Foreseeing Privacy Threats from Gradient Inversion Through the Lens of Angular Lipschitz Smoothness
Authors: HyeongGwon Hong
Yooshin Cho
Hanbyel Cho
Jaesung Ahn
Junmo Kim
Venue: NeurIPS 2022 Submitted (2022)
Keywords: Federated Learning
Privacy Leakage
Gradient Inversion
Lipschitz Smoothness

Abstract: Recent works proposed server-side input recovery attacks in federated learning (FL), in which an honest-but-curious server can recover clients’ data (e.g., images) using shared model gradients, thus raising doubts regarding the safety of FL. However, the attack methods are typically demonstrated on only a few models or focus heavily on the reconstruction of a single image, which is easier than that of a batch (multiple images). Thus, in this study, we systematically re-evaluated state-of-the-art (SOTA) attack methods on a variety of models in the context of batch reconstruction. For a broad spectrum of models, we considered two types of model variations: implicit (i.e., without any change in architecture) and explicit (i.e., with architectural changes). Motivated by the re-evaluation results that the quality of reconstructed image batch differs per model, we propose angular Lipschitz constant of a model gradient function with respect to an input as a measure that explains the vulnerability of a model against input recovery attacks. The prototype of the proposed measure is derived from our theorem on the convergence of attackers’ gradient matching optimization, and re-designed into the scale-invariant form to prevent trivial server-side loss scaling trick. We demonstrated the predictability of the proposed measure on the vulnerability under recovery attacks by empirically showing its strong monotonic correlation with not only loss drop during gradient matching optimization but also the quality of the reconstructed image batch. We expect our measure to be a key factor for developing client-side defensive strategies against privacy threats in our proposed realistic FL setting called black-box setting, where the server deliberately conceals global model information from clients excluding model gradients.

Foreseeing Privacy Threats from Gradient Inversion Through the Lens of Angular Lipschitz Smoothness
Anonymous Author(s)
Affiliation
Address
email
Abstract
Recent works proposed server-side input recovery attacks in federated learning (FL), which an honest-but-curious server can recover clients' data (e.g., images) using shared model gradients, thus raising doubts regarding the safety of FL. However, the attack methods are typically demonstrated on only a few models or focus heavily on the reconstruction of single image. which is easier than that of batch (multiple images). Thus, in this study, systematically re-evaluated state- of-the-art art (SOTA) attack methods reconstruction. For broad spectrum of models, we considered two types of model variations: implicit (i.e., without any change in architecture) and explicit (i.e., with architectural changes). Motivated by the re-evaluation results that the quality reconstructed image batch differs per model, we propose angular Lipschitz consiant of a model gradient function with respect to an input as a measure that explains the vulnerability of model against input recovery attacks. The prototype of the proposed measure is derived from our theorem the convergence of attackers' gradient matching optimization, and re-designed into the scale-invariant form to prevent trivial server-side loss scaling trick. We demonstrated the predictability of the proposed measure on the vulnerability under recovery attacks by empirically showing its strong monotonic correlation with not only loss drop during gradient- matching optimization but also the quality of the reconstructed image batch. We expect our measure be key factor for developing client-side defensive strategies against privacy threats in proposed realistic FL setting called black-box setting, where the server deliberately conceals global model information from clients excluding model gradients.
2
3
variety of models in the context of batch
10
11
12
13
18
17
18
19
20
23
Introduction
25
Federated learning (FL) cooperative machine learning between clients as local trainers and central server global aggregator [14 21.. Participants in FL cannot access raw data from others and only communicate with one another through gradients, which were believed to leak little information of the original data in the past.
28
29 However, recent studies
26 12 challenge inverting gradients back original data, suggesting that there potential for an honest-but-curious server to attack by sneakily recovering
30
31 clients' data from gradients in FL. Their algorithms, so-called gradient inversion attacks, aim optimizing input variables (c.g., images) match the given gradients under the condition of fixed model weights. For better reconstruction quality, state-of-the-ar (SOTA) attacks assume that both batch normalization (BN) layers' statistics and private labels are known 26 However,
33
34
Submitted to 36th Conference Neural Information Processing Systems (NeurIPS 2022). Do distribute.

---

71 two settings on the transparency of global model information to clients: white-box and black-bon In white-box setting, clients have absolute control over global model such as the server; thus, 35 they are demonstrated on limited range of global models. Thus, we systematically re-evaluated
36 SOTA gradient inversion attacks on a variety of models in the context of batch (or multiple images) reconstruction, the recovery of input batch from the averaged gradients over itself, which is more difficult to solve than single image reconstruction, the recovery of single image from its gradient. In this paper, two kinds of model variations are considered, namely implicit and explicit.
37
38
39
40
Implicit model variations refer to collection of different models with the same architecture. In this paper, we consider two types of implicit model variations: BN modes and training epochs.
41
As mentioned previously, SOTA gradient inversion attack methods demonstrated models with BN layers to assume shared BN statistics. Note that there are two modes of a BN layer, namely, train mode and eval mode. In the reality of FL, the server can choose any mode among them. Therefore, we re-evaluated SOTA attacks by considering both modes of BN. This paper is the first to consider BN modes for the evaluation of gradient inversion attacks. We empirically found that the quality of reconstructed batch significantly changes by switching BN modes even for the same model weights.
43
44
45
46
47
48
49
By reflecting the reality that clients can encounter global model from the server at any time, we consider models with different training epochs for the re-evaluation. This scheme extends the scope of previous works' training epoch choices of black-and-white manner: zero training epoch (untrained) and maximum training epochs (fully trained). We empirically found that the best reconstruction result was usually found at earlier training epochs, not untrained nor fully trained, thus raising the need to expand the evaluation criterion for attack methods.
50
51
53
54
55
Meanwhile, explicit model variations are more straightforward than implicit model variations as they only involve architectural changes. this study, we consider two types of explicit model variations: skip connections and channel size.
56
57
58
even for batch reconstruction, while networks without skip connection are introduced for only for the recovery of single image from its gradient [6. Therefore, we explored how a skip connection affects the quality of SOTA gradient inversion attacks the context of batch reconstruction. Our empirical findings suggest that models without skip connection are more robust against the gradient inversion attack than residual networks.
Residual networks (ResNets) ()] are frequently employed in previous works 26 6
59
60
61
82
63
64
The reconstruction quality is known to increase with the number of channels, but this property is demonstrated on single image reconstruction 30 6) Thus, we recap how the number of channels affects the attack quality in the context of batch reconstruction.
66
By re-evaluating SOTA attacks in a variety of models, we found that the vulnerability against gradient inversion attack significantly differs per model, implying the need of more strict evaluation criteria 69 for attack methods. Then, clients are required to judge whether a shared model from the server is safe
67
68
70 or not before sending locally computed gradients back for their privacy. In this study, we consider
73 clients can directly apply SOTA attacks to the model to assess its vulnerability.
74 On the other hand, a black-box setting only allows clients control over model gradients to restrict
75 access to the global model possibly due to companies' secrets. For the client-side measurement of
76 privacy leakage in this practical and difficult setting, we propose angular Lipschitz constant of model gradients with respect an inpul predictive measure for the quality of reconstructed samples inverted from model gradients.
77
78
79 This measure is derived from our theorem in Sec. 4 that an attacker's 's gradient matching loss function
80 drops more abruptly with a smaller L in a particular range, where L is Lipschitz constant of model gradients with respect to an input. However, using I. as a measure for privacy leakage would be inappropriate as L can be any nonnegative value by loss function scaling. Therefore, inspired by ecale-invarian cosine similarity loss function, propose the angular Lipschitz constant, loss scaling- invariant alternative to L. We experimentally found that both measure motonically correlates
81
82

---

85 with not only total loss drop during an attacker's optimization but also the reconstruction quality
86 than the norm of gradients. These findings are expected to support the construction of client-side
87 defense algorithms particularly for black-box setting, where only model gradients are given to clients
88 as minimal information of the model as described Fig. 5
Prior Art in the Gradient Inversion Attack
89
Given the neural network function fw R Rx (w, b, d, e being the model weights. batch size, image size, and the number of classes, respectively). and the gradient g = aC(s=(=")) computed de
90
91
92 with ground truth input batch (a* yy" E Rixd R (x", yy being the image batch, and corresponding label batch) and the loss function & Rx x E + R (e.g., cross-entropy loss). the goal of gradient inversion attack is reconstruct image batch x E R resemblance of ground truth image batch x². In the context of federated learning (FL), fw is the global model, and g" is the gradient computed from client. Then, honest-but-curious server aims to recover the client's private data x².
93
96
97
general method to tackle the problem of inverting gradients is to solve an optimization problem formulated as follows:
96
arg min Egraal (C(fm( (C(fu(1')))"
C Reyrior (x))
dw
where Lgrad R R is the size of weights w) the loss function for gradient matching (which closes the distance between current gradients and target gradients), Ryrior RRxdd IR is the regularization loss for image prior, with Oprior being its coefficient.
99
100
Prior to the advent of packages for automatic differentiation, the gradient term g (C(...))).)) du was computed function of (ar, y) in closed form. For the computation to be tractable, Lgrad was set to a squared loss (C(ggg)) = [|g g" 11) and fw was also slightly modified from the original design of contemporary neural networks. For example, ReLU activation functions were replaced with Sigmoid, and all the strides convolution modules were excluded from the original ResNet in [31. Consequently, the choice of fw was limited.
102
103
105
106
107
Currently, with the advantages of automatic differentiation [22] and advanced deep learning opti- mization algorithms [13 23 5), solving for optimization problem in IT becomes tractable for most contemporary deep neural networks without the need for modification. Further, the gradient matching loss is selected in a broad range from cosine similarity loss (C(g,g") = <9.9 Telll
110
111
6
12
10 26
112
to L2 loss (C(g.g)) g") |gg 9 Il
26
The liberation from the limited choice of loss
113
functions and neural network architectures became the trigger of state-of-the-arr attack methods.
114
Sf attack methods provide several assumptions which enable the baseline, which is only gradient-based, to be expanded.
115
First, the server is supposed to know the private labels of clients' images. Currently, estimating and y becomes a sequential process, in which y is estimated first, after which is approximated with the estimated y = Vüyproz given. Rather than jointly learning x and in (T) prior works suggest estimating directly by seeing the gradients from ground truth data g before optimization [26] 29]
118
119
120
Therefore, the problem of estimating labels from gradients is separated from the original optimization problem I 25 16] and some works, which focus on reconstruction of images rather than labels, assume that private labels are known 6 12]
121
122
Second, the local batch statistics (m(("";)) w). (x:: W (u((";:)) or ww) and M being the batch mean of the 4th batch normalization layer, batch standard deviation of the 1th batch normalization (BN) layer, and number of the BN layers, respectively), computed with client's 'ss data batch, is given to the server. This assumption reflects a naive approach of a FL algorithm called FedAvg 21 on the global model with BN layers [19 17.. When {ur("" ww): at (a"; w)) " JM is shared from a client to the server for the update of population statistics in the global model's BN layers, the server as an honest-but cutrris adversary would work to add up the batch statistics matching loss term to I to ensure a stronger attack.
123
124
125
126
127
128
3

---

Then, optimization problem in ①I can be rewritten by considering both assumptions mentioned
132
previously as follows:
arg min Lagaad (L( aC(Mm(=))v")
M
+ Riprioorprroo +aDN Σ
( of
dh
Ohe
(2)
133
where RBN is the BN statistics matching loss and ABN being its coefficient with (pz, 0i) (1) 0f (2; (æ;w) w)) and (ui, oi') = (n((""; w) or) (x);x));)
134
135
By solving the optimization problem in ( high resolution images (e.g. ImageNet 4 with batch size of up to 40 can be constructed in [66]. However, Sie is only considered for three models: ImageNet pre- pre-trained 8 model, ImageNet pre-trained ResNet50 model, and MOCO v2 2 trented ResNet50 model fine-tuned with ImageNet. However, there are various choices of fw- Although a broad spectrum of fw choices is introduced in 6 (e.g.. increasing channel size. models with or without skip connection), the authors of the work verified the effect from model variations on single image reconstruction as well as considered the optimization problem of the form ① rather
136
139
140
141
142
than 2 Thus, in this paper, we recap how model variations considered in 6 affect reconstruction of multiple images in batch by solving optimization problem of the form achieve better
143
quality of reconstructed samples.
Re-evaluation of SOTA Gradient Attacks on a Broad Spectrum of Models
145
148
Prior works in gradient inversion attacks properly select limited range of models with vulnerability under the proposed attack methods to demonstrate their effectiveness (26] 12 30 Therefore, this study aims to re-evaluate sate-off-hhe-rt attack methods on broad spectrum of models. The target of our evaluation is attack methods that can solve the optimization problem of the form (2) assuming
147
149
150
that the server as an honest-but-curious attacker desires to reconstruct multiple private images from
151
batch gradients given, which is rarely studied previously. The model variations we considered are
152
twofold: implicit and explicit.
Original
Untrained
e
e=10
e525
e0
e=150
222
Fully-brined
eval mode
BN with train mode
Figure 1: Visualization of reconstructed images from implicit model variations of ResNet18. Here denotes training epochs. Then, "Untrained" means 0, and "Fully-trained" means 300 as the ResNet18 model is trained on CIFAR 100 training set up to 300 epochs. Reconstructed images in the red dotted line box come from choices of e. Original images (a woman image, an apple image, a beetle image) were randomly sampled from the CIFARIOR 100 validation set.
153
3.1 Implicit model variation: BN modes and training epochs
154
While explicit model variation refers to an architectural change such as increasing channel sizes of the model, as suggested in (6. implicit model variation invisible in the architectural level. However, changes arise internally within the same architecture such as applying different weights with different
155
156
training epochs or switching the mode of normalization layers (c.g., switching between train and eval modes for BN). This is the first work to introduce the concept of implicit model variation. More

---

MSE
LPIPS
c15
BN mode
BN eval mode
BN mode
BN mahn mode
5
10
25
50
150
225
300
Epoch
Epoch
Figure Plotting the quality of reconstructed samples from implicit model variations of ResNet18 in terms of MSE (4, left) and LPIPS (4, right).
159
specifically, this is the first time implicit model variation considered for the evaluation of gradient inversion attacks. Interestingly, experimentally found that the reconstruction quality ranges in broad spectrum over implicit model variations.
162
3.1.1
BN modes: motivation
State-of-the-art gradient inversion attack methods elevate the quality of reconstructed samples by
introducing batch statistics matching loss to the original problem of gradient matching as in (2). Therefore, we adopt a global model with BN layers to realize shared batch statistics in FL. BN
184
165
186
layer has two modes of operation: train mode and eval mode [T. However, recent works have not specified which mode set for their demonstration while the malicious server, least as an honest-but-curiout attacker, can send a global model with BN layers set to any mode. Therefore, this study considers both BN train mode and BN eval mode for the re-evaluation of SOTA gradient attacks. Our re-evaluation results show that reconstruction results from different BN modes can be significantly different from each other even in terms of the same model weights as in Tab.
167
168
171
Epoch (c)
PSNR
Epoch (c)
PSNR
1,9045
0.0195
0.0665
0.2362
5
1.5033 0.1157
10.4366 +: 0.43
0.0915 0.0081
5
0.6921
0.1601
14.9733
0.9168
0.0459 :: 0.0164
0.0334
12.5
0.2861
0.0624 0.0035
25
1.8072 =: 0.1043 1042
10.02 + 0.5716
0.1362 :: 0.0263
25
1.3015 = 0.3402
11.6733 :: 1.4027
0.097 :: 0.04
50
1.7941
0.3291
9.8666 0.5507
0.1451
0.0153
1.66 + 0.1831
10.0433
0.6354
0,1601
0.04]
150
1.7361
0.0783
10.34 =:: 0.3732
0.1307
0.0167
150
1,6881 = 0.3138
10,2066
1.1074
0.1444 à: 0.0279
225
1.8495
0.2759
10, 1866 +: 0.4878
0.1393 0.0214
225
1.8497 0.315
9.49
1.008
0.174 0.0111
0.1575
0.4333
300
1,833
0.3703
9.4333 + 0.8832
0.1812 + 0.0322
(a) BN with eval mode
(b) BN with train mode
Table I: Quantitative comparison between reconstruction results for 50 CIFAR100 images from ResNet18 model with BN set (a) eval mode and (b) train mode. MSE (L), PSNR (t), and LPIPS (L) are used as evaluation metrics. We highlight the best performance for each column in bold.
172
3.1.2
Training epochs:
motivation
173 In a scenario of FL, a client can participate at any time during training. Then, a client can encounter the global model with arbitrary performance. This fact contradicts previous works' experimental setup, where the global model is chosen in dichotomous manner: untrained (or initialized) model model fully trained on the training set 66 26). Therefore, we re-evaluated SOTA inversion attacks on models with a broad spectrum of training epochs. We empirically found that the best reconstruction quality is usually obtained at earlier training epochs.
174
175
177
178
3.1.3
BN modes and training epochs: experimental results
Setup We trained ResNet18 model CIFAR 100 [5] training set for 300 epochs using SGD optimizer with initial learning rate 0.1, momentum 0.9, and learning rate decay 0.1 applied when
5

---

182 e 150 and e 225 for the training epoch During training, we saved checkpoints of model weights when e ε {0,,5, 5, 10, 25, 50, 150, 225, 300} to consider the models from different training epochs. We oversampled model weights before the first learning decay (0 < c < 150) to cover the whole set of dynamically changing model weights in the beginning of training. On the other hand, hyperparameterss and loss function choices for input reconstruction attacks are borrowed from [TO].
183
184
185
186
As expected from their difference in batch statistics computation, BN with train mode and BN with eval mode show different reconstruction results both qualitatively (see Fig. D and quantitatively (see Fig. and Tab. I. When BN is set to eval mode, partial information (e.g. colors or shapes) is barely leaked in reconstructed images only for the cases = 0 and e = 5 as described in Fig. and Fig. 2 On the other hand, for BN with train mode, the quality of reconstructed images were sufficient enough to identify the object in each image only for the cases e = 5, 10, 25. Unlike the BN mode set to eval mode, it remarkable that reconstructed images from BN with train mode in Fig. aare noisy images for 0. For the cases 2 50, input reconstruction failed for both BN modes and reconstructed images even from the same target gradients look significantly different for different BN modes. However, both BN with train mode and BN with eval mode have similar reconstruction quality in terms of both mean squared eгror (MSE) and Learned Perceptual Image Patch Similarity (LPIPS) (28) in Fig. 2 and Tab. [] Therefore, in the early stage of training, a global model would be privacy threatening with high probability.
Results
189
190
191
192
193
194
197
198
199
200
3.2
Explicit model variation: skip connection and channel size
201
Explicit model variations involve change in architecture level like removing skip connections in residual blocks increasing the number of channels in convolution module, which the kinds considered in previous works but on single image reconstruction. Therefore, we re-explore the effect of skip connection and channel size on the model's vulnerability against gradient inversion attack but in the context of batch reconstruction. Skip connection helps information flow both forward and backward through the network, thus input reconstruction is expected to be easier for residual p On the other hand, increasing channel size implies increasing dimension of gradients, which is the capacity of gradients store information. Therefore, expect that more information about input would be compressed in gradients when the
204
205
206
207
networks but harder for models without skip connection
208
number of channels increase.
Figure 3: Visualization of reconstructed images from ConvNet on CIFAR100. In each image block. the images the positions of the red, pink, and green borders denote the original image, the reconstruction with BN (eval mode), and the re- construction with BN (train mode), respectively. Original images were randomly sampled from CI- FAR100 validation set.
Figure 4: Plotting the best reconstruction quality in terms of LPIPS ()) among model variations through training epochs for ResNet18, ResNet18-2, ResNet18-4 models with BN eval (orange) and train (blue) modes. = 5 or 10 usually result in the best reconstruction quality. As channel size increases, the reconstruction quality increases for BN eval but decreases for BN train.
1.5
653
Restett
3.2.1
Skip connection and channel size: experimental results
Setup Instead of ResNet18, trained a ConvNet model, ResNet18 8-2 model, and ResNet1 8-4 model for explicit model variations. ConvNet, which is introduced in [6 for the first time, is convolutional neural network without skip connection and ResNet18-2 and ResNet18-4 being ResNet with channel size doubled and quadrupled, respectively. Note that we apply implicit variations considered in the Sec. 3.1 to the models. Training conditions and hyperparameters for both model training and attack methods are kept the same with the setup in the previous section.
214
215
216
217

---

Server
Server
"We con't shore the network itself company secret"
White box
Black box
Averaged
?
Averaged Gradients
Gradients
CHECOST
Clients
DEDGGTT
Clients
know everything about
Reverse engineering with model's gradients
"How likely is my data be threotened??"
my privary threats!"
Figure 5: White-box (left) and black-box (right) FL settings.
80
25
Condlttann
Reslictt na
Resietii eva Redlieti62
Rendieti8 tain
Resleel322 buin Restiett
e 4
Conelttt aval
R Renfiet7B eval
ResNcttB-2 eval
12 30
RenNitt6--1
10
Cyrst
(a) All models (rx = 0.78) (b) ResNets, BN train (r. = 0.87) (c) ResNets, BN eval (r. = 0.66)
Figure 6: Proposed measure L is approximately a monotonic decreasing function with respect to Limit - final, the difference between initial (Linst) and final losses (Lymaa)) among (a) all models, (b) ResNet models with BN train mode, and (c) ResNet models with BN eval mode considered in Sec.
218
Results Reconstructed images from ConvNet models with the best quality, in terms of LPIPS, are listed in Fig. 3 For ConvNet models, reconstructed images, even with the best quality, are far from original images visually due to severe artifacts. Therefore, as expected from the role of skip connection in residual networks, network without skip connection like ConvNet seems be robust against input recovery attacks. Then, ConvNet models would be considered as global model candidates for privacy protection in FL despite of their worse performance than that of residual networks.
219
220
223
224
225
By contrast, the best averaged reconstruction results among the sampled training epochs e e (0,5, 5, 10, 25, 50, 150, 225, 300) are plotted in Fig. for ResNet18, ResNet18-2, and ResNet18-
226
227
4 models with varied BN modes. When BN is set to the eval mode, the reconstruction quality increases as the number of channels increases expected. However, the reconstruction quality worsens as the number of channels increases for BN set to the train mode, which breaks the belief from previous works that increasing channel size makes input recovery attack easier 6 30) However, the reconstruction quality obtained with BN train mode is better than that with BN eval mode for all models considered except ResNet18-4, where their LPIPS range overlaps, implying that BN train mode vulnerable against input recovery attacks than BN eval mode. The quantitative results for ConyNet, ResNer18-2, and ResNet18-45 8-4 are provided in Appendix A1.
229
230
231
232
233
234
Lipschitz Smoothness for Client-Side Privacy Leakage Detection
235
236
FL, choosing global model robust against any server-side input reconstruction attack method would be important. At the least, global model should be robust against well-known
For
237
238
SOTA gradient inversion attack methods to alleviate clients' anxiety about any potential leakage from gradient sharing with the server. If clients can access the global model with the same level of central
239
240
server (white-box), applying SOTA attack methods directly the global model with private images
would be the best way for assessing whether or not the global model presents risk to the client's privacy. However, in general, global model information would be opaque to clients due to company
7

---

243
secrets. As clients should communicate with the server via locally computed gradients, we suppose the black-box setting, where model gradients are given to clients as minimal information of the global model. Therefore, we provide helpful measure for developing the system for clients to examine
244
245
246
whether the given global model safe in terms privacy by using gradients computed with their self-controlled inputs. Note that white-box and black-box -bx are described in Fig.
247
4.1
Angular Lipschitz smoothness: motivation
If a function f R - R is Lipschitz smooth (or the derivative of is Lipschitz continuous) with constant I,, then the following holds: [vv](x> [vv)ll S T.|aa yl Va., E RR. The concept of Lipschitz smoothness or Lipschitz continuity is frequently employed to prove convergence theorem 18] I This study employs the concept of Lipschitz smoothness to prove the following theorem the context of gradient matching problem.
251
252
of gradient descent methods for optimization [24] 7 27
20
253
254
Theorem (Monotonic decreasing loss function), Suppose (wf(((()) y) is Lipschitz continuous -0 is given as a gradient matching with respect to z with constant and L grad = || ((f()) y) - 113
255
o loss. Then, when gradient descent Ar is applied with step size μ > 0 and > e for some > 0, the
256
257
following holds:
Cat
grad S Cyrad
1
OC
grod
(3)
L
dr
258
259
Inequality 3 implies that gradient matching loss strictly decreases as the gradient descent steps
unless the gradient term grad is zero (i.e. gradient matching loss already converges). Furthermore, az gradient descent with small L (or large T-x) can accelerate the convergence of gradient matching optimization but with the premise that L > for > O. This premise is required ensure the first-order Taylor approximation for V [if((( Ax), y) in the proof in Appendix A2. Therefore, in a particular range of L (i.e., L > e). we hypothesize that a global model with smaller L experiences a sharper loss drop in gradient matching optimization. We empirically found that L. is not too small for most models, thus meeting the premise in reality.
260
263
264
265
266
For the empirical verification of the hypothesis in the context of input reconstruc- tion, we desire to compute Lipschitz smoothness constant locally around x², Tig -Vu
269 sup 2-2=1 <e.atx"
with small e, for the models considered Sec- 270 tions 3.1 and 3.2 Recent works on computing precise upper bound of L. only focus on multi-layer perceptrons (MLP) due to the difficulty of computing L for normalization layers or residual layers.
x-=z"||
271
Therefore, Tege,e is estimated as I_ max,30 [IV., +n). v)).)))VV.... V..... (()) by sampling 1,000
272
noises (n) from the Gaussian distribution (0, 0.0012) our experiments.
273
However, L_ can be any nonnegative value by scaling loss function L. If L is scaled by nonnegative scalar k. then Ly is scaled by & too, allowing L.- to be manipulated by the server using simple loss scaling. Therefore, inspired by the cosine similarity loss function, which is ocale-invariant propose the angular Lipschitz constant L max,30 1-cs(V CC (o))) L(f(="" ((f(=")))) ).v)) (cs
278
1-ce(=" +m))
being the cosine similarity loss) loss scaling-invarie invariant alternative L... We find hat D shows strong monotonic correlation with the quality of reconstructed samples, demonstrating the potential of L o to be imperative for client-side defense methods.
280
281
4.2 Angular Lipschitz smoothness: experimental results
We computed -g- and the attacker's 's loss drop Linst L (Cinit and L being the initial and final losses, respectively) for the models and input batches considered in Sec. 3 (Fig. (aa.. We also quantified their correlation using the Spearman's 's rank correlation coefficient r,, which quantifies
282
283
284
285
how two variables are in monotonic relationship. r. (r. -1) means that one variable is completely monotonic increasing (decreasing) function with respect to the other one. Then, L.- is almost a monotonic decreasing function with respect to Linit Lrinal with
287
-0.78, thus validating hypothesis. For ResNet models with BN train (Fig. 66b. Ly- and Linst Liinal show stronger monotonic correlation than that for ResNet models with BN eval (Fig. 6c with
8

---

25-
Reskettl tain
Resituii lean
300-
Tradivtta benn
eslleet8 2 mai
Restiett tain
20-
Rashetli-44 ball
20-
10-
10-
100
50
0.05
0.25
0.05
0.
0.15
0.2
0.25
LPIPS
LPIPS
(a) ||9"" [// BN train (r, 0.55)
(b) L BN train (r. 0.79)
(c) L Cos
BN train (r. 0.72)
35
30
Ranketll anal
Reskedt oval
300
Resh crt8 eval
30-
Recheell
250
25
20
15
15-
100
10r.
5-
50-
805
6.05
0.1
0.15
0.2
0.25
8.0
LPIPS
LPIPS
(d) ||/"||2 BN eval (r. 0.4)
(c) L2*, BN eval (r, 0.71)
(f) L Cos
BN eval (r.- 0.6)
Figure 7: Comparison of |lg" 1g, Ley, and L in terms of the correlation between LPIPS of reconstructed samples for ResNet models with BN train (top) and BN eval (bottom)
290 r. = 0.855. As in Tab. D and Fig. reconstructed samples are closer to their original images in BN
291
train mode, thus Lz,, which is computed around the ground truth x", seems to fit more to BN train
292
while should be estimated around the solution from the attack method rather than x" for the case of
293
BN eval. However, clients cannot access the solution from the the attack method in the black-box setting. The plot of Ly- and Linit ffinal for the ConvNet models is provided in Appendix A3.
Limitations and Future Work
295
296
Our hypothesis can be extended to the correlation between Lipschitz constant and the quality of reconstructed samples, rather than loss drop. Zero gradient matching loss does not mean complete recovery of original images due to the existence of twin data 300, two different data input with identical model gradients. However,
297
empirically found that both L.- and L show positive monotonic correlations with the quality of reconstructed samples, in terms of LPIPS (lower value is
300
better) (Fig- 7). In particular, they beat the baseline measure, the norm of given gradients (I1g"112)
301
302
which was implicitly believed to be the amount of information within the gradients in previous works, by wide margin, in terms of rg. Therefore, we expect Lg- and Ieos to be the key factors for developing future client-side defense strategies.
303
304
Conclusions
305
306
Here, we re-evaluated the SOTA attack method on a broad spectrum of models in the context of batch reconstruction, which is rarely studied in previous works. We considered model variations of two types: implicit, which changes in model weights BN modes within the same architecture, and explicit, with changes in architecture. The re-evaluation results indicate that the quality of the reconstruction attack varies depending on the implicit or explicit model changes. Therefore, inspired by our theorem related to the convergence of gradient matching optimization and scale-invariance of the cosine similarity loss function, we propose an explainable and predictive measure for privacy leakage. an angular Lipschitz constant nns, which is invariant to trivial loss scaling attacks from malicious servers. We empirically find that I.00s shows a strong monotonic correlation with the
307
308
311
312
313
314
315
quality of reconstructed samples, thus expecting the potential of cos be key factor for clients' defense strategies in a black-box setting, where only model gradients are given minimal information about the global model to clients.

---

References
318
[1] H. H. Bauschke, J. Bolte, and M. Teboulle. A descent lemma beyond lipschitz gradient continuity: first-order methods revisited and applications. Mathematics of Operations Rexearch, 42(2):330-348, 2017.
320
321
[2] X. Chen, H. Fan, R. Girshick, and K. He. Improved baselines with momentum contrastive learning. arXiv preprint 2xir:2003.04297 2020.
322
323
[3] T. Dang, O. Thakkar, S. Ramaswamy, R. Mathews, P. Chin, and F, Beaufays. Revealing and protecting labels in distributed training. Advances in Neural Information Processing Systems, 34, 2021.
324
325
[4] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. lece, 2009.
327
328
[5] Duchi, E. Hazan, and Y. Singer. Adaptive subgradient methods for online learning and stochastic optimization. Journal of machine learning research, 12(7), 2011.
329
330
[6] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller. Inverting gradients-how easy is it to break privacy in federated learning? Advances in Neural Information Processing Syxtems, 33:16937-16947, 2020.
332
[7] H. Gouk, F. Frank, B. Pfahringer, and M. Cree. Regularisation of neural networks by enforcing lipschitz continuity. Machine Learning, 110(2):393 -16,, 2021.
[8] A. Hatamizadeh, H. Yin, P. Molchanov, A. Myronenko, W. Li, P. Dogra, A. Feng, M. G. Flores, Kautz, D. Xu, et al. Do gradient inversion attacks make federated learning unsafe? arXiv preprint arXiv:2202.06924, 2022.
335
336
337
[9] K. He, X. Zhang, S. Ren, and J. Sun, Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 770-778, 2016.
338
329
[10] Y. Huang, S. Gupta, Z. Song, K. Li, and S. Arora. Evaluating gradient inversion attacks and defenses in federated learning. Advances in Neural Information Processing Systems, 34, 2021.
[11] S. loffe and C. Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pages 448 456. PMLR, 2015.
342
343
[12] Jeon, K. Lee, S. Oh, J. Ok, et al. Gradient inversion with generative image prior. Advances in Neural Information Processing Systems, 34:29898-99908, 2021.
344
345
[13] D. P. Kingma and J. Ba. Adam: A method for stochastic optimization. In ICLR (Poster), 2015.
346
[14] J. Konečný, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint 161iv:1610005449 2016.
[15] A. Krizhevsky, Learning multiple layers of features from tiny images. 2009.
[16] O. Li, J. Sun, X. Yang, W. Gao, H. Zhang, J. Xie, V. Smith, and C. Wang. Label leakage and protection in two-party split learning. 2022.
350
351
[17] Q Li, Diao, Q. Chen, and Hc. Federated learning on non-iid data silos: An experimental study. 2021.
352
[18] X. Li and F. Orabona. On convergence stochastic gradient descent with adaptive stepsizes. In The 22nd International Conference on Artificial Intelligence and Statistics, pages 983 -922. PMLR, 2019.
353
354
[19] X. Li. M. JIAGG. X. Zhang, M. Kamp, and Q. Dou. Fedbu: Federated learning on non-iid features via local batch normalization. In International Conference on Learning Representations, 2020.
355
356
[20] V. V. Mai and M. Johansson. Stability and convergence of stochastic gradient clipping: Beyond lipschitz
continuity and smoothness. In International Conference Machine Learning, pages 7325-7335 PMLR, 2021.
358
359
[21] B. McMahan, Moore, D. Ramage, S. Hampson, and B. A. y Arcas. Communication-effice.. learning of
360
deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1283 PMLR, 2017.
381
[22] A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang. Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and 382
A. Lerer. Automatic differentiation in pytorch. 2017.
10

---

384
[23] S. Ruder. An overview of gradient descent optimization algorithms. arXiv preprint wrXiv1109904474
2016.
386
[24] S. Santurkar, D. Tsipras, A. Ilyas, and A. Madry. How does batch normalization help optimization? Advances in neural information processing systems, 31, 2018.
388
[25] D. Ye, T. Zhu, S. Zhou, B. Liu, and W. Zhou. Label-only model inversion attack: The attack that requires the least information. arXiv preprint arXiv:2203.06553 2022.
370
[26] H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov. See through gradients: Image batch recovery via gradinversion. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 16337-16346, 2021.
372
[27] J. Zeng, T.-K. Lau, S. Lin, and Y. Yao. Glohal convergence of block coordinate descent in deep learning. In International conference on machine learning, pages 7313-7323. PMIR, 2019.
375
[28] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features perceptual metric. In Proceedings the IEEE conference on computer vision and pattern recognition, pages 586-595 (066599,2220 2018.
377
[29] B. Zhao, K. R. Mopuri, and H. Bilen. idlg: Improved deep leakage from gradients. arXiv preprint wxxiv2201.006//1 2020.
379
[30] J. Zhu and M. B. Blaschko. g-gap: Recursive gradient attack on privacy. In International Conference on Learning Representations, 2020.
[31] L. Zhu, Z. Liu, and S. Han. Deep leakage from gradients. Advances in Neural Information Processing Systems, 32, 2019.
383
Checklist
384
385
The checklist follows the references. Please read the checklist guidelines carefully for information on
386
how to answer these questions. For each question, change the default [TODO] to [Yes]. [No], or [N/A]. You are strongly encouraged to include a justification your answer, either by referencing the appropriate section of your paper or providing a brief inline description. For example:
387
388
Did you include the license the code and datasets? [Yes] See Section ??.
390
Did you include the license the code and datasets? [No] The code and the data are proprietary.
Did you include the license the code and datasets? [N/A]
Please do not modify the questions and only the provided macros for your answers. Note that the Checklist section does not count towards the page limit. In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.
385
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes] We thoroughly listed the contributions of our work in both abstract and introduction.
389
400
(b) Did you describe the limitations of your work? [Yes] See Sec. 5 for limitations of our work and future research direction.
402
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms them? [Yes]
2. If you including theoretical results....
408
(a) Did you state the full set of assumptions of all theoretical results? [Yes] In Theorem | all the assumptions are included in the statement. The details are described in Appendix
A2.
11

---

409
(b) Did you include complete proofs of all theoretical results? [Yes] We include complete proofs in Appendix A2.
410
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as a URL)? [Yes] The details for experiments are partially described in Results section in Sec. S including Appendix.
413
414
415
(b) Did you specify all the training details (e.g.. data splits, hyperparameters, how they were chosen)? [Yes] All the training details for experiments described in Results section in Sec. 3
418
(c) Did you report error bars (e-g., with respect to the random seed after running experi- ments multiple times)? [Yes] We report standard deviation of our results in Tab. and
419
420
Fig. 2
421
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] We report them in Appendix A4.
422
423
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
424
(a) If your work uses existing assets, did you cite the creators? [Yes] We cited the creators for CIFARIOM 100, ImageNet, ConvNet, and ResNet18.
425
426
(b) Did you mention the license of the assets? [N/A]
427
(c) Did you include any new assets either in the supplemental material or as URL? [No]
428
(d) Did you discuss whether and how consent was obtained from people whose data you't 're using/curating? [Yes] We use data widely used in the field of research related to work
431
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
432
435
5. If you used crowdsourcing or conducted research with human subjects...
434
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
435
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
437
438
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
439
12


Reviews:
[{"review_id": "xUs2r5mVZzW", "reviewer": "Reviewer_F6kS", "summary": "This paper studied the gradient inversion problem where an honest-but-curious server aims to reveal clients’ private data from model weights and gradients shared by clients in federated learning (FL). The paper first evaluated SOTA gradient inversion algorithms (mainly [6] with an additional BN-related loss term), under implicit model variations (different BN modes and training epochs with the same model architecture) and explicit variations (different model architectures). The evaluation showed that the reconstruction results vary across model variations both qualitatively and quantitively. The paper then proposed a measure of angular Lipschitz constant to indicate the outcome of reconstruction, which was shown to be stronger correlated with LPIPS and attack loss drop than gradient norm.", "questions": "- The paper mentioned about knowledge of target labels and batch size in previous work. What are the related settings in experiments of this paper? Batch size may be an important factor for observing the effect of BN modes on the performance.\n- It is stated in Line 168 that the server “can send a global model with BN layers set to any mode”. But BN modes are about whether to use running mean/variance or current batch’s mean/variance in BN layers, and the computation is done on clients. How can an honest-but-curious server alter the BN mode without being noticed?\n- The computation of the angular Lipschitz constant (defined in Line 277) is done through randomly sampling from Gaussian. Can this measure be manipulated by scaling the input x^*, for fixed variance of Gaussian noises? Is the input x^* normalized to compute the measure?\n- In the theoretical result, the loss is guaranteed to monotonically decrease only when the step size \\mu is small enough (optimally =1/(2L^2)). Are the learning rates sufficiently small in experiments?\n- What is \\delta in Lines 458, 465 and 466?\n- BN statistics are used in two places in the inversion process, one in equation (2) as a loss term, and another in the BN layers of the networks (in train/eval modes). Which one affects the performance of inversion algorithms more significantly?\n", "limitations": "The paper discussed limitations in Section 5.", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The paper addressed an interesting problem of evaluating gradient inversion algorithms for different models. A systematic experimental study may help gain insights about the mechanism of gradient inversion.\n- The paper made a good summarization on the optimization-based gradient inversion approach and related prior art in Section 2.\n- The paper showed some interesting results regarding the BN train mode. Firstly, the inversion achieves the best quantitative performance at early training stages (e=5). Secondly, the inversion achieves best results for ResNet18 than for ResNet18-2 and ResNet18-4, showing that wider networks are not necessarily easier to attack.\n\nWeaknesses:\n- The main contribution of this paper seems ambiguous. The title and abstract suggest that the paper mainly proposes a new measure, angular Lipschitz constant, for assessing inversion attacks, but a large body of the paper focuses on re-evaluation of existing methods over model variations. While the re-evaluation is valuable, it should be more clearly stated as primary results or just motivational study.\n- The scope of re-evaluation of SOTA algorithms in this paper overlaps with [10], which focused on evaluating gradient inversion attacks and defenses. In particular, [10] evaluated the algorithm in [6] with BN loss term (as in equation (2) of this paper), and considered different settings on knowledge of BN statistics. What is the difference between the BN settings of this paper and [10]? A detailed discussion and comparison with [10] would be beneficial.\n- The re-evaluation of SOTA algorithms was performed on limited variations. If the empirical study is positioned as the primary contribution, a wider range of models may be considered, such as initialization schemes (pre-trained or random) and random seeds for implicit variations, and more architectures beyond ResNet18 with different widths for explicit variations.\n- The paper only considered CIFAR100 images in experiments, but not higher-resolution (e.g. ImageNet) images.\n- The paper motivates the proposed angular Lipschitz constant measure with the case that clients may only have access to gradients provided by the server. However, wouldn’t the client need white-box access to compute gradients using private local data for model training in FL? If the client only has black-box access, what is the interplay between model training, gradient inversion, and risk assessing (Section 4)? And how does the client compute the measure (in Line 277) through random sampling?\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "xNBK15Xket-", "reviewer": "Reviewer_9iUp", "summary": "This paper works on the privacy attacks in the black-box FL setting, specifically using the gradient inversion methods. The contribution is on the image tasks and empirically solid. Different aspects of models are systematically evaluated to identity the vulnerability to privacy attacks. The authors also propose a new measure, the angular Lipschitz constant, to measure the privacy risk.", "questions": "See \"Weakness\" and \"Limitations\".", "limitations": "The limitations are discussed in the paper. However, I believe there could be additional limitations that worth consideration. \n\nFor example, the experiment is very limited, only CIFAR datasets are tested, which contains tiny images only. It would be desirable to understand how the gradient inversion attack work on moderate images (e.g. CelebA or ImageNette) and even maybe on language samples.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n\nOverall the paper is well-written and tackles a clear task. The FL privacy is an important and practical concern, especially in the black-box setting in which the authors have worked on. The motivation of an honest-but-curious host could be realistic. Empirically speaking, the ablation study of BN modes, number of channels, skip connection, etc. is thorough. From a theoretical viewpoint, the proposed angular Lipschitz constant has nice properties (scale-invariance); the theorem has a premise reasonably justified.\n\nWeakness:\n\nMy main concern is the impact of this paper: the experiment is limited to one simple dataset, thus limiting my confidence that the trends observed in this paper can hold in a broader range of cases (see more comments in \"Limitations\"). All conclusions except the scale-invariant property of the new Lipschitz measure are empirical, which requires more experiments to support the trends claimed in the paper.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "vK9IqNrT59D", "reviewer": "Reviewer_vsQD", "summary": "The submission \"Foreseeing Privacy Threats from Gradient Inversion Through the Lens of Angular Lipschitz Smoothness\" is concerned with gradient inversion attacks in federated learning. The first part of this submission contains additional results and ablation studies about the success conditions of such attacks. The second part proposes a new measure of vulnerability that is claimed to be a key to client-sided defenses.", "questions": "Maybe I misunderstood the intent of the submission concerning the black-box setting. I would be glad about a correction or additional insights why this is a meaningful setting.", "limitations": "The submission discussses some limitations, however limitations of the proposed measure are not discussed. There is not enough evidence presented whether this really would be a key factor in future defenses.", "rating": 2, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 1, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I, unfortunately,  have several points of criticism with this work, which I will list out below:\n\n* This submission analyzes gradient inversion attacks as developed around 2019/2020, but of the analysis given in this submission has been included in other work also evaluating these attacks since. Questions brought up concerning batch normalization have been  already been analyzed in works such as Huang et al., \"Evaluating Gradient Inversion Attacks and Defenses\nin Federated Learning\", from last year's NeurIPS. Solutions to the normalization question have then been proposed in Hatamizadeh et al., \"Do Gradient Inversion Attacks Make Federated Learning Unsafe?\". Whether labels are required was also discussed in Huang et al., and work such as Wainakh et al, \"User Label Leakage from Gradients in Federated Learning\" have made strides towards showing that label knowledge is not a requirement for a succesful attack. The impact of training state in recovery success has been discussed several times, from Zhu et al, \"Deep Leakage from Gradients\", Geiping et al., \"Inverting Gradients - How easy is it to break privacy in Federated Learning\" and also appears in follow-up work such as Wei et al., \"A Framework for Evaluating Gradient Leakage Attacks in Federated Learning\".\n\n* The submission states that choices in Zhu et al., were based on the unavailability of automatic differentiation. Yet, AD was certainly already developed and present in 2018! These paragraphs in the related work are incorrect, and it is unclear what \"computed the loss in closed form\" here should mean. The existence of closed form solutions (which Zhu et al. do not employ, as they also backpropagate gradients using AD) is unrelated to the smoothness of the loss function. Zhu et al. use smooth activations because their optimization strategy is based on an L-BFGS solver that nominally requires well-defined higher-order derivatives. Later works use adaptive first-order optimizer and hence drop this requirement.\n\n* I am doubtful about the proposed black-box setting. The submission proposes a black-box setting in which the global model parameters are hidden from the user, but the user application requires these parameters to compute the update gradient. The parameters have to be send to the user device, and the user has full control over their device, so the users necessarily have access to model parameters as well. \n\n* Further, for a user to use known inversion attacks to gauge their loss of privacy is an inherently unsafe proposal. Even if a user uses these attacks themselves and finds that they cannot reconstruct their data, this is no guarantee of privacy! These attacks can only be used to prove vulnerabilty, never to ascertain safety.\n\n* The introduction mentions evaluation of additional models. However in the experimental section I find only the ConvNet and ResNet variations used in previous work?\n\n* Minor: The cited work by Bauschke, Bolte and Teboulle is one of their few work where Lipschitz smoothness of the gradient in the classical sense is not actually required, in contrast to how this work is cited here.\n\n* I like the general idea of the section concerning angular Lipschitz smoothness, but the concept makes up such a small part of the submission that it is difficult to quantify its effectiveness. The submission shows some correlation with attack success if measured in LPIPS, but the correlation is not overly strong and it is unclear whether this is a strong argument for robustness. LPIPS scores are only be a limited measure of safety. The main question here would be whether some threshold of angular Lipschity smoothness would imply that no reconstruction succeeds. The measure discussed in Yin et al., \"See through gradients\" might be helpful here. Further it would be necessary to discuss whether this measure is robust to adaptive attacks, meaning whether this proposed measure can be \"gamed\" by the attacker in some way. For example, angular smoothness might correlate with gradient obfuscation which would undermine its effectiveness.\n\n\n* From a more general vantage point, I do think that this submission makes a categorical mistake about the nature of safety. The submission shows scenarios where the (even unmodified) baseline attack works more or less well and concludes from this that the attack should be evaluated in more scenarios, but this misses the asymetric nature of safety research. It is not necessary for a single attack to work optimally in all scenarios, in each scenario the question is whether an attack could exist that breaks privacy. Will small modifications as discussed in this work, categorically defeat all attacks and prove a reliable defense in the future? Will angular smoothness defend against adaptive attacks that circumvent gradient matching losses?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "nIb39BY5G10", "reviewer": "Reviewer_f87g", "summary": "This paper first evaluate current gradient inversion attacks for both implicit and explicit model changes. It shows that when the batch norm mode, training epochs, skip connection or channel size is different, the result of gradient inversion attacks also changes. Finally, it proposes angular lipschitz smoothness and shows its positive correlation to the success of gradient inversion attacks.", "questions": "See weaknesses for details.", "limitations": "Yes, the authors fairly describe the limitations.", "rating": 3, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n1. It is the first paper to study gradient inversion attacks on the different settings of training procedures and models, including batch-norm mode, skip connection and channel size.\n2. Its second part tries to find another signal, which is able to indicate the leakage in the end. Such signal, if it has good performance, would be useful in practice.\n3. The paper is well structured.\n\n### Weaknesses\nThe main weakness of this paper is that some experiment results are not very reliable and and some conclusions from the results are ambiguous.\n1. Results of BN: \n    (a). Why all MSE numbers in table 1 are mostly larger than 1? If all images are lying in the 0-1 cube, MSE > 1 means nothing recovered.  However, results from previous work already shows the success of image recovery at some setting of BN.\n    (b). What is the conclusion from the BN experiment results?\n2. Results of skip connection: why the gradient inversion attack is failed for the ConvNet? [1] and its following work all shows the success for ConvNet.\n3. Results of channel size: the result \"the reconstruction quality worsens as the number of channels increases for BN set to the train mode\" is lack of explanation.\n4. Angular Lipschitz smoothness: The intuition from theorem 1 is that smaller L means faster dropping at one step of optimization. However, it doesn't mean the minimum value of L_grad^x would be smaller, i.e. the reconstruction result is better. As the experiment details are missed in both main text and appendix, I am hypothesizing it is likely due to the unfair optimization set-up, e.g. the larger L_grad might need more iterations to converge, etc.\n\nAs for the experiment set-up, what gradient inversion attack is evaluated for those experiments?\n\n[1] Zhu, Ligeng, Zhijian Liu, and Song Han. \"Deep leakage from gradients.\" Advances in neural information processing systems 32 (2019).\n\n-------After Discussion--------\n\nI have read all responses and I'll keep my score. Thank the authors for the clarification and the additional experiment results. I hope authors can improve their paper by incorporating these results in the revision and improve their writing by highlighting the conclusions for each setting (BN, skip connection, training stages etc.) with the clear conditions.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Reject