idea of the HSIC-based learning method is to use the HSIC to measure the dependence and achieve the solutions by maximizing or minimizing such associations Wang al. (2021c).
C EXTRA EXPERIMENTS ON HEALTH DATASETS AND CIFAR-
(a) Segmented Prior Data (Covid-19 CT-scans)
(b) Segmented Target Data (Fed-LIDC-IDRI)
(c) Fedlnverse Inverted Data
Figure 6: Visualization results of FedInverse on Fed-LIDC-IDRI Terrail al. (022) using the publicly available prior data from Covid-19 19 CT-Scans Kaggle (2019). It should be noted that, con- sidering the global model in FL is nodule detection model, FedInverse adopts the preprocessed segmentation results for original CT-scanned images as the private data distributed to federated clients.
30

---

Published as a conference paper at ICLR 2024
Attack Acc: 10.00%
Attack Acc: 22.00%
Attack Acc: 30.00%
Target
airplane
automible
bird
cat
deer
Figure 7: Visualization results of FedInverse on CIFAR-10 across different attack accuracies (10.00%, 22.00%, and 30.00%).
Sugrmenned Prior (Covte 19 CTiccent
Segmented Terget (Fe--UDC-IORI)
Fediiwensa Inverted with 30% prior data
Feclnoerse Inverted with 50% prior cata
Figure 8: Visualization results of FedInverse on Fed-LIDC-IDRI Terrail et al. 2022) using the publicly available prior data from Covid-19 19 CT-Scans Kaggle (019). We select total of 665 segmented images from Kaggle (2019) as prior data. Panes (c), (d), and (e) present the inverted results with prior data proportions 30%, 50% and 100%, respectively.
31


Reviews:
[{"review_id": "ZJXawQ8L35", "reviewer": "Reviewer_hL64", "summary": "- The paper studies model inversion (MI) attacks in federated learning settings, where malicious clients (participants) would apply existing model inversion techniques on the global model shared by the server. When performing MI attacks, the malicious clients would look like benign clients since they can still send model updates as such.\n- To perform the attack, the malicious clients would train GAN models for model inversion, following prior work (GMI, KED-MI, VMI); a typical instantiation is to train GANs on public data with similar data distributions as the FL training setup and then optimize the generator for low log-likelihood (loss) under the shared global FL model.\n- The paper also proposes a “diversity optimization” technique using the Hilbert-Schmidt independency criterion as a regularizer. The main idea is to encourage the GAN generated outputs to be more diverse, and the paper shows that this technique qualitatively improves the inverted data and quantitatively improves the attack success.\n- The paper evaluates the proposed method on three datasets (CelebA, MNIST, and CIFAR-10) and shows that it can achieve high “attack accuracy” (measured by a separate model trained to tell apart generated vs real images) and low “Frechet inception distance” (which measures the similarity between real and fake images within the embedding space of a CNN). The experiments also show that the proposed HSIC regularizer was essential for obtaining high attack accuracy.", "questions": "- I would appreciate if the authors provide more visualization results of the generated samples, e.g. on CIFAR-10, as well as across different attack success rates.\n- Consider using different citation commands `\\citet` , `\\cite`, etc. to make the formatting of in-text references consistent.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The high-level idea of the paper is simple: with some modifications (HSIC regularizer in this case), existing model inversion attacks in the standard ML literature can easily carry over to federated settings, where the attackers are malicious clients and the target network is the global, shared model from the central server in FL.\n- There is also originality in studying a new attack surface in FL that isn’t easily detectable from by the server (cf. attacks that require malicious clients to send out-of-distribution updates). The problem of interest is important and worth exploring.\n- The paper is also reasonably easy to follow.", "weaknesses": "[W1] The use of public-data assisted generative models, particularly following prior work like GMI, KED-MI, or VMI, implicitly assumes that the client data distributions can be found in the public domain. However, in many practical FL settings, this assumption is often unwarranted. Many settings where FL is helpful—such as medical images across hospitals [1]—are often where the data distributions aren’t covered by publicly available data.\n\n[W2] The experiments can be improved in terms of both quality and quantity.\n\n- The paper directly takes a split of the federated training set as the “public data” for training the GANs. This in-distribution nature weakens the experimental support for the proposed techniques.\n- The evaluated datasets are fairly small; there are large federated dataset such as iNaturalist [2] that would help make the results more convincing. Indeed, by looking at Figure 4(a), the reader may argue that the model-inverted examples do not look much alike the true examples; what happens if the dataset and the FL setup is scaled up (e.g. more clients, larger local batch sizes)?\n\n[W3] The evaluation metrics can be made more rigorous.\n\n- The bulk of the experimental results rely on having a good “evaluation classifier” which tells apart real vs generated (model-inverted) images and whose embeddings are good enough to give meaningful Frechet inception distances (Section 4.4). However, it is unclear how such a classifier was trained.\n- The core issue is perhaps that the possible plausible deniability that the model-inverted images are indeed part of the training set. I.e. just because the evaluation classifier says the generated images are realistic, can we be sure that they actually are? Is the similarity provable? Again, Fig. 4(a) does not seem to support the use of proposed metrics.\n\n[1] FLamby: Datasets and Benchmarks for Cross-Silo Federated Learning in Realistic Healthcare Settings. NeurIPS 2022 Datasets and Benchmark.  https://arxiv.org/abs/2210.04620 \n\n[2] https://www.tensorflow.org/federated/api_docs/python/tff/simulation/datasets/inaturalist", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9El5JgqQzG", "reviewer": "Reviewer_E5kp", "summary": "This paper focuses on Federated Learning (FL), a privacy-enhancing distributed machine learning approach. It highlights a crucial issue: the potential for Model Inversion (MI) attacks in FL, where attackers can extract data from other participants. Existing defenses are inadequate. To address this, the authors propose FedInverse, which uses the Hilbert-Schmidt independence criterion (HSIC) to assess FL model vulnerability to MI attacks. Experiments with typical MI attackers confirm FedInverse's effectiveness in evaluating data leakage risks in FL systems.", "questions": "This paper is well written and organized and has been thoroughly and comprehensively evaluated. However, the following minor issues still need to be considered:\n\n- As mentioned in the weaknesses of this paper, we need to augment the diversity of the benchmark dataset. It would be better if the authors considered more tasks, such as NLP tasks.\n\n- More advanced defense mechanisms need to be added to evaluate the effectiveness of the proposed attacks. Although the authors demonstrate the performance of the proposed attack against two common defense schemes in the appendix, the following stronger defenses still need to be considered:\n\n[1] Huang Y, Gupta S, Song Z, et al. Evaluating gradient inversion attacks and defenses in federated learning[J]. Advances in Neural Information Processing Systems, 2021, 34: 7232-7241.\n\n[2] Li J, Rakin A S, Chen X, et al. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 10194-10202.\n\nThe main reason is that the BiDO solution considered in this article is not a defense solution tailored for FL.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ A novel method called FedInverse is proposed to comprehensively evaluate the privacy risks of FL in response to model inversion attacks.\n+ The research question is well defined and valuable to the research community.\n+ A thorough and comprehensive case study.", "weaknesses": "- The diversity of the evaluated benchmark datasets needs to be further augmented.\n- Potentially mature defense mechanisms require further consideration.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tsSEXXvDEN", "reviewer": "Reviewer_Do36", "summary": "This manuscript proposes FedInverse, an approach that one attacker could use to obtain the private local data of other clients as a normal participant. FedInverse generates the possible training data from observing the aggregated global model with the help of the GAN. Additionally, a regularizer using the Hilbert-Schmidt independence criterion (HSIC) is applied to generate more diverse images. The experiments show that FedInverse with HSIC has achieved progress in recovering the local data of other participants.\n\nThe rating has been changed to 6 after the rebuttle discussion.", "questions": "- How does FedInverse perform in a typical vertical FL setting? For example, 10+ clients with the same (or similar) data distribution. More discussions of this case should be given.\n- Is there any method to remove or mitigate the effect of the attacker dataset in the final results? From Figure 4, the generator is still trying to produce an image similar to its local dataset, even with the regulation of HSIC.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "This paper focuses on how to steal the private data of other clients in FL as a participant, and the idea of applying HSIC as a regularizer to increase diversity is helpful. Besides, for the evaluation part, plenty of factors are taken into consideration, which make the results comprehensive and easy to understand.", "weaknesses": "- FedInverse uses typical model inversion attacks to generate the images. However, whether those approaches could be directly applied to the aggregated model is still a problem. In the setting of the experiments, the clients have local datasets that are disjoint on the label (for example, in MNIST, the attacker has labels 5-9, while other clients have labels 0-4). However, the setting is not practical for the typical situation. As the number of participants increases, some clients will have similar data distributions, so that FedInverse may fail in this setting.\n- Moreover, FedInverse generates the image from a similar distribution with target clients. However, it could not tell the source of the image exactly (from an attacker or another specific participant).\n- Some metrics used in the experiments should be clear. Take the attack accuracy as an example. A well-trained model may still classify an image with some flaw as the correct class, and it could lead to results at variance with reality. Additionally, the top-5 accuracy is too weak for some experiments, especially on MNIST (with only ten labels). As for FID, the attack results of some baseline approaches(for example, applying the MI attack on local models) should be added for comparison. Otherwise, it would be hard for readers to understand the degree of privacy leakage.     \n- In Section 3, the description of the attack procedure is not clear enough. More details are needed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Xgs7ZRY6cY", "reviewer": "Reviewer_5eXT", "summary": "The authors apply known model inversion attacks (GMI, KED, VMI) to FL where a clients might act malicious and try to learn sensitive training data from other participants (by applying these attacks to the global models distributed in each round). The authors furthermore propose an optimization to these attacks based on introducing more diversity in the images generated by the attacker. The evaluation on various standard image classification tasks demonstrates the effectiveness of the model inversion attacks and a mostly minor advantage for the proposed optimization.", "questions": "- What is the relation to existing attacks for extracting sensitive training data from global models listed above?\n- Does the attack perform well / at all if there is no good quality auxiliary dataset available? (e.g., because training is done over records of rare medical diseases, etc.)\n- Is the proposed algorithm / framework meant purely for attack purposes or also as a defence / pre-check for the server to evaluate the vulnerability of participating clients?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The paper studies an important topic, showing further vulnerabilities of FL, which is often assumed to be a privacy-preserving ML paradigm.\n\nIn the discussed threat model, this might indeed be the first (or one of the first) works to reconstruct sensitive training data of other clients just from plaintext access to the global model.\n\nThe underlying model inversion attacks are clearly presented and perform well in the evaluation.", "weaknesses": "The work is based on the bold premise that \"no studies pay attention to the data leakage problem when the attackers are pretended to be benign users\", i.e., data extraction from the global models that are distributed by the central server in each round. While this might be true, a dedicated discussion of related works is missing from the main body of the paper (and only provided in Appendix B). There definetely exist works that look into data extraction from the global model, but from the perspective of a malicious aggregator that can use techniques like providing inconsistent models. For example: Boenisch et al. (arXiv:2301.04017), Pasquini et al. (CCS'22), Zhao et al. (SP'24).\n\nThe application of the existing model inversion attacks seems rather straightforward, assumes that a good auxiliary dataset is available, and the proposed diversity optimization in the evaluation does not show impressive improvements over the respective baselines.\n\nThe presentation and positioning of the suggested FedInverse framework is rather unclear to me. On the one hand, it is presented as an attack, on the other hand as an evaluation framework => is it supposed to be something that also FL operators should utilize to measure whether real benign clients might be vulnerable to such attacks?\nAlgorithm 1 is also unclear in this respect: Do all clients run the attack in parallel (instead of a small subset of malicious clients pretending to be benign)? The set Q_t is not passed to the FedInverse function as a parameter but assumed to be a global variable in line 19; however, the function still explicitly returns it => make clear what is the purpose of this algorithm, what is the final result of the algorithm, and how values are passed around between the functions.\n\n**Update:** The authors have appropriately addressed my concerns in the rebuttal and provided a revised version of the paper. Therefore, I'm upgrading my score.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)