CAFE: Catastrophic Data Leakage in Vertical Federated Learning
Authors: Xiao Jin
Pin-Yu Chen
Chia-Yi Hsu
Chia-Mu Yu
Tianyi Chen
Venue: NeurIPS 2021 Poster (2021)
Keywords: Federated learning
data privacy
attack
defense

Abstract: Recent studies show that private training data can be leaked through the gradients sharing mechanism deployed in distributed machine learning systems, such as federated learning (FL). Increasing batch size to complicate data recovery is often viewed as a promising defense strategy against data leakage. In this paper, we revisit this defense premise and propose an advanced data leakage attack with theoretical justification to efficiently recover batch data from the shared aggregated gradients. We name our proposed method as catastrophic data leakage in vertical federated learning (CAFE). Comparing to existing data leakage attacks, our extensive experimental results on vertical FL settings demonstrate the effectiveness of CAFE to perform large-batch data leakage attack with improved data recovery quality. We also propose a practical countermeasure to mitigate CAFE. Our results suggest that private data participated in standard FL, especially the vertical case, have a high risk of being leaked from the training gradients. Our analysis implies unprecedented and practical data leakage risks in those learning settings. The code of our work is available at https://github.com/DeRafael/CAFE.

CAFE: Catastrophic Data Leakage in Vertical Federated Learning
Xiao Jin Rensselaer Polytechnic Institute unx2@rpi.edu
Pin-Yu Chen IBM Research pin-yu.chen @ @ibm.com
Chia-Yi Hsu
National Yang Ming Chiao Tung University
chiayihsu83 1188311165 @ gmail.com
Chia-Mu Yu
Tianyi Chen
National Yang Ming Chiao Tung University chiamuyu gmail.com
Rensselaer Polytechnic Institute chent & @@rpi.edu
Abstract
Recent studies show that private training data be leaked through the gradients sharing mechanism deployed in distributed machine learning systems, such as federated learning (FL). Increasing batch size complicate data recovery is often viewed as a promising defense strategy against data leakage. In this paper, we revisit this defense premise and propose an advanced data leakage attack with theoretical justification to efficiently recover batch data from the shared aggregated gradients. We name our proposed method as catastrophic data leakage in vertical federated learning (CAFE). Comparing to existing data leakage attacks, our ex- tensive experimental results on vertical FI. settings demonstrate the effectiveness of CAFE to perform large-batch data leakage attack with improved data recovery quality. We also propose a practical countermeasure to mitigate CAFE. Our results suggest that private data participated in standard FL., especially the vertical case, have high risk being leaked from the training gradients. Our analysis implies unprecedented and practical data leakage risks in those learning settings. The code our work is available at sttpps//eet http//gttttttttte//e waw.uuu..oomDeeaaaeee/eeeeee httpb///lpfppgg////////////////r
Introduction
Federated learning (FL) g 24 is emerging machine learning framework where central server and multiple workers collaboratively train a machine learning model. Some existing FL methods consider the setting where each worker has data of different set of subjects but sharing common features. This setting also referred to data partitioned or horizontal FL (HFL). Unlike the HFL setting, in many learning scenarios, multiple workers handle data about the each has a different set of features. This case is common in finance and healthcare applications [ In these examples, data owners (e.g., financial institutions and hospitals) have different records of those users in their joint user base, and so, by combining their features through FL., they can establish more accurate model. We refer this setting as ceature-partitioons
set of subjects, but
vertical FL (VFL).
Compared with existing distributed learning paradigms, FL raises new challenges including data heterogeneity and privacy (20] To protect data privacy, only model parameters and the change of parameters (e.g., gradients) are exchanged between server and workers 19 13]. Recent works have studied how malicious worker can embed backdoors replace the global model in FL 2 3 27 Furthermore, as exchanging gradients is often viewed as has been paid to information leakage from public shared gradients and batch identities.
protocols, little attention
In the context of data security and ethics, the possibility inferring private user data from the gradients in FL has received growing interests 10 14 21
known as the data leakage problems.
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

Original
CAFE
DLG
Cosine similarity
SAPAG
BN regularizer
GC regularizer
Figure
Visual comparison between CAFE (our method) with the state-of-the-art data leakage attacks including DLG [32, Cosine similarity [II. SAPAG [5 BN regularzier 2 and GC
regularizer [29] on Linnaeus VFL (4 workers, batch size 40 and batch ratio = 0.05).
Previous works have made exploratory efforts on data recovery through gradients. See Section 2 and Table [ for details. However, existing approaches often have the limitation of scaling up large-batch data recovery and are lacking in theoretical justification on the capability of data recovery, which may give false sense of security that increasing the data batch size during training can prevent data leakage 60]. Some recent works provide sufficient conditions for guaranteed data recovery, but the assumptions overly restrictive and can be sometimes impractical, such as requiring the number of classes to be much larger than the number of recovered data samples (29
To enhance scalability in data recovery and gain fundamental understanding data leakage in VFL., in this paper we propose an advanced data leakage attack with theoretical analysis on the data recovery performance, which call catastrophic data leakage in vertical federated learning (CAFE). As an illustration, Figure demonstrates the effectiveness of CAFE for large-batch data recovery compared to existing methods. The contributions of this paper are summarized follows.
C1) We develop new data leakage attack named CAFE to overcome the limitation of current data leakage attacks VFL. Leveraging the novel of data index and internal representation alignments in VFL, CAFE able to recover large-scale data in general VFL protocols.
C2) We provide theoretical guarantees on the recovery performance of CAFE, which permeates three steps of CAFE: (I) recovering gradients of loss with respect the outputs of the first fully connected (FC) layer; (II) recovering inputs to the first FC layer; (III) recovering the original data.
C3) To mitigate the data leakage attack by CAFE, we develop a defense strategy which leverages the fake gradients and preserves the model training performance.
C4) We conduct extensive experiments both static and dynamic VFL training settings to validate the superior data recovery performance of CAFE over state-of-the-art methods.
2 Related Work
Recovering private training data from gradients has gained growing interests in FL. Recently, popular method termed deep leakage from gradients (DLG) has been developed infer training data in efficient way without using any generative models or prior information. However, DLG

---

Table 1: Comparison of CAFE with saute-of-the-arrs data leakage attack methods in FL.
Optimization
Reported maximal batch size
Training while attacking
Theoretical guarantee
Additional information other than gradients
Method
termus
distance between real and fake gradients
DLG
8
No
No
No
iDLG kD
E2 distance
8
No
Yes
No
Cosine similarity. norm
8 (Mostly unrecognizable)
Inverting Gradients
Yes
Yes
Number of local updates
Frumework for Evaluating
Gradient Leakage MM
Eg distunce, lahel hased regualrizer
8
No
Yos
No
Gaussian kernel
SAPAG
25
funciton
8
No
R-GAP R1
recursive gradient loss
5
No
Yes
matrix defined in 3D
Eg distance, distances of the recovered fearure map
Number of Exclusive activated ncurons
Theory oriented 22
32
Yes
Fidelity regularioars. Group consistency regularizers
Ratch size og, mumher of classes Non repeating labels in batch
meddtwersio 30
48
No
No
distance, TV norm,
CAFE (ours)
Internal representation
(our hardware limit)
100
Yes
Yes
Batch indices
lacks generalizability on model architecture and weight distribution initialization 2 In analytical approach has been developed to extract accurate labels from the gradients. In another analytical approach has been developed derive the inputs before a fully connected (FC) layer. However, in [1 their method only works on a single sample input and fails to extend on a batch of data. In 1221, a new approach has been developed by recovering the batch inputs before the FC layer through solving linear equations. However, strong assumptions have been made for solving the equations and cannot guarantee data recovery in more general cases, In ( is claimed that a convolutional layer can always be converted to FC layer. However, the gradients of the original convolutional layer are still different from the gradients of the converted FC layer, which impedes data recovery. Besides the new loss function proposed in [11], several previous works design new loss functions or regularizers based on DLGG and try to make their algorithms work on more general models and weight distribution initialization. In 25 new Gaussian kernel based gradient difference is used as the distance measure. 31 recursive method attack procedure has been developed to recover data from gradients. However, in both P and 31I. the quality of recovery batch data is degraded. A recent work (29] proposes an algorithm named GradInversion to reconstruct images from noise based on given gradients. However, their theory and algorithm mostly built on strong assumptions and empirical observations. Although they successfully reconstruct a batch of training data, the reported batch size is still no larger than 48.
50
3 CAFE: Catastrophic Data Leakage in Vertical Federated Learning
In this section, we will introduce some necessary background of VFL and present our novel attack method. We consider the attack scenario where a conest-but-curionn server follows the regular VFL. protocols but intends to recover clients' private data based on the aggregated gradients. Our method is termed CAFE: Catastrophic data leakage in vertical federated learning. While CAFE can be applied to any type of data, without loss of generality, we use image datasets throughout the paper.
3.1 Preliminaries
VFL setting, FL can be categorized into horizontal and vertical FL settings [16. In this paragraph, we provide necessary background of VFL. Consider set of M clients: M= (1,
2,.... M) ). A dataset of N samples D = [(x,, Un ) n== are maintained by the M local clients, where is the data index. Each client m M associated with unique features set. A certain data point x,, in D
can be denoted by x, [x] 2 X,M]" where Xn,m is the m-th partition of the n-th sample
3

---

vector. The label set fyn hn=1 can be viewed special feature and is kept at the server certain local worker. Throughout this paper, we mainly study the VFL setting. CAFE can also be applied to HFL. if the data indices of each randomly selected batch are known to workers during training.
Use of VFL.. VFL is suitable for cases where multiple data owners share the same data identity but their data differ in feature space. Use cases of VFL appear in finance, e-commerce, and health. For example, in medical industry, test results of the same patient from different medical institutions are required diagnose whether the patient has certain disease or not, but institutions tend not to share raw data. Figure gives an example of VFI. in medical industry.
Positive?
Patient id
POCT test
PCR test
Vaccine records
Batch indices in each iteration. For a given batch size K, we define set of vectors with binary entries
Pharmacy
Hospital
Medicine Center
S {Si, S2, ..... ....... with |S] (x) For
Data id
Feature space
each vector s; N in S, its n-th element s; [n] can be either 0 or 1. There are in total K enires of '1' in
Figure 2: VFL among medical institutions
S; In each iteration the server randomly selects one
element from set S denoted by s', where s' [n] is the nith element in s The selected batch samples in /-th iteration are denoted by D(s') = {xx., Mn)) =
Loss function and gradients. We assume that the model is neural network parameterized by θ, where the first FC layer is parameterized by 0 gd and its bias b1 R24 The loss function on the batch data D(s') and on the entire training data D is, respectively, denoted by
C(O, (($))
Σ s' [ Xn, Un) and L(O,D)
Σ xn, N
1
(1)
The gradients of losses w.r.t. O is denoted as
(C((,,((ss)
N
AC(A, Xu, Un)
VoL(O, = 00
Σ
s' [m]
K
00
And similarly, we define VeL(O,
Why larch-batch data leakage attack is difficult?
We motivate the design of our algorithm by providing some intuition why performing large-batch data leakage from aggregated gradients is difficult [32]. Assume that K images are selected as the inputs for a certain learning iteration. We define the selected batch data D' {xn yn } Likewise, the batched 'recovered data' is denoted by D' [Kn, 9n)). Then the objective function is
D' arg min
Σ
VeL(O,xa.bh)
Σ
Vel(e, Xn, In)
(3)
K
(Xm:Bw)ED
(Kn.sn)ED
Note that 3 the dimensions of the aggregated gradients is fixed. However, as increases, the cardinality of D' and D' rise. When K is sufficiently large, it will be more challenging to find the "right" solution D' of 3 corresponding to the ground-truth dataset D'. On the other hand, CAFE addresses this issue of large-batch data recovery by data index alignment (defined next subsection), which can effectively exclude undesired solutions. We discuss a specific example in Appendix B
3.3
CAFE implementation
The main idea of our algorithm is that we divide the entire data leakage attack procedure into several steps. Specifically, we fully recover the inputs the first FC layers of the model that we term the internal representation with theoretical guarantee and use the internal representation regularizer to help improve the performance of data leakage attack. During the process, to overcome
learnt

---

Vec ((s))
Chex, 3ttr
Reconet grabenn of
Scd Own, 128 then
Tancl
Bisl Cindiinn
H
Ne Dats
woskkrr
Local
Resl Con Cu
Server
Co, 0.6h (P))
Retl Cratlen
CAFE Supp PC lepe
Singooop
Ve, C(e, D(s))
x4
Sorved lerpe
U
V
Real Candens
Facoo 1
PC bear Nanalhop
FCllees striede
Lacal
x4
worker
CAFE tup
Reil Dat
xl
Roceventt
Figure 3: Overview of CAFE, The left part (blue box) performs the regular VFL protocol and the right part (red box) illustrates the main steps of CAFE.
Figure 4: Model structure in VFL.
we fully use the batch data index known by the attacker the VFI. setting so that the system equation in can be determined instead of undetermined.
the difficulty mentioned Section 3.2
Notably, CAFE can be readily applied to existing VFL protocols where the batch data indices is assigned or other deep learning protocols as long as the batch data indices are given. In Figure the blue box represents the VFL paradigm and the red box denotes the attack paradigm.
Prerequisite:
In a typical VFL process, the server sends public key to local workers and decides the data indices in each iteration of training and evaluation ? 2 During the training process, local workers exchange their intermediate results with others to compute gradients and upload them. Therefore, the server has access to both of the model parameters and their gradients. Since data vertically partitioned among different workers, for each batch, the server (acting as the attacker) needs to send a data index or data id list to all the local workers ensure that data with the same id sequence have been selected by each worker 2 and we name this step as data index alignment. Data index alignment turns out to be an inevitable step in the vertical training process, which provides the server (the attacker) an opportunity to control the selected batch data indices.
In the rest of this subsection, explain algorithm CAFE in detail, which consists of three steps.
Step Recover the gradients of loss w.r.t the outputs of the first FC layer. As shown in Figure for a certain data point X,, we denote the inputs to the first FC layer as h, = 1((Q,,,, E Rd where h the forward function and e, is the parameters before the first FC layer. Let u, denote the outputs of the first FC layer in the neural network, given by
4
u = = hn + bj 12
For the training data D. the corresponding inputs before the first FC layer are concatenated as [ h2 ..... hyl IT R Nxd1 and the corresponding outputs of the first FC layer concatenated as U U1, U2 ................................ uN] T Nxdz, The gradients of loss w.r.t U can be denoted by
1 N V ((O,x,, x1, M.). V., C(O, X2, N2) VuN L(O, NN: ]N)]
VuL(e, D)
1 a x1, v1) O
acio, XN. UN. dun
E Nxd2 (5)
N au
du
For batch of data in the 1-th iteration D(s"), have
N
A Xn, vn)
N Σ
acie, x xz) Ou,
Vb, ((0,
Σ
s
[n]
s'nn K
Σ (1
K
Db
==1
==1
==1
N
Σ
sd
n V. ((O,D(s)))
Although we do not have access to VoL(O, D) as gradients are only given w.r.t. the model parameters, can successfully recover it through an iterative optimization process.
5

---

Algorithm Recover the gradients VuL(H,
Algorithm 2 Recover the inputs to the first FC layer H regular VFL and attacker
regular VFL and attacker
I: Given model parameters è and V 4Nd for ...,..., , do
1: Given @ trained V. initialize H ~ 2xd2
2: for / ...,....2 T do
3: Server select s' from S
3: Server select s' from S.
4: Server broadcasts @ and to all workers
4: Server broadcasts and s' workers ......... Worker m takes real batch data 7: Worker exchanges intermediate results with
for m ,,,, M do
5:
for m = 1, .......... M do
Worker m takes real batch data Worker m exchanges intermediate results with
6:
7:
other workers and computes Ve (ee, D)s*))
other workers and computes (e, Worker m uploads (eL(G,
8:
Worker uploads VeL(e, D(s'))
8:
9:
end for
9:
end for
10:
Server computes Vb, ((,, D(s'))
10:
Server computes Ve, ((e,
11:
Server computes (V:'') in
11: Server computes F2 in
12:
Server updates V with (V:s')
12:
Server updates H with F
13:
end for
13: end for
Algorithm 3 CAFE (Nested-loops)
Algorithm 4 CAFE (Single-loop)
1: Given model parameters O initialize V
1: Given model parameters O initialize V
x(dx H 4 Nx22 D (Sn, On )
UNdx1 H. NNd2, D {Sn: On )
2: Run Algorithms Mand 2 each for T iterations
2: for 1,2,.... . do
for 2,2..... I' do
Run Step 3-10 in Algorithm once Server computes (e Dis')) including V,, L(O, D(s")), Ve, C(e, D)s")
4: Run Step 3-10 in Algorithm Monce Server computes Ve D(s'))
Server computes the fake global aggregated gra-
5: Run Step 11 12 in Algorithm once
dients VeL(O, D(t))
6: Run Step 11 - 12 in Algorithm once
7: Server computes CAFE loss (D::') in
7: Server computes CAFE loss (D;
8:
Server updates with V & (D;ss'
Server updates D with V (D:s')
9: end for
9: end
Specifically, we randomly initialize an estimate of VuL(O,D) denoted as V, c.g. V
V1, V2... -n....s. vN]] RNNx,, where v, = [Vn,1 vn,1,.... dn, Rda, Given
L. ((s)), we recover VuL(O, by minimizing the following objective function
V" arg rigminHa Emitss) (V:s))) with Fi(V:s.) = V Vo, ((o,(()((s)) (7)
:>)iv))
In each iteration t, the objective function of Step is given by Fi (V:
The first step of CAFE summarized in Algorithm D which enjoys the following guarantee.
Theorem 1. If <,, the objective function Fi (V) in is strongly convex in V. For a fixed O applying SGD to 7 guarantees the convergence to the ground truth almost surely.
When the batch size smaller than the number of total data samples N, the Hessian matrix of Fi (V) is shown to be strongly convex in Appendix and the convergence is guaranteed according to 23 Step is essential in CAFE because we separate the gradients of loss w.r.t each single input to the first FC layer from the aggregated gradients in this step.
Step II: Recover inputs to the first FC layer. Using the chain rule, we have Ve, L(O,D) VvL(O, D)
Rdd xd2 We randomly initialize an estimate of H as H
h, hy...., hay..., hw] E Nxd, where h, [ h..,,,... In.d,) 1T
E Rd. Given
Ve, ((),)(ss)) and V", we recover by minimizing the following objective
H arg min E Unif (H:s.) with FHi:)
Σ (v
(v,
H
:F)
(8)

---

In each iteration E, the objective function of Step II can be denoted by F2(H:s").
Through the first two steps, parts of the information about the data have already been leaked. Step II also has the following guarantee.
Theorem 2. If N < d2 and Rank(V") = N, the objective function F2 is strongly convex. When C keeps unchanged, applying SGD guarantees the convergence of H to H.
Our experiment setting satisfies the assumption, c.g., N 800 and d2 1024, and thus the convergence is guaranteed according to [23]. The proof of Theorem 2 can be found in Appendix D In some simple models such as logistic regression or neural network models only containing FC layers, the attack will recover the data only by implementing the first two steps.
Step III: Recover data. We randomly initialize the fake data and fake labels followed by uniform distribution D {&n, In J According to equation ① we have h, h h(Oc,, kn) E
Given (( and H", our objective function in the last step is
D' = arrg min Uni))))) 7
(9)
D
with
+7
[m (H
(n
where 8 and y are coefficients, TV (s:)) the truncated total variation (TV) norm which is if the TV-norm of (s,)) = (&,, [s 1) is smaller than ç. and Dss,) {{8m. Un (ss((r) [n] 1]- In each iteration the objective function of step IIII is FD s¹). The first term in 9 is the E norm in [2.. The second term is the TV norm and the last term is the internal representation norm regularizer.
We also define (DF = vVx. sD) a. FD )
To ensure attacking efficiency, consider two flexible update protocols in CAFE - Algorithm B CAFE (Nested-loops) and Algorithm R CAFE (Single-loop). Empirically, Algorithm $
will take fewer iterations than those of Algorithm 3 More details can be found in the experiment results in
Section
We also discuss the theoretical guarantee for each step and its proof in Appendix
3.4 Defense strategy: Leveraging fake gradients countermeasure to CAFE
Although CAFE comes with theoretical recovery guarantees, the underlying premise that the clients will upload true (correct) gradients for aggregation. Therefore, propose intuitive and practical approach to mitigate CAFE by requiring each client to upload fake (but similar) gradients, resulting in incorrect data recovery via CAFE. Specifically, to solve the problem of leakage from true gradients, we design defense called Fake Gradients and summarize in Algorithm 5 of Appendix F The main idea of this defense is that attackers will aim match wrong gradients and invert incorrect inputs to the first FC layer so that attackers cannot recover the true training data. The defending strategy in Algorithm (Appendix (F) can be added between Line 8 and 9 in Algorithms [and
As summarized in Algorithm 5 (Appendix D. each local worker can randomly generate gradients with the normal distribution N (0, o²) and sort the elements in descending order (Line 1 At the same time, local workers also sort their true gradicnts in descending order and record indexes of the sorted items (Line 7). Then, one computes the L2-norm distance between true gradient and all fake gradients to find the nearest fake gradient (Line [2]. Afterwards, we pair fake gradients to match true gradients by the sorted order (Line 17 This an important step that we can keep large/small values at the same positions of true gradients. Finally, local workers upload the fake gradients to the server.
Impact on model training. Chen et al. 5 has proved that if the distance between the actual gradients and the gradient surrogate is smaller than a decreasing threshold, using the gradient surrogate to update the model still guarantees convergence. Building upon the results in [5), we set sufficient threshold such that the distance between the fake gradients and the true gradients are smaller than the threshold. In this case, can still achieve the learning performance as if true gradients are used.
7

---

Table 2: Comparison with the state-of-the-art
Table 3: PSNR vs batch size
(M = 4, K 40, batch ratio 0.05)
(800 data samples in total)
PSNR
Datasel
PSNR
Dataset
CIFAR-10
MNIST
Linnacus 5
K
CIFAR-10
MNIST
Linnacus
Method
32.60
28.00
CAFE
31.83
43.15
33.22
35.70 70
39.00
30.53
DLG
9.29
7.96
7.14
31.83
43.15
33.22 22
Cosine Similarity
7.38
7.84
8.31
80
36.87
47.05
30.43
SAPAG
6.07
3.86
6.74
100
38.94
47.50
29.18
BN regularizer
18.94
13.38
8.09
GC regularizer
13.63
9.24
12.32
Origina dats
WNST
8
8
8
8
8
CAFE Bike gradions
CARS
a-e
Figure 6: Visual comparison the real and recovered data
Figure 5: Visual comparison on the
using ordinary and fake gradients.
effect of auxiliary regularizers.
4 Experiments
datasets in VFL settings. Our algorithm recovers all the data participating in VFL with a relative large batch size (more than 40). Scaling up to our hardware limits (RTX 2080 and TITAN V). CAFE can leak as many as 800 images in the VFL setting including 4 workers with a batch size as large as 100. The neural network model architecture used in the simulation is shown in Figure To measure the data leakage performance, we the peak signal- to-noise ratio (PSNR) value and the mean squared error (MSE). Higher PSNR value of leaked data represents better performance of data recovery.
We conduct experiments on MNIST 18] CIFAR-10 17 and Linnaeus 5
The hyper-parameter settings shown in Appendix G.
4.1 Comparison with the state-of-the-art
We compare CAFE with five state-of-the-e methods using the batch size of 40 images in each iteration. For fair comparisons, all methods were run on the the same model and iterations.
i) DLG [32]:
The deep gradients leakage method is equivalent to replacing the objective function in with the squared l norm distance.
Cosine Similarity [I] The objective function is equivalent to replacing the objective function in with the linear combination of cosine similarity and TV norm of the recovered images.
iii) SAPAG 25
The objective function equivalent replacing the objective function in with the Gaussian kernel based function.
iv) Batch normalization (BN) regularizer
29
The objective function is equivalent to replacing
the TV norm and internal representation norm in ?
with the batch normalization regularizer 29
v) Group consistency (GC) regularizer
29 The objective function is equivalent to replacing the
TV norm and internal representation norm in with the group consistency regularizer 22
In GradInversion of non-repeating labels in the batch is hard to be satisfied in datasets such as CIFAR-10, MNIST and Linnaeus In those datasets, we use batch size more than 40, which is larger than the number still compared our CAFE the methods by using the batch
2 several additional assumptions have been made. For example, the assumption
of classes (10 5). Nevertheless, normalization regularizer and group consistency regularizer mentioned in 29 in CAFE.
Theory-driven label inference methods have been proposed in 30 and 27 However, our attack mainly deals with training data leakage rather than labels. In 22 authors proposed a sufficient requirement that "each data sample has at least two exclusively activated neurons at the last but one layer". However, in our training protocol, the batch size too large and is almost impossible to ensure that each selected sample has at least two exclusively activated neurons. In (31,, it is assumed that the method will only return linear combination of the selected training data, which a very restricted assumption. As the results, we did not compare those methods in Table 2

---

Table 4: Effect of auxiliary regularizers (M- 4, K 40, batch ratio 0.05)
Table 5: Nested-loops vs single-loop CAFE
(M-
4, K 40, batch ratio 0.05)
PSNR
Datasets
Iterations
mode
CIFAR-10
Linnaeus 5
MNIST
CIFAR-10
MNIST
Linnaues 5
Datasets
Algorithm
CAFE
31.83
33.22
43.15
Single loop
(8000)
7300
(8000)
6600
(20000)
12400
CAFE (a 0)
33,93
28.62
31.93
Nested-loups
8000
8000
12428
Step
(8000)
(8000)
(20000)
CAFE (C 0)
25.57
25.29
34.51
Nested-loops
2404
8000
20000
CAFE (3 0)
18.25
23.22
31.98
Step
(8000)
(8000)
(20000)
CAFE
12.51
12.37
6.34
Nested-loops
1635
2468
20000
Step III
(8000)
(8000)
(20000)
Thanning bag
tuu gradients
laee gradienis
Table 6: Effects of number workers M
(K 40, batch ratio = 0.05)
Steps
Scops
Stops
Datasets
CIFAR 10
Limusess
MNNSTT
(a) CIFAR-10
(b) Linnaeus
(c) MNIST
31,83
33:22
Figure 7: Training loss of true gradients and fake gradients on CIFAR-10, Linnaeus and MNIST.
16
28.39
39:85
39.28
CAFE outperforms these methods both qualitatively (Figure 1 and quantitatively (Table 2 Its PSNR values are always above 30 at the end of each CAFE attacking process, suggesting high data recovery quality. However, the PSNR of other methods are below 10 on all the three datasets.
4.2 Ablation study
We test CAFE under different batch size, network structure and with/without auxiliary regularizers.
(i) PSNR via Batch size K. Table shows that the PSNR values always keep above 30 CIFAR-10. above 32 on MNIST and above 28 on Linnaeus 5 when the batch size K increases with fixed number of workers and number of total data points. The result implies that the increasing K has almost no influence on data leakage performance of CAFE and it fails to be an effective defense.
(ii) PSNR via Epoch. Theoretically, given infinite number of iterations, we prove that we can recover VuL and H because the respective objective function in 7 and (8) in our paper is strongly convex long N < d2 and Rank(V") N in Sections C and D of supplementary material. The corresponding experimental results and analysis are shown in Appendix G.2
(iii) Effect of regularizers. demonsttatts the impact of regularizers. From Figure 5 adjusting the threshold prevents images from being over blurred during the reconstruction process. TV norm can eliminate the noisy patterns on the recovered images and increase the PSNR. We also find that the last term in P the internal representation norm regularizer, contributes most the data recovery. In Table CAFE still performs well without the first term (a 0) in D The reason is that the internal representation regularizer already allows data to fully recovered. Notably, CAFE also performs well on MNIST even without the second term (3 = 0) in ( It is mainly due to that MNIST is simple dataset that CAFE can successfully recover even without the TV-norm regularizer.
(iv) Nested-loops vs single-loop. We compare both modes of CAFE (Algorithms 3 and 4 on all datasets. In Table the number of iterations is the maximum iterations each step. For the CAFE (single-loop). if the objective function in step 7 decreases below 10-9, we switch to step II. If the objective function in step value reaches 27 on 10, 30 on Linnaeus 5, 38 on MNIST, we stop both algorithms and record the iteration numbers. As shown Table 3 CAFE single-loop requires fewer number of iterations. Meanwhile, it is difficult to set the loop stopping conditions in the CAFE Nested-loops mode. In particular, V and H' with low recovery precision may impact the data recovery performance.
decreases below 5 x 10-9, we switch step III. When the PSNR
(v) Effects number workers M. Although data are partitioned on feature space across workers, the dimension of the entire data feature space is fixed and independent of M. Therefore, increasing number of workers theoretically does not change the dimension of variables associated with data recovery in Dh. In practice, different from HFL, where there could be hundreds of workers, in VFL,

---

Table 7: Attacking while training in VFL
Table 8: Training while attacking on MNIST
(SNR(())
Setting
# of ilerations
PSNR value
Training loss
Testing securacy
2
Datasei
5.07
2.36
0.11
31.24
62
25.22 (10
2000
11.68
2.31
0.27
CIFARIO
(10"*)
(5 x 10 9)
6000
18.07
1.99
0.51
28.42
MNIST
(10-1)
10m1)
(10-9)
10000
18.12
1.82
0.64
15000
16.86
1.63
0.65
30.74 (10-")
21.45
20.68
Linnacus 5
(5 x 10-9)
(10-9)
20000
20.72
1.68
0.68
the workers are typically financial organizations companies. Therefore, the number of workers is usually small [3]. In Table 66 we compare the results of 4 workers with 16 workers following the same experiment setup. The CAFE performances comparable.
4.3 Tests for attacking while training scenarios
Previous works have shown that DLG performs better on an untrained model than trained one M This is also true for CAFE. Our theoretical analysis can provide the partial reason. When the model trained or even convergent, the real gradients of loss can be very small. is possible that the value of the recovered VuL(e, D) will also be close to O. In that case, it can be difficult to recover H.
We also implement CAFE in the "attacking while training' scenario, in which we continuously the VFL process. When the model is training, both of the selected batch data and the model parameters change every iteration, which may cause the attack loss diverge. However, from our experimental results in Table 7 CAFE is able to recover training images when the learning rate (Ir) is relatively small. Increasing the learning rate renders data leakage more difficult because the model is making more sizeable parameter changes in each iteration, which can be regarded as an effective defense strategy. According to our experiment in Table the model indeed converges with relative small learning rate (e.g., Adam with learning rate 10 6, trained on 800 images, tested on 100 images, batch size K 40), which indicates that we can conduct our attack successfully while model converging. The data indeed leaks to certain level (PSNR above 20) while the model converges at certain accuracy (0.68), which indicates that CAFE works in an attacking while training scenario.
4.4 Mitigation of CAFE data leakage attack via lake gradients
Training and defense performance. To demonstrate how fake gradients defend against CAFE (Section 3.4) we conduct CAFE with unchanged θ, which the strongest data leakage attack setting. We use the SGD optimizer with learning rate set as 0.1, o² 1.1, and // = 1000 for fake gradients. Figure 6 shows a comparison between the visual image quality of the data recovered by CAFE on CIFAR- 10 when the ordinary gradients and fake gradients are used, respectively. The PSNR of recovered data in CAFE on ordinary and fake gradients is 28.68 and 7.67, respectively. Moreover, Figure / shows that the training process with fakes gradients behaves in similar way to the one with true gradients. confirming that the use of fake gradients does not lose the training efficacy. We have also added the experiment to discuss the difference of our fake gradients method to differential
privacy (DP). The results and analysis are shown in Appendix G.3
4.5 Recover human face data
We also implement CAFE on Yale 32 x 32 human face dataset [12). which achieves the PSNR above 42. The recovered data are shown Appendix G.4 implies that CAFE can fully recover data that requires privacy protection such as facial images.
5 Conclusions
In this paper, we uncover the risk of catastrophic data leakage in vertical federated learning (CAFE) through a novel algorithm that can perform batgh data leakage with high data recovery quality and theoretical guarantees. Extensive experimental results demonstrate that CAFE can recover large-scale private data from the shared aggregated gradients on vertical FL settings, overcoming the batch limitation problem current data leakage attacks. We also propose an effective countermeasure using fake gradients to mitigate the potential risks of CAFE.
10

---

Acknowledgments
This work was supported by National Science Foundation CAREER Award 2047177, and the Rensselaer-IBM Al Research Collaboration hhttp://airc .rii edu), part of the IBM AI Horizons Network (http://ibm. biz/AIHorizons) C-Y Hsu and C-M Yu were supported by MOST 110- 2636-E-009-016 88, and we also thank National Center for pigh-peeffrmance Computing (NCHC) of National Applied Research Laboratories (NARLabs) Taiwan for providing computational and storage resources.
References
[1] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L Zhang. "Deep learning with differential privacy". Proc. the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308-318, Vienna, Austria, Oct, 2016.
[2] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov. "How to backdoor federated learning". In Proc. the Twenty Third International Conference on Artificial Intelligence and Statistics, volume 108 of Proceedings of Machine Learning Research, pages 26-28 Aug 2020.
PMLR,
[3] A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo. "Analyzing federated learning through an adversarial lens". In Proc. International Conference on Machine Learning, pages 634-643 Long Beach, California, 2019.
[4] G. Chaladze and L. Kalatozishvili. Linnaeus dataset for machine learning, 2017.
[5] Chen, G. Giannakis, T. Sun, and W. Yin. "LAG:
lazily aggregated gradient for communication- efficient distributed learning". In Proc. Advances in Neural Information Processing Systems, volume 31, Montréal, CANADA, 2018.
[6] T. Chen, X. Jin, Y. Sun, and W. Yin. "VAFL: a method of vertical asynchronous federated learning". arXiv preprint: 2007.0608/11 Jul, 2020.
[7] K. Cheng, T. Fan, Y. Jin, Y. Liu, Chen, and Q. Yang. "Secureboost: A lossless federated learning framework". In Proc. The 1st International Workshop on Federated Machine Learning for User Privacy and Data Confidentiality (FML'19) conjunction with IJCAI, 2019.
[8] T. Chilimbi, Y. Suzue, J. Apacible, and K. Kalyanaraman. "Project adam: Building an efficient and scalable deep learning training system". In /sh USENIX Symposium Operating Systems Design and Implementation (OSDI 14), pages 571-582, Broomfield, CO, October 2014.
[9] I.. Fan, K. Ng. C. Ju, T. Zhang, C. Liu, C. S. Chan, and Q. Yang. "Rethinking privacy preserving deep learning: How to evaluate and thwart privacy attacks". Federated Learning Privacy and Incentive, volume 12500 of Lecture Notes in Computer Science, pages 32-50. Springer, 2020.
[10] M. Fredrikson, S. Jha, and T. Ristenpart. "Model inversion attacks that exploit confidence information and basic countermeasures". In Proc. the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 1322-1333, New York, NY, USA, 10 2015.
[11] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller. "Inverting gradients how easy is it to break privacy in federated learning?". ?". In Proc. Advances in Neural Information Processing Systems, 2020.
[12] A.S. Georghiades, P.N. Belhumeur, and D.J. Kriegman. "From few to many: Illmmiaaiion models for face recognition under variable lighting and pose". IEEE Trans. Pattern Anal. Mach. Intelligence, 23(6):633666 2001.
[13] C. He, S. J. So, M. Zhang. Wang, X. Wang, P. Vepakomma, A. Singh, H. Qiu, L. Shen, P. Zhao, Y. Kang, Y. Liu, R. Raskar, Q. Yang, M. Annavaram, and S. Avestimehr. "Fedml: A research library and benchmark for federated machine learning". In Proc. Advances Neural Information Processing Systems Workshop: SpicyFL 2020, 2020.
11

---

[14] B. Hitaj. G. Ateniese, and F. Pérez-Crus Deep models under the GAN: information leakage from collaborative deep learning. In Proc. the 2017 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA, 2017.
[15] F.N. landola, K. Ashraf. M. W. Moskewicz, and K. Keutzer, Firecaffe: near-linear acceleration of deep neural network training on compute clusters. In Proc. 2016 IEEE Conference Computer Vision and Pattern Recognition (CVPR), pages
Los Alamitos, CA, USA, Jun 2016.
[16] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawit, 7. Charles, G. Cormode, R. Cummings, R. G. L. D'Oliveira, H. Fichner, S. EI Rouayheb, D. Evans, J. Gardner, Z. Garrett, A. Gascón, B. Ghazi, P. B. Gibbons, M. Gruteser, Z. Harchaoui, C. He, L. He, Z. Huo, B. Hutchinson, J. Hsu, M. Jaggi, T. Javidi, G. Joshi, M. Khodak, J. Konecný, A. Korolova, F. Koushanfar, S. Koyejo, T. Lepoint, Y. Liu, P. Mittal, M. Mohri, R. Nock, A. Özgür, R. Pagh, H. Qi. D. Ramage, R. Raskar, M. Raykova, D. Song, W. Song, S. U. Stich, Z. Sun, A. Theertha Suresh, F. Tramèr, P. Vepakomma, J. Wang, L. Xiong, Z. Xu, Q. Yang, F. X. Yu, H. Yu, and S. Zhao. " "Advances and open problems in federated learning". arXiv preprint: 191.. 1912.04977, 04977, December 2019.
[17] A. Krizhevsky and G. Hinton. "Learning multiple layers of features from tiny images". Master's thesis, Department of Computer Science, University of Toronto, 2009.
[18] Y. LeCun and C. Cortes. MNIST handwritten digit database. 2010.
[19] M. Li. "Scaling distributed machine learning with the parameter server". In Proc. the 11th USENIX Conference on Operating Systems Design and Implementation, pages 1-1, Broomfield, CO, USA, 08 2014.
[20] H. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Arcas. "Communication--ffcciein learning of deep networks from decentralized data". In AISTATS, Ft. Lauderdale, FL, USA, 2017.
[21] L. Melis, C. Song, E. D. Cristofaro, and V. Shmatikov. "Inference attacks against collaborative learning". In Proc, the 35th Annual Computer Security Applications Conference, page 148-162, New York, NY, USA, 2018.
[22] X. Pan, M. Zhang, Y. Yan, J. Zhu, and M. Yang. "Theory-oriented deep leakage from gradients via linear equation solver". In arXiv eprint 2010.13356, 2020.
[23] A. Rakhlin, O. Shamir, and K. Sridharan. "Making gradient descent optimal for strongly convex stochastic optimization". In Proc. International Conference on Learning Representations, Edinburgh, Scotland, 2012.
[24] R. Shokri and V. Shmatikov. "Privacy-preserviie deep learning". In Proc. the 22nd ACM SIGSAC Conference on Computer and Communications Security, page 1310-1321, Denver, Colorado, USA. 2015.
[25] Y. Wang. J. Deng, D. Guo, C. Wang, X. Meng, H. Liu, C. Ding, and Rajasekaran. Sapag: self-adaptive privacy attack from gradients. arXiv, eprin::0009.06228, 2020.
[26] W. Wei, L. Liu, M. Loper, K. H. Chow, M. Gursoy, S. Truex, and Y. Wu. "A framework for evaluating gradient leakage attacks in federated learning". arXiv, eprint 2004. 10397, 2020.
[27] C. Xie, K. Huang, P. Chen, and B. Li. "DBA: Distributed backdoor attacks against federated learning". In International Conference on Learning Representutions, Addis Ababa, Ethiopia, 2020.
[28] Q Yang, Y. Liu, T. Chen, and Yongxin Tong. Federated machine learning: Concept and applications. ACM Trans. Intell. Syst. Technol., 10(2), January 2019.
[29] H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov. "See through gradients: Image batch recovery via gradinversion". In Proc. Conference on Computer Vision and Pattern Recognition, 2021.
12

---

[30] B. Zhao, K. R. Mopuri, and H. Bilen. idlg: Improved deep leakage from gradients. arXiv, eprint:2001.02610, 2020.
[31] Zhu and M. B. Blaschko. "R-GAP: Recursive gradient attack on privacy". In International Conference Learning Representations, 2021.
[32] L.. Zhu, Z. Liu, and S. Han. "Deep leakage from gradients". In Advances in Neural Information Processing Systems 32, pages 14774 14784, Vancouver, Canada, 2019.
13


Reviews:
[{"review_id": "j9GeIv7BThj", "reviewer": "Reviewer_kAc7", "summary": "\nThis paper proposes an information leakage attack (i.e., CAFE) that can recover data samples from aggregated gradients against a  FL setting. The proposed attack first recovers gradients of loss with respect to the outputs of the first fully connected (FC) layer. It then recovers the first FC layer's inputs. Finally, it recovers the original data samples by optimizing an objective that consists of the traditional gradient matching objective and two auxiliary regularizers:  a TV norm term and an internal representation regularization term. The paper provides both theoretical analysis and numerical verification about CAFE's performance. Experiments show that the proposed method outperforms some of the previous works. ", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "[Strengths]\n\n1. The paper presents an information leakage attack against FL.\n2. In addition to numerical results, the paper also presents a theoretical guarantee of the proposed method's performance.\n3. The paper also provides a defense mechanism to mitigate the proposed attack.\n\n[Weaknesses]\n\n1. My main concern of the proposed method is that it might not generalize to a typical FL setting where the clients only send their own model updates to the server (without communicating with other workers). The authors might want to clarify how the proposed method can generalize to the traditional FL setting. Otherwise, the contribution of the paper would be quite limited. \n2. In the experiments, only three baselines are selected: DLG, cosine similarity, and SAPAG. More recent and more advanced methods  (e.g., Inverting gradients [Geiping et al., 2020], GradInversion [Yin et al., 2021]) are not included for comparison. \n3. The FL setting in the experiments only includes four workers. In practice, an FL system usually consists of hundreds of or even thousands of clients. The proposed method works in VFL, in which local agents need to exchange updates with other workers to compute the gradients.  \n4. Some of the concepts are a bit vague. For instance, the paper mentions \"data index alignment.\" However, it does not provide a clear definition or explanation. ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "See the main review.", "review_text": "", "extra_scores": {"ethical_concerns": "N/A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "12"}, "extra_text": {}}, {"review_id": "LlKSVwM2do", "reviewer": "Reviewer_PDMg", "summary": "This paper studies recovering sensitive training data from vertical federated learning (VFL) process, where same set of training data is shared among the clients, but each has distinct set of features. The authors leveraged the data indices (or batch indices) to reliably recover internal representations, which in turn helps to recover the input training data with high quality. The experimental results validate the effectiveness of the proposed approach. ", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "$\\textbf{Originality}$: I do not have enough knowledge about the related work, but utilizing the data indices to design stronger model inversion attack seems to be new. To the best of the reviewer's knowledge, related work is adequately cited. \n\n$\\textbf{Quality}$: the proposed approach is technically sound and the claims are well supported by the experimental results. I think it is a clever idea to utilize known data indices (although somewhat limits its application scenario) to recover some intermediate representations, which I believe gives the final optimization process (of recovering the input training data) an even finer control and improves the recovery quality.   \n\n$\\textbf{Clarity}$: the paper is very well written and is easy to follow. There are some typos in the paper: in page 3, for the definition of $\\mathcal{D}(s^t)$, it should be $s^t[i]$ instead of $s^t[n]$? \"betch size\" in page 7. \n\nRegarding the baselines in page 8, the justifications for not including some methods in Table 1 is not satisfactory. For example, the reason \"... require certain conditions which may fail to satisfy\" is too ambiguous. I am fine with not including certain baselines with justifiable reasons, but they need to be very precise. When experimenting with the fake gradient based defense, it will be better to also report the training and testing accuracy for more intuitive understanding. In terms of writing, I think it will improve the paper if the authors can describe the high level motivation of designing multi-stage attack at the beginning of the paper. My current understanding is, multi-stage attack is preferred because it gives adversaries finer control over the optimization process of data recovery, and a side benefit is, some sensitive intermediate representations are also revealed. If my understanding is correct, then one follow-up question is, why not make the analysis even finer by recovering the inputs to the convolutional layers?  \n\n$\\textbf{Significance}$: the method is not general enough and only applies to the special VFL setting where the data indices are known. In other FL settings, data indices are generally unavailable and the proposed method will not work. But I believe VFL is still an important setting and stronger attacks tailored for this specific setting are also valuable. \n\nIn the experiment section, comparison to the baselines might be an apple to orange comparison. The reviewer is only familiar with the two baselines [10], [26], but these two methods are actually very general and do not need the knowledge of data indices. Therefore, it is expected that in VFL setting with large batch sizes, this type of baselines will perform worse. I believe for the general FL setting where data indices are unavailable, larger batch size is still an effective defense. \n\nWhen designing a defense in VFL setting, one straightforward option is to apply differential privacy during model training. I think the authors should discuss the difference of their method to differential privacy and it will be very impressive if the proposed method outperforms DP experimentally by providing better model utility while protecting the data privacy. ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors addressed the limitations and potential negative impact. ", "review_text": "", "extra_scores": {"ethical_concerns": "N/A.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "4"}, "extra_text": {}}, {"review_id": "47LS43ound", "reviewer": "Reviewer_a7yr", "summary": "This paper proposes a method for the server to recover the batch data from the gradients obtained in vertical federated learning. The recovery process is based on the use of data indices of the batch which are known.  The recovery contains three steps, and the most important nouvel part is to recover the first input of a fully connected layer for every data sample in the batch ($H$ in the paper) and then introduce it as a metric in the final recovery objective function.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "CAFE recovers the whole data as it makes use of the indices of the batch that other previous strategies have no access to. It keeps recovering every image as time goes on i.e., making use of all the collected gradients. If the global model is unchanged (not in a training mode), the authors prove that CAFE recovers the optimal $H$.\n\nOverall the strategy is quite original but with strong assumptions. It may be better to mention in the title that it is for vertical federated learning. As for horizontal federated learning (the one we think about first when we mention FL), it is not realistic that the server would know the batch indices.  Besides, as the authors pointed out, the attack will be weak while training (that’s to say that $\\Theta$ changes according to the FL procedure), as it is harder to recover $H$ which depends on $\\Theta$. Thus, CAFE works well only when the learning rate in training is small. This limitation is better to be mentioned in the early pages. Although the leakage seems to be catastrophic, there are limitations for the efficiency of this attack.    \n\nSome other comments:\n1. Lines 221 - 224: Can you explain why data leakage performance of CAFE is independent of the batch size? Do the experiments in Table 3 share the same T? If the same T is used, from the attack perspective, larger batch size may help the algorithm to approximate $H$ and thus favors the CAFE performance.  \n2. I got confused about the names of the algorithm 3 and 4. Should algorithm 3 be the single-loop one and algorithm 4 be the nested one? There are contradictory conclusions on the performance of these algorithms in lines 167-168 and lines 240-241.\n3. It may be interesting to show the convergence plot for experiment 4.3 with small learning rate. In addition, as mentioned in the paragraph, it would be great to study as well if CAFE works better on an untrained model.\n4. In algorithm 4, line 5 should be “Run step 11-13” and line 6 should be “Run step 11-13”?\n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes, the authors have adequately addressed the limitations and potential negative societal impact of their work", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "10"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers were not strongly positive about the paper. The reviewers had a recurring concern over the distinction between Vertical Federated Learning (VFL) and Horizontal Federated Learning, probably the more common one. I would recommend the authors to update the title and make a clear distinction in the introduction itself, to keep the expectation of the reader focussed on VFL. Also, reviewer kAc7 had some concerns about the vagueness in the definition of concepts in the paper, which needs to be addressed.
Decision: Accept (Poster)